feat(platform-api): split lightweight platform service from Lab image

New platform/api/ service owns students, cohorts, curriculum, progress,
scenario attempts, and student/admin sessions. No k3s, no --privileged,
no terminal runtime — starts instantly, unlike the old identity service
which booted an unused k3s cluster just to serve roster/progress APIs.

Provisioner calls (student and admin) are consolidated here too, in
provisioner-client.js, so it's the only service that talks to the
Provisioner directly.

platform/api/migrations/004_progress.sql

@@ -0,0 +1,18 @@
+-- progress — same shape as the SQLite table it replaces (student_id, scenario_id composite
+-- key), migrated data-for-data. Postgres is authoritative for this after migration runs.
+
+CREATE TABLE IF NOT EXISTS progress (
+  student_id          TEXT NOT NULL REFERENCES students(student_id),
+  scenario_id         TEXT NOT NULL,
+  status              TEXT,
+  attempts            INTEGER DEFAULT 0,
+  last_validated      TIMESTAMPTZ,
+  completed_at        TIMESTAMPTZ,
+  started_at          TIMESTAMPTZ,
+  notes               TEXT,
+  time_spent_seconds  INTEGER DEFAULT 0,
+  PRIMARY KEY (student_id, scenario_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_progress_student ON progress(student_id);
+CREATE INDEX IF NOT EXISTS idx_progress_status ON progress(status);