docs(phase3a): document production identity architecture

New docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md covers the schema, persistent session
design, instructor accounts, the full RBAC matrix, cohort scoping (including the documented
raw-environment-id simplification), student session hardening (explicitly still
classroom/pilot identification, not production auth), CSRF, rate limiting, audit logging,
the API inventory, a security hardening checklist, test results, known limitations, the
future OIDC path, and production HTTPS/cookie expectations — with an explicit BUILT NOW vs.
FUTURE split.

Updates ENGINEERING_SOP.md (new §9/§10, closing a stale '(§9)' forward-reference that dated
back to Phase 2B), LAB_ARCHITECTURE.md status line, README.md, platform/README.md, and
platform/api/README.md (bootstrap-owner usage, new config vars, no more ADMIN_PASSWORD).

README.md

@@ -135,18 +135,19 @@ layers rather than changing the image itself:
 - `platform/provisioner/` — Postgres-backed environment registry, per-student Docker
   networking, firewall-enforced egress, idle reaper (`docs/PHASE1_PLATFORM_FOUNDATION.md`).
 - `platform/api/` — lightweight Platform API: students, cohorts, curriculum, progress,
-  scenario attempts, student/admin sessions, instructor/admin control plane. No k3s, no
-  `--privileged` (`docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md`).
+  scenario attempts, persistent student/instructor sessions, per-instructor accounts (RBAC:
+  owner/admin/instructor), audit log, instructor/admin control plane. No k3s, no `--privileged`
+  (`docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md`, `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`).
 - `platform/gateway/` — the only student-facing path to a Lab: resolves identity from a
-  server-controlled session cookie (not a client-suppliable header/param), proxies
+  server-controlled, persistent session cookie (not a client-suppliable header/param), proxies
   HTTP/WebSocket into that one student's container, never a raw container IP/port
   (`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`, session model in
-  `docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md` §3).
+  `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md` §3).
 - The student flow (roster login → curriculum dashboard → Launch Lab → Lab session →
-  Reset/Recreate) lives in `frontend/src/platform/`; the instructor/admin portal
-  (cohorts, students, classroom "Prepare Labs," environment controls) lives in
-  `frontend/src/admin/` at the `/admin` route — both small additions alongside the existing,
-  unmodified Lab UI, not a rewrite of it.
+  Reset/Recreate) lives in `frontend/src/platform/`; the instructor/admin portal (per-instructor
+  login, cohorts, students, instructor accounts, audit log, classroom "Prepare Labs,"
+  environment controls) lives in `frontend/src/admin/` at the `/admin` route — both small
+  additions alongside the existing, unmodified Lab UI, not a rewrite of it.
 
 **Never publish the raw privileged container** — front it with isolation (that's what the
 Gateway is). The one-container `docker run --privileged -p 7554:80 ...` command above stays
@@ -163,16 +164,21 @@ Key properties of the platform (not this image):
   loses their academic record. Verified with a full class-sized (3-student) cohort workflow:
   provision, complete different scenarios, reset one student's Lab, destroy all Labs after
   class — progress survives every step.
-- Instructors manage cohorts, students, curriculum assignment, and classroom Lab prep
-  (provision an entire cohort before class, verify readiness, destroy Labs after) from
-  `/admin` — no manual database, Docker, or Kubernetes access needed.
+- Instructors sign in with their own account (no shared password) and manage cohorts, students,
+  curriculum assignment, and classroom Lab prep (provision an entire cohort before class, verify
+  readiness, destroy Labs after) from `/admin` — no manual database, Docker, or Kubernetes
+  access needed. Owners manage instructor accounts and roles; every instructor/admin action is
+  recorded in an audit log.
+- Sessions (student and instructor) are Postgres-backed and survive a Platform API restart —
+  verified by actually restarting it mid-session and confirming access still works.
 - CPU/memory/PID/storage limits are enforced per container, config-driven.
 - Egress is restricted to an allowlisted proxy at the firewall layer, not left open.
 - Idle/abandoned environments are automatically cleaned up, and a student can launch a fresh
   one and keep going without losing progress.
 
 Production topology and what's built vs. not yet: `docs/LAB_ARCHITECTURE.md`,
-`docs/PHASE1_PLATFORM_FOUNDATION.md`, `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`.
+`docs/PHASE1_PLATFORM_FOUNDATION.md`, `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`,
+`docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`.
 
 ---