feat(platform-api): split lightweight platform service from Lab image

New platform/api/ service owns students, cohorts, curriculum, progress,
scenario attempts, and student/admin sessions. No k3s, no --privileged,
no terminal runtime — starts instantly, unlike the old identity service
which booted an unused k3s cluster just to serve roster/progress APIs.

Provisioner calls (student and admin) are consolidated here too, in
provisioner-client.js, so it's the only service that talks to the
Provisioner directly.

platform/api/src/curriculum.js

@@ -0,0 +1,37 @@
+// Scenario/bundle/curriculum-path loading — same source files and cache pattern as
+// backend/server.js (scenarios/data, scenarios/bundles, scenarios/rootnode-path.json). The
+// Platform API only ever READS this content for listing/progress-shaping purposes; it never
+// executes setup/validate/teardown commands — that stays exclusively the Lab image's job.
+
+const fs = require('fs');
+const path = require('path');
+
+const SCENARIOS_DIR = process.env.SCENARIOS_DIR || path.join(__dirname, '../scenarios/data');
+const BUNDLES_DIR = process.env.BUNDLES_DIR || path.join(__dirname, '../scenarios/bundles');
+const CURRICULUM_PATH_FILE = process.env.CURRICULUM_PATH_FILE || path.join(__dirname, '../scenarios/rootnode-path.json');
+
+function loadJsonDir(dir) {
+  return fs.readdirSync(dir).filter((f) => f.endsWith('.json'))
+    .map((f) => JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')));
+}
+
+let scenariosCache = [];
+let bundlesCache = [];
+let curriculumPathCache = null;
+
+function reloadCache() {
+  scenariosCache = loadJsonDir(SCENARIOS_DIR);
+  bundlesCache = loadJsonDir(BUNDLES_DIR);
+  curriculumPathCache = fs.existsSync(CURRICULUM_PATH_FILE)
+    ? JSON.parse(fs.readFileSync(CURRICULUM_PATH_FILE, 'utf8'))
+    : null;
+  console.log(`Loaded ${scenariosCache.length} scenarios and ${bundlesCache.length} bundles into cache.`);
+}
+reloadCache();
+
+module.exports = {
+  reloadCache,
+  loadScenarios: () => scenariosCache,
+  loadBundles: () => bundlesCache,
+  loadCurriculumPath: () => curriculumPathCache,
+};