feat(platform-api): split lightweight platform service from Lab image

New platform/api/ service owns students, cohorts, curriculum, progress,
scenario attempts, and student/admin sessions. No k3s, no --privileged,
no terminal runtime — starts instantly, unlike the old identity service
which booted an unused k3s cluster just to serve roster/progress APIs.

Provisioner calls (student and admin) are consolidated here too, in
provisioner-client.js, so it's the only service that talks to the
Provisioner directly.

platform/api/Dockerfile

@@ -0,0 +1,42 @@
+# RootNode Platform API — lightweight, no k3s, no --privileged, no Lab terminal runtime.
+# This is the fix for the Phase 2A "identity" instance problem: that was a full,
+# --privileged Lab image booting a k3s cluster nobody used, just to serve roster/curriculum/
+# progress APIs. This image never runs k3s and needs no elevated privileges at all.
+#
+# Built from the REPO ROOT as build context (see platform/docker-compose.dev.yml's
+# `context: .. / dockerfile: platform/api/Dockerfile`), because it needs read-only access to
+# scenarios/ and the frontend source — both live outside platform/api/'s own directory.
+#
+# Multi-stage: the root .dockerignore excludes frontend/dist/ from every build context (it's a
+# build artifact, and the main Lab image always builds it fresh — see that Dockerfile's
+# node-pty fix commit for why leaking host-built artifacts into an image is actively
+# dangerous). Rather than special-case that, this image builds the frontend fresh too, the
+# same way the Lab image does, then discards the Node/npm frontend toolchain from the final
+# stage — the running image only ever needs the static output.
+
+FROM node:20-slim AS frontend-build
+WORKDIR /fe
+COPY frontend/package.json frontend/vite.config.js ./
+RUN npm install
+COPY frontend/ ./
+RUN npm run build
+
+FROM node:20-slim
+WORKDIR /app
+COPY platform/api/package.json ./
+RUN npm install --production
+COPY platform/api/src/ ./src/
+COPY platform/api/migrations/ ./migrations/
+COPY platform/api/migrate-sqlite.js ./
+
+# Read-only curriculum content — same source the Lab image ships, needed here purely for
+# listing/progress-shaping (never executed; setup/validate/teardown stay Lab-only).
+COPY scenarios/ ./scenarios/
+
+# Platform-shell + admin frontend, built in the stage above — served statically, no nginx
+# needed for a lightweight Node API+static server.
+COPY --from=frontend-build /fe/dist/ /frontend-dist/
+ENV FRONTEND_DIST_DIR=/frontend-dist
+
+EXPOSE 4300
+CMD ["node", "src/server.js"]