feat(msg): graphql subgraph with dataloader for notification/template

- GraphQLModule: Apollo Federation 2 at /graphql

- Notification/NotificationTemplate @key with @ResolveReference

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- batchFindByIds added to notifications and templates repositories

services/msg/src/templates/templates.repository.ts

@@ -1,4 +1,4 @@
-import { and, eq, type SQL } from "drizzle-orm";
+import { and, eq, inArray, type SQL } from "drizzle-orm";
 import { createId } from "@paralleldrive/cuid2";
 import { getDb } from "../config/database.js";
 import {
@@ -35,6 +35,20 @@ export async function findById(
   return row;
 }
 
+/**
+ * 批量查询模板（DataLoader @key 解析器使用，ADR-035）
+ */
+export async function batchFindByIds(
+  ids: string[],
+): Promise<NotificationTemplate[]> {
+  if (ids.length === 0) return [];
+  const db = getDb();
+  return db
+    .select()
+    .from(notificationTemplates)
+    .where(inArray(notificationTemplates.id, ids));
+}
+
 export async function findByCode(
   code: string,
   locale?: string,