feat(platform-api): split lightweight platform service from Lab image

New platform/api/ service owns students, cohorts, curriculum, progress,
scenario attempts, and student/admin sessions. No k3s, no --privileged,
no terminal runtime — starts instantly, unlike the old identity service
which booted an unused k3s cluster just to serve roster/progress APIs.

Provisioner calls (student and admin) are consolidated here too, in
provisioner-client.js, so it's the only service that talks to the
Provisioner directly.

platform/api/migrations/003_curriculum_assignments.sql

@@ -0,0 +1,16 @@
+-- curriculum_assignments — which curriculum path a cohort or an individual student is on.
+-- Only one curriculum exists today (scenarios/rootnode-path.json, "RootNode Learning Path") —
+-- this table exists so assigning it is a real, visible instructor action (and so a second path
+-- can be added later without a schema change), not because multiple paths exist yet.
+
+CREATE TABLE IF NOT EXISTS curriculum_assignments (
+  assignment_id    BIGSERIAL PRIMARY KEY,
+  cohort_id        TEXT REFERENCES cohorts(cohort_id),
+  student_id       TEXT REFERENCES students(student_id),
+  curriculum_path  TEXT NOT NULL DEFAULT 'rootnode-path',
+  assigned_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CONSTRAINT curriculum_assignment_target CHECK (cohort_id IS NOT NULL OR student_id IS NOT NULL)
+);
+
+CREATE INDEX IF NOT EXISTS idx_curriculum_cohort ON curriculum_assignments(cohort_id);
+CREATE INDEX IF NOT EXISTS idx_curriculum_student ON curriculum_assignments(student_id);