docs(platform): document ephemeral lab architecture

- docs/LAB_ARCHITECTURE.md — the full ephemeral-per-student design: two-VM
  production topology (Platform VM / Lab Host VM, correction A), lifecycle,
  data model, networking/egress model (correction B), resource model,
  routing/auth model, security boundaries, failure/recovery behavior,
  migration path from the current single container, and the lab-host
  abstraction (correction D). Status updated to reflect Phase 1 is now
  implemented, pointing at the two docs below for specifics.

- docs/PHASE1_PLATFORM_FOUNDATION.md — the Phase 1 build plan: exact Postgres
  schema, service boundaries, API routes, lifecycle state machine, Docker/
  firewall commands, security assumptions, file layout, and a 12-test plan.
  Updated with "Implementation notes" at the points where testing surfaced
  real deviations from the original design: the per-network (not static)
  egress-proxy address resolution, the COALESCE reaper fix, and the
  provisioning-failure cleanup fix.

- docs/ENGINEERING_SOP.md — new §8 mapping the platform/provisioner/ and
  platform/egress-proxy/ components, what's built vs. not (no Gateway, no
  frontend wiring — internal API only), and where identity still lives
  (unchanged: Lab image's own SQLite). Roadmap item 5 (per-student isolation)
  updated from "not started" to "Phase 1 done, not yet cleared for minors."

- README.md — Multi-Student Deployment section rewritten: the old per-student-
  volume persistence model is superseded by the Platform's registry (progress
  already lives outside the disposable container as of the prior curriculum/
  roster work); points at docs/LAB_ARCHITECTURE.md and platform/provisioner/
  for the real architecture instead of describing three delivery modes that
  were never actually built out.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

README.md

@@ -127,22 +127,30 @@ Everything runs inside one image managed by `scripts/entrypoint.sh`.
 
 ## Multi-Student Deployment (RootNode Academy addition)
 
-The upstream project assumes one learner, one container. RootNode Academy runs it across three
-delivery modes. **Never publish the raw privileged container** — front it with isolation.
+The upstream project assumes one learner, one container — this image is still exactly that,
+unmodified. RootNode Academy multiplies it into a real platform via a separate provisioning
+layer rather than changing the image itself: see `docs/LAB_ARCHITECTURE.md` for the
+architecture and `platform/provisioner/` for the Phase 1 implementation (Postgres-backed
+environment registry, per-student Docker networking, firewall-enforced egress, idle reaper —
+see `platform/provisioner/README.md` for how to run it).
 
-| Mode | Provisioning | Isolation |
-| ---- | ------------ | --------- |
-| In-person camp | Pre-spun container per seat, torn down after | Lab VLAN, no public ingress |
-| Live cohort | Container per enrolled student for the session window | Per-student auth at the proxy |
-| Self-paced | On-demand spin-up per session, idle-timeout teardown | Per-user volume + auth + resource limits |
+**Never publish the raw privileged container** — front it with isolation. The one-container
+`docker run --privileged -p 7554:80 ...` command above stays supported for local development
+and scenario authoring; it is not how this gets deployed to real students.
 
-Hardening checklist for shared infra:
+Key properties of the Phase 1 platform (not this image):
 
-- One container **per student** — never share a cluster between learners.
-- Apply CPU/memory limits so one runaway pod can't starve a host.
-- Put authentication in front (proxy-level), never expose `:7554` to the internet.
-- Persist each student's `/data` to a dedicated volume.
-- Idle-timeout + auto-teardown for self-paced sessions to control cost.
+- One container **per student**, its own Docker network, its own firewall chain — never a
+  shared cluster between learners.
+- Progress/identity live outside the disposable container (currently this image's own SQLite,
+  moving to the Platform's PostgreSQL in a later phase) — destroying a student's environment
+  never loses their academic record.
+- CPU/memory/PID/storage limits are enforced per container, config-driven.
+- Egress is restricted to an allowlisted proxy at the firewall layer, not left open.
+- Idle/abandoned environments are automatically cleaned up.
+
+Production topology and what's built vs. not yet: `docs/LAB_ARCHITECTURE.md` and
+`docs/PHASE1_PLATFORM_FOUNDATION.md`.
 
 ---