feat(platform-api): split lightweight platform service from Lab image

New platform/api/ service owns students, cohorts, curriculum, progress,
scenario attempts, and student/admin sessions. No k3s, no --privileged,
no terminal runtime — starts instantly, unlike the old identity service
which booted an unused k3s cluster just to serve roster/progress APIs.

Provisioner calls (student and admin) are consolidated here too, in
provisioner-client.js, so it's the only service that talks to the
Provisioner directly.

platform/api/migrations/001_students.sql

@@ -0,0 +1,16 @@
+-- students — migrated off the Lab image's SQLite (Phase 1/2A). This is the FIRST table in
+-- Postgres to become authoritative for platform academic/identity data — environments.student_id
+-- (Provisioner schema) stays an opaque TEXT reference, no cross-database FK games; a real FK
+-- from environments to this table is a natural follow-up once both are settled, not required
+-- for Phase 2B.
+
+CREATE TABLE IF NOT EXISTS students (
+  student_id      TEXT PRIMARY KEY,
+  display_name    TEXT NOT NULL,
+  status          TEXT NOT NULL DEFAULT 'active',   -- 'active' | 'inactive'
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_active_at  TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_students_status ON students(status);