docs(phase2a): document gateway and student launch architecture

- docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md — the full Phase 2A record: node-pty
  root cause and fix, Gateway architecture, student flow (entry through
  reset/recreate), API routes added, HTTP/WebSocket routing design (and why
  the lab-session cookie exists), security model (what's checked, and the
  explicit statement that this is pilot identity, not production auth),
  reset/recreate and reaper-recovery semantics, and known limitations found
  during implementation (the identity instance's k3s resource cost and its
  network_mode: bridge requirement, the Gateway's in-memory cache scope, the
  ?sid= check's coverage). BUILT NOW vs. FUTURE (Phase 2B) called out
  explicitly per the governing requirement.
- docs/LAB_ARCHITECTURE.md, docs/ENGINEERING_SOP.md — status updated to
  reflect Phase 2A is implemented and tested, not just Phase 1; roadmap item 5
  updated accordingly; ENGINEERING_SOP's Provisioner section corrected (it's
  no longer un-fronted — the Gateway is the only caller now).
- README.md — Multi-Student Deployment section updated to describe the
  Gateway and student flow, not just the Provisioner; clarifies the
  node-pty fix is the only change to the Lab image itself.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docs/ENGINEERING_SOP.md

@@ -142,13 +142,14 @@ Order agreed 2026-08-17/18. Status as of this doc:
 3. Student accounts / persistent progress — **backend done** (§5), frontend not started,
    no instructor auth yet.
 4. Instructor dashboard — not started.
-5. Per-student isolation — **Phase 1 (platform foundation) done**, see §8. Ephemeral
-   per-student Lab environments with Postgres-backed lifecycle, per-environment Docker
-   networking, and firewall-enforced egress restriction are implemented and tested on a single
-   dev machine. **Still not cleared for minors** — no Gateway/frontend wiring yet (environments
-   are only reachable via the internal Provisioner API), no instructor auth on top of it, and
-   the production two-VM Proxmox split this depends on doesn't exist yet. See
-   `docs/PHASE1_PLATFORM_FOUNDATION.md` final report for exactly what's verified vs. not.
+5. Per-student isolation — **Phase 1 (platform foundation) + Phase 2A (Gateway + student flow)
+   done**, see §8/§9. Ephemeral per-student Lab environments, Gateway-mediated routing, and a
+   working entry→dashboard→launch→lab→progress flow are implemented and end-to-end tested on a
+   single dev machine, including two simultaneous students with verified cross-student
+   isolation. **Still not cleared for minors** — pilot-grade identity only (no
+   password/SSO), no instructor auth layer, and the production two-VM Proxmox split this
+   depends on doesn't exist yet. See `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` for exactly
+   what's verified vs. not.
 6. Scenarios → teaching modules (incident context/investigation/prevention) — not started.
 7. Capstone/exam engine — not started (placeholder stage only, see §4).
 8. Progressive hint levels — not started.
@@ -156,9 +157,9 @@ Order agreed 2026-08-17/18. Status as of this doc:
 10. CI scenario testing — not started.
 11. Container/build optimization — explicitly deprioritized by design (platform works, not urgent).
 
-Next slice: either the deferred frontend login (name picker → `X-Student-Id` header, curriculum
-view), or the Phase 2 platform work (Gateway, frontend wiring to the Provisioner, instructor
-auth) — see the Phase 1 final report for the concrete Phase 2 list. Not decided here.
+Next slice: Phase 2B — instructor dashboard, production auth/SSO, and the identity/progress
+Postgres migration are the biggest remaining items. See
+`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §9 for the full Phase 2B list.
 
 ## 8. Platform Provisioner (Phase 1)
 
@@ -170,9 +171,9 @@ section is just the map.
   environment per student — its own Docker network, its own container running the existing,
   unmodified Lab image, its own firewall-enforced egress. Postgres-backed registry
   (`environments`, `environment_events`, `lab_hosts`), idle reaper, startup reconciliation.
-- **What it is not (yet):** reachable by a student. There's no Gateway and no frontend wiring
-  — it's exercised directly via its internal API (shared-secret auth) or
-  `platform/provisioner/test/run.js`. Nothing here is a live feature.
+- **What it is not:** directly reachable by a student, even now — the Gateway (§9) sits in
+  front of it and is the only caller. Still exercised directly via its internal API
+  (shared-secret auth) or `platform/provisioner/test/run.js` for isolated Provisioner testing.
 - **Where identity lives:** unchanged from §5 — `students`/`progress` are still on the Lab
   image's own SQLite. `environments.student_id` is deliberately opaque (no FK) until a later,
   separate migration puts roster/progress on the same Postgres instance as the environment