feat(student): wire roster identity and student session

New Platform Shell entry point (frontend/src/platform/) alongside the
existing, completely unmodified Lab UI (App.jsx and everything under
frontend/src/components/). main.jsx now splits on the current URL path —
/lab/<token>/ renders the existing <App/> exactly as before; anything else
renders the new <PlatformShell/>. Both live in the same built bundle (it's
served both by the persistent identity instance and by every ephemeral Lab
container), split purely at runtime.

- EntryScreen.jsx — cohort dropdown -> name dropdown (existing
  GET /api/roster/cohorts, GET /api/roster?cohort=) -> POST /api/login. No
  password. Visibly labeled pilot identity, not production auth, per the
  governing requirement that this be stated explicitly, not just true in the
  architecture docs.
- api.js — student_id lives in localStorage only, sent as X-Student-Id on
  every authenticated request. Every authenticated call throws if no student
  is stored rather than silently going out anonymously — this is what
  "prevent accidental anonymous progress writes" means in practice, not just
  a comment.
- PlatformShell.jsx — entry screen if no stored session, dashboard otherwise.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

frontend/src/main.jsx

@@ -1,14 +1,23 @@
 import React from 'react'
 import ReactDOM from 'react-dom/client'
 import App from './App.jsx'
+import PlatformShell from './platform/PlatformShell.jsx'
 import './index.css'
 
 // Apply saved theme before first paint to avoid flash
 const savedTheme = localStorage.getItem('kubekosh-theme') || 'dark'
 document.documentElement.setAttribute('data-theme', savedTheme)
 
+// This bundle is served both by the persistent identity/platform instance (root paths) and by
+// every ephemeral per-student Lab container (reached via the Gateway at /lab/<token>/) — same
+// build, same code, split purely by the URL path at runtime. See
+// docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md "Student flow" for why: it lets the existing Lab UI
+// (<App/>) stay completely unmodified while the new Platform Shell (entry/dashboard/launch)
+// lives alongside it in the same bundle.
+const isLabSession = window.location.pathname.startsWith('/lab/')
+
 ReactDOM.createRoot(document.getElementById('root')).render(
   <React.StrictMode>
-    <App />
+    {isLabSession ? <App /> : <PlatformShell />}
   </React.StrictMode>
 )