feat(loadtest): load-test tooling + capacity model

boot-labs.js drives the real admin Prepare-Labs endpoint (reusing the
existing session-helper.js from Phase 3A) and records boot time/failure
rate; sample-resources.sh samples real docker stats for running Labs.
capacity-model.js turns measured per-Lab CPU/memory into a recommended/
warning/hard-admission-control concurrency threshold - no concurrency
number is hardcoded as a marketing figure, every input is explicitly
placeholder data until measured against the real host.

Plus deploy/rollback/smoke-test scripts used by the CI/CD and deployment
runbooks. All syntax-checked; validate-compose.sh and capacity-model.js
actually run against real inputs.

infra/scripts/rollback-production.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Rolls back to the previously deployed image tag, per infra/docker/IMAGE_STRATEGY.md —
+# "rollback is changing one variable and re-running the Ansible role." Reads
+# /opt/rootnode/deploy-history.log (written by deploy-production.sh) for the tag before the
+# current one; pass an explicit tag instead if you need to go back further than one step.
+#
+# Usage: ./rollback-production.sh [explicit-image-tag]
+set -euo pipefail
+cd "$(dirname "$0")/../ansible"
+
+DEPLOY_LOG="/opt/rootnode/deploy-history.log"
+
+if [ -n "${1:-}" ]; then
+  TARGET_TAG="$1"
+else
+  [ -f "$DEPLOY_LOG" ] || { echo "No $DEPLOY_LOG found and no explicit tag given — nothing to roll back to." >&2; exit 1; }
+  LINES=$(wc -l < "$DEPLOY_LOG")
+  [ "$LINES" -ge 2 ] || { echo "Deploy history has fewer than 2 entries — nothing to roll back to. Pass an explicit tag instead." >&2; exit 1; }
+  TARGET_TAG=$(tail -2 "$DEPLOY_LOG" | head -1 | awk '{print $2}')
+fi
+
+echo "Rolling back production to image_tag=$TARGET_TAG"
+read -r -p "Type ROLLBACK to continue: " CONFIRM
+[ "$CONFIRM" = "ROLLBACK" ] || { echo "Aborted."; exit 1; }
+
+ansible-playbook site.yml -i inventory/production.ini \
+  -e "image_tag=$TARGET_TAG" \
+  --vault-password-file .vault_pass
+
+echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $TARGET_TAG (rollback)" >> "$DEPLOY_LOG"
+echo "==> Rolled back to $TARGET_TAG. Verify with infra/scripts/production-smoke-test.sh."
+echo "NOTE: this rolls back the application images only. If the rollback needs to undo a"
+echo "database migration too, see docs/RUNBOOK_FAILED_MIGRATION.md — schema changes are not"
+echo "automatically reversible by this script."