docs(phase5a): student identity and remote classroom documentation

- PHASE5A_STUDENT_IDENTITY_REMOTE_CLASSROOM.md: the full design doc.
- RUNBOOK_STUDENT_ACCOUNT_LIFECYCLE.md, RUNBOOK_REMOTE_CLASSROOM.md: operational runbooks.
- REMOTE_AND_SELF_PACED_ARCHITECTURE.md: closes the 'no real student authentication' gap this
  doc previously flagged as the one item blocking self-paced delivery.
- ENGINEERING_SOP.md §5 rewritten (was describing a pre-Phase-2A state no longer true of any
  deployed version of this codebase) plus a new §14; roadmap item 3 updated.
- LAB_ARCHITECTURE.md, PRODUCTION_VALIDATION_CHECKLIST.md, README.md, platform/README.md:
  cross-references and a Phase 5A production-validation section.

platform/README.md

@@ -10,13 +10,15 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
 - `api/` — the lightweight Platform API: students, cohorts, enrollments, curriculum, detailed
   scenario attempt telemetry, progressive hints, curriculum completion rules, the exam +
   capstone assessment engine, achievements, per-instructor accounts, persistent student/
-  instructor sessions, RBAC, audit logging, and the instructor/admin control plane. No k3s, no
-  `--privileged` — this replaced Phase 2A's "identity" instance, which was a full Lab image
-  booting an unused k3s cluster just to serve these APIs. Design:
+  instructor sessions, RBAC, audit logging, real student credentials + remote classrooms
+  (Phase 5A), and the instructor/admin control plane. No k3s, no `--privileged` — this replaced
+  Phase 2A's "identity" instance, which was a full Lab image booting an unused k3s cluster just
+  to serve these APIs. Design:
   `docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md` (split + Postgres migration),
   `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md` (sessions, accounts, RBAC, audit),
-  `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` (learning/assessment engine). Operational
-  reference: `api/README.md`.
+  `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` (learning/assessment engine),
+  `docs/PHASE5A_STUDENT_IDENTITY_REMOTE_CLASSROOM.md` (student credentials, remote classroom).
+  Operational reference: `api/README.md`.
 - `gateway/` — the only student-facing path to a Lab (HTTP + WebSocket proxy, environment-aware
   routing derived from a server-controlled session — not a client-suppliable header/param — and,
   as of Phase 3B, server-side gating of progressive hint reveal). Design: