feat(content): graphql subgraph with dataloader for textbook/chapter/kp/question

- GraphQLModule: Apollo Federation 2 at /graphql

- Textbook/Chapter/KnowledgePoint/Question @key with @ResolveReference

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- batchFind methods added to 4 repositories

- Domain modules export repositories for GraphqlModule injection

services/content/src/app.module.ts

@@ -12,6 +12,8 @@ import { HealthModule } from "./shared/health/health.module.js";
 import { OutboxModule } from "./shared/outbox/outbox.module.js";
 import { PermissionGuard } from "./middleware/permission.guard.js";
 import { LifecycleService } from "./shared/lifecycle/lifecycle.service.js";
+import { GraphqlModule } from "./graphql/graphql.module.js";
+import { RouterAuthGuard } from "./graphql/router-auth.guard.js";
 
 @Module({
   imports: [
@@ -25,9 +27,11 @@ import { LifecycleService } from "./shared/lifecycle/lifecycle.service.js";
     GrpcModule,
     HealthModule,
     OutboxModule,
+    GraphqlModule,
   ],
   providers: [
     { provide: APP_GUARD, useClass: PermissionGuard },
+    { provide: APP_GUARD, useClass: RouterAuthGuard },
     LifecycleService,
   ],
 })