docs(phase2a): document gateway and student launch architecture

- docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md — the full Phase 2A record: node-pty
  root cause and fix, Gateway architecture, student flow (entry through
  reset/recreate), API routes added, HTTP/WebSocket routing design (and why
  the lab-session cookie exists), security model (what's checked, and the
  explicit statement that this is pilot identity, not production auth),
  reset/recreate and reaper-recovery semantics, and known limitations found
  during implementation (the identity instance's k3s resource cost and its
  network_mode: bridge requirement, the Gateway's in-memory cache scope, the
  ?sid= check's coverage). BUILT NOW vs. FUTURE (Phase 2B) called out
  explicitly per the governing requirement.
- docs/LAB_ARCHITECTURE.md, docs/ENGINEERING_SOP.md — status updated to
  reflect Phase 2A is implemented and tested, not just Phase 1; roadmap item 5
  updated accordingly; ENGINEERING_SOP's Provisioner section corrected (it's
  no longer un-fronted — the Gateway is the only caller now).
- README.md — Multi-Student Deployment section updated to describe the
  Gateway and student flow, not just the Provisioner; clarifies the
  node-pty fix is the only change to the Lab image itself.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

README.md

@@ -128,29 +128,39 @@ Everything runs inside one image managed by `scripts/entrypoint.sh`.
 ## Multi-Student Deployment (RootNode Academy addition)
 
 The upstream project assumes one learner, one container — this image is still exactly that,
-unmodified. RootNode Academy multiplies it into a real platform via a separate provisioning
-layer rather than changing the image itself: see `docs/LAB_ARCHITECTURE.md` for the
-architecture and `platform/provisioner/` for the Phase 1 implementation (Postgres-backed
-environment registry, per-student Docker networking, firewall-enforced egress, idle reaper —
-see `platform/provisioner/README.md` for how to run it).
+unmodified except for a node-pty build fix (see `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §1).
+RootNode Academy multiplies it into a real platform via separate provisioning and gateway
+layers rather than changing the image itself:
 
-**Never publish the raw privileged container** — front it with isolation. The one-container
-`docker run --privileged -p 7554:80 ...` command above stays supported for local development
-and scenario authoring; it is not how this gets deployed to real students.
+- `platform/provisioner/` — Postgres-backed environment registry, per-student Docker
+  networking, firewall-enforced egress, idle reaper (`docs/PHASE1_PLATFORM_FOUNDATION.md`).
+- `platform/gateway/` — the only student-facing path to a Lab: resolves identity → environment
+  → routing token, proxies HTTP/WebSocket into that one student's container, never a raw
+  container IP/port (`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`).
+- The student flow (roster login → curriculum dashboard → Launch Lab → Lab session →
+  Reset/Recreate) lives in `frontend/src/platform/` — a small addition alongside the existing,
+  unmodified Lab UI, not a rewrite of it.
 
-Key properties of the Phase 1 platform (not this image):
+**Never publish the raw privileged container** — front it with isolation (that's what the
+Gateway is). The one-container `docker run --privileged -p 7554:80 ...` command above stays
+supported for local development and scenario authoring; it is not how this gets deployed to
+real students.
+
+Key properties of the platform (not this image):
 
 - One container **per student**, its own Docker network, its own firewall chain — never a
-  shared cluster between learners.
-- Progress/identity live outside the disposable container (currently this image's own SQLite,
-  moving to the Platform's PostgreSQL in a later phase) — destroying a student's environment
-  never loses their academic record.
+  shared cluster between learners. Verified with two simultaneous students: separate clusters,
+  separate progress, no cross-access.
+- Progress/identity live outside the disposable container (a persistent identity instance
+  running this same image, currently SQLite-backed, moving to the Platform's PostgreSQL in a
+  later phase) — destroying or recreating a student's Lab never loses their academic record.
 - CPU/memory/PID/storage limits are enforced per container, config-driven.
 - Egress is restricted to an allowlisted proxy at the firewall layer, not left open.
-- Idle/abandoned environments are automatically cleaned up.
+- Idle/abandoned environments are automatically cleaned up, and a student can launch a fresh
+  one and keep going without losing progress.
 
-Production topology and what's built vs. not yet: `docs/LAB_ARCHITECTURE.md` and
-`docs/PHASE1_PLATFORM_FOUNDATION.md`.
+Production topology and what's built vs. not yet: `docs/LAB_ARCHITECTURE.md`,
+`docs/PHASE1_PLATFORM_FOUNDATION.md`, `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`.
 
 ---