docs(phase2b): document admin and platform-data architecture

New docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md covers the Platform API
split, Postgres schema and migration guarantees/rollback, the session
cookie architecture (including the whoami-routing-bug fix), the admin
portal, the API/security boundary, known limitations, and Phase 3+
future work.

Updates ENGINEERING_SOP.md §8, LAB_ARCHITECTURE.md, README.md, and
platform/README.md to reflect Platform API as the sole Provisioner
caller and Postgres as authoritative for identity/progress as of
Phase 2B.

docs/ENGINEERING_SOP.md

@@ -171,13 +171,15 @@ section is just the map.
   environment per student — its own Docker network, its own container running the existing,
   unmodified Lab image, its own firewall-enforced egress. Postgres-backed registry
   (`environments`, `environment_events`, `lab_hosts`), idle reaper, startup reconciliation.
-- **What it is not:** directly reachable by a student, even now — the Gateway (§9) sits in
-  front of it and is the only caller. Still exercised directly via its internal API
-  (shared-secret auth) or `platform/provisioner/test/run.js` for isolated Provisioner testing.
-- **Where identity lives:** unchanged from §5 — `students`/`progress` are still on the Lab
-  image's own SQLite. `environments.student_id` is deliberately opaque (no FK) until a later,
-  separate migration puts roster/progress on the same Postgres instance as the environment
-  registry.
+- **What it is not:** directly reachable by a student or the Gateway anymore — as of Phase 2B,
+  the Platform API (§9) is the *only* caller (student launch/reset AND admin prepare/destroy/
+  reset both go through it). Still exercised directly via its internal API (shared-secret
+  auth) or `platform/provisioner/test/run.js` for isolated Provisioner testing.
+- **Where identity lives:** as of Phase 2B, Postgres is authoritative —
+  `students`/`cohorts`/`progress`/`scenario_attempts` live in the same `rootnode_platform`
+  database as `environments`, owned by the Platform API's own migrations. See §9.
+  `environments.student_id` is still a plain opaque reference, not a real FK — that's a
+  deliberate, documented choice (docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md §2), not an oversight.
 - **Local dev:** `platform/provisioner/docker-compose.dev.yml` runs Postgres + the egress
   proxy + the Provisioner on one machine — the documented Phase 1 dev exception. Production
   is a two-VM Proxmox split (Platform VM / Lab Host VM); the dev compose file is explicitly