feat(loadtest): load-test tooling + capacity model

boot-labs.js drives the real admin Prepare-Labs endpoint (reusing the
existing session-helper.js from Phase 3A) and records boot time/failure
rate; sample-resources.sh samples real docker stats for running Labs.
capacity-model.js turns measured per-Lab CPU/memory into a recommended/
warning/hard-admission-control concurrency threshold - no concurrency
number is hardcoded as a marketing figure, every input is explicitly
placeholder data until measured against the real host.

Plus deploy/rollback/smoke-test scripts used by the CI/CD and deployment
runbooks. All syntax-checked; validate-compose.sh and capacity-model.js
actually run against real inputs.

infra/scripts/validate-compose.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Local test (Phase 4 §29): renders infra/docker/platform/docker-compose.production.yml's
+# Jinja2 placeholders with disposable dummy values and confirms `docker compose config`
+# accepts the result — catches YAML/schema errors before Ansible ever touches a real host.
+# This does NOT prove the real production values work (env_file paths under /etc/rootnode/
+# won't exist locally, which docker compose only warns about, not a fatal error), and does NOT
+# validate anything hardware/network-dependent.
+set -euo pipefail
+cd "$(dirname "$0")/../docker/platform"
+
+TMPDIR="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR"' EXIT
+
+for f in platform.env provisioner.env gateway.env postgres.env; do touch "$TMPDIR/$f"; done
+
+sed \
+  -e 's/{{ rootnode_data_root }}/\/tmp\/rootnode-test-data/g' \
+  -e 's/{{ registry }}/registry.example.com/g' \
+  -e 's/{{ image_tag }}/test/g' \
+  -e 's/{{ postgres_exporter_user }}/exporter/g' \
+  -e 's/{{ postgres_exporter_password }}/dummy/g' \
+  -e "s#/etc/rootnode/platform.env#$TMPDIR/platform.env#" \
+  -e "s#/etc/rootnode/provisioner.env#$TMPDIR/provisioner.env#" \
+  -e "s#/etc/rootnode/gateway.env#$TMPDIR/gateway.env#" \
+  -e "s#/etc/rootnode/postgres.env#$TMPDIR/postgres.env#" \
+  docker-compose.production.yml > "$TMPDIR/docker-compose.yml"
+
+echo "--- docker compose config ---"
+docker compose -f "$TMPDIR/docker-compose.yml" config --quiet
+echo "OK: production compose file is well-formed YAML and passes docker compose's own schema validation"
+
+echo
+echo "--- Caddyfile syntax (real caddy validate) ---"
+sed -e 's/{{ academy_domain }}/academy.example.com/g' -e 's/{{ management_cidr }}/203.0.113.0\/24/g' \
+  Caddyfile.j2 > "$TMPDIR/Caddyfile"
+chmod a+r "$TMPDIR/Caddyfile"
+docker run --rm -v "$TMPDIR:/etc/caddy:ro" caddy:2-alpine caddy validate --config /etc/caddy/Caddyfile 2>&1 | grep -q "Valid configuration" \
+  && echo "OK: Caddyfile is valid" || { echo "FAIL: Caddyfile did not validate"; exit 1; }