feat(integration): provider-neutral website enrollment boundary

- integration-routes.js: POST /api/integrations/enrollments — separate from student/instructor
  session auth entirely (no cookie read), pre-shared-secret header auth matching the existing
  Gateway<->Provisioner trust-boundary pattern. Idempotent via a DB unique constraint on the
  caller's own event_id (not app-level check-then-insert) — proven safe under real concurrent
  duplicate requests. Student resolution is create-or-match by email OR login_identifier
  (minor/no-email support), reusing Phase 5A's exact credential-issuing path. A small,
  provider-neutral status vocabulary (paid/active/confirmed/pending/awaiting_payment) — never
  a raw payment-provider object model.
- docker-compose.dev.yml: INTEGRATION_SHARED_SECRET, optional in dev (fails closed if unset).

platform/docker-compose.dev.yml

@@ -68,6 +68,11 @@ services:
       PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
       PROVISIONER_URL: "http://localhost:4100"
       PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
+      # Phase 5B — the website/commerce integration boundary's shared secret (see
+      # docs/WEBSITE_ENROLLMENT_INTEGRATION.md). Optional in dev: unset means
+      # POST /api/integrations/enrollments refuses every request (fails closed), which is fine
+      # for anyone not exercising that boundary locally.
+      INTEGRATION_SHARED_SECRET: ${INTEGRATION_SHARED_SECRET:-}
       PLATFORM_API_PORT: "4300"
       # No ADMIN_PASSWORD anymore (Phase 3A) — instructor accounts live in Postgres, created via
       # `npm run bootstrap-owner` for the first owner and the admin portal after that.