docs(phase4.1): pre-production hardening documentation

Master overview (PHASE4_1_PREPRODUCTION_HARDENING.md) covering all 27
substantive items, plus REMOTE_AND_SELF_PACED_ARCHITECTURE.md (reviews
what already works for remote/self-paced delivery - student-driven
provisioning, cohort-less students, idle-reaper-destroy-then-continue -
and the one real gap: student authentication, explicitly Phase 5 scope,
not built here).

Updated PRODUCTION_NETWORK_SECURITY.md (the Gateway-to-Lab gap is now
RESOLVED, with the full design writeup and a new control-plane-vs-data-plane
section), PRODUCTION_DEPLOYMENT.md (four-cert TLS bundle),
PRODUCTION_VALIDATION_CHECKLIST.md (Router mTLS check, admission control
checks), PHASE4_PRODUCTION_INFRASTRUCTURE.md and ENGINEERING_SOP.md and
LAB_ARCHITECTURE.md (stale 'known gap' pointers updated to point at the
resolution), BACKUP_DR.md (destructive drill), README.md and
platform/README.md (Phase 4.1 pointers, lab-router component, updated
known-limitations).

Also fixes a real pre-existing bug found while auditing what gets
committed: infra/.gitignore's patterns were written repo-root-relative
(e.g. "infra/terraform/...") but the file lives in infra/, so git resolved
them relative to THAT directory and none of them ever matched anything -
a real .terraform/ provider cache showed up as untracked when it should
have been ignored. Fixed by dropping the redundant leading "infra/" from
every pattern.

Status: PHASE 4.1 COMPLETE / PRE-PRODUCTION HARDENING COMPLETE / READY FOR
HARDWARE DEPLOYMENT.

platform/README.md

@@ -23,6 +23,10 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
   `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` (routing), `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`
   (persistent sessions, CSRF), `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` §3 (hint gating).
 - `egress-proxy/` — shared allowlisting proxy every Lab's outbound traffic passes through.
+- `lab-router/` — Phase 4.1 addition. Runs on the Lab Host VM (or `dev-local`'s stand-in in
+  local dev, though `direct` mode there never exercises it); resolves an opaque routing token
+  to a local Lab container purely from Docker state, over mTLS, so the Gateway never needs a
+  Docker-internal address. Design: `docs/PHASE4_1_PREPRODUCTION_HARDENING.md` §1-3.
 - `docker-compose.dev.yml` — the full stack (Postgres, egress proxy, Provisioner, Platform API,
   Gateway) on one machine. This is the Phase 1/2A/2B **local dev exception** — production is
   the two-VM Proxmox split described in `docs/LAB_ARCHITECTURE.md` §1.
@@ -77,13 +81,20 @@ those need a browser-equivalent client and aren't automated here.
 See `provisioner/README.md` (Phase 1), `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §9 (Phase
 2A), `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md` (Phase 3A identity limitations), and
 `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` §20 (Phase 3B learning/assessment limitations) for the
-full, honest lists.
+full, honest lists. Phase 3B's "no automatic abandoned-attempt detection" and "no per-cohort
+needs-attention threshold configuration" limitations were both closed in Phase 4.1 (§13/§17 of
+`docs/PHASE4_1_PREPRODUCTION_HARDENING.md`); its raw-JSON pool_spec limitation was replaced with
+a structured editor (§18) with an owner-only raw-JSON fallback still available. Phase 4.1's own
+known limitation: real remote/self-paced delivery needs student email/password authentication,
+not built — see `docs/REMOTE_AND_SELF_PACED_ARCHITECTURE.md`.
 
 ## Running this in production
 
 `../infra/` has the full production infrastructure package (Ansible, Terraform, firewall,
 monitoring, backup, CI/CD) for deploying the Platform API/Gateway/Provisioner/Postgres onto a
-dedicated `rn-platform-01` VM, with student Labs on a separate `rn-lab-host-01` VM. See
+dedicated `rn-platform-01` VM, with student Labs — and a new `lab-router` service
+(`../platform/lab-router/`) — on a separate `rn-lab-host-01` VM. See
 `../docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md` for the overview and
-`../docs/PRODUCTION_NETWORK_SECURITY.md` for a known gap in Gateway-to-Lab reachability across
-two real VMs that must be closed before production go-live.
+`../docs/PHASE4_1_PREPRODUCTION_HARDENING.md` for how Gateway-to-Lab reachability across two
+real VMs was closed (a Lab Host Router + mTLS data plane, simulation-tested in
+`../infra/scripts/simulate-two-host/`) and for the rest of Phase 4.1's pre-production hardening.