feat(platform): pagination, admission control, cohort roles, version endpoint, structured assessment editor

- Real server-side pagination (platform/api/src/pagination.js) on the audit
  log (was a flat LIMIT 200), student attempt history (was LIMIT 100), and
  assessment session history (was fully unbounded - the one genuine growth
  risk found). Frontend updated (AuditView, AssessmentsView, StudentsView).
- Admission control: resource-policy.yaml's new (disabled-by-default)
  admission_control.max_concurrent_labs, checked before touching Docker at
  all, returns a clean 503 CAPACITY_EXCEEDED instead of failing mid-provision.
  Relayed as a clean student-facing message, never a raw 500. New
  GET /capacity endpoint feeds the instructor dashboard.
- cohort_instructors.role_in_cohort (existed since Phase 2B, never read) is
  now enforced: teacher vs viewer, rbac.js's
  requireCohortWriteAccess/requireStudentCohortWriteAccess.
- GET /api/version - app version, deployed Git SHA, latest migration as a
  schema-version stand-in.
- Structured assessment authoring UI (AssessmentsView.jsx's PoolSpecEditor)
  replaces the raw-JSON pool_spec textarea, backed by a new
  GET /api/admin/scenario-catalog endpoint. Owner-only raw-JSON fallback
  remains for anything the structured editor doesn't cover.
- NEEDS_ATTENTION_FAIL_THRESHOLD/STALE_DAYS moved to env-var configuration.

Full regression suite (e2e-phase2a/2b/3a/3b, 67/67) re-run clean after
these changes; frontend production build confirmed clean.

platform/api/src/rbac.js

@@ -78,5 +78,61 @@ module.exports = function createRbac(pool) {
     };
   }
 
-  return { requireRole, requireOwner, requireAdminOrOwner, requireAnyInstructor, requireCohortAccess, requireStudentCohortAccess };
+  // Phase 4.1 §19 — cohort_instructors.role_in_cohort existed since Phase 2B but was never
+  // read anywhere (a misleading field: it looked authoritative but did nothing). Minimal
+  // useful model: 'teacher' (default, existing full instructor capability within the cohort)
+  // vs 'viewer' (read-only — sees dashboards/progress/analytics via requireCohortAccess above,
+  // but cannot Prepare/Destroy Labs or provision a student's environment). owner/admin still
+  // bypass entirely, same as every other cohort-scoped check.
+  function requireCohortWriteAccess(cohortIdParam = 'id') {
+    return async (req, res, next) => {
+      const instructor = req.instructor;
+      if (['owner', 'admin'].includes(instructor.role)) return next();
+      const cohortId = req.params[cohortIdParam];
+      const { rows } = await pool.query(
+        `SELECT role_in_cohort FROM cohort_instructors WHERE cohort_id = $1 AND instructor_id = $2`,
+        [cohortId, instructor.instructor_id]
+      );
+      if (!rows.length || rows[0].role_in_cohort === 'viewer') {
+        await recordAudit(pool, {
+          actorType: 'instructor', actorId: instructor.instructor_id, action: 'authz_denied',
+          resourceType: 'cohort', resourceId: cohortId, result: 'failure', sourceIp: req.ip,
+          metadata: rows.length ? { reason: 'viewer_role' } : undefined,
+        });
+        return res.status(403).json({ error: 'forbidden' });
+      }
+      next();
+    };
+  }
+
+  // Same, keyed by student_id — resolves through cohort_enrollments the same way
+  // requireStudentCohortAccess does, then applies the same viewer check.
+  function requireStudentCohortWriteAccess(studentIdParam = 'id') {
+    return async (req, res, next) => {
+      const instructor = req.instructor;
+      if (['owner', 'admin'].includes(instructor.role)) return next();
+      const studentId = req.params[studentIdParam];
+      const { rows } = await pool.query(
+        `SELECT ci.role_in_cohort FROM cohort_enrollments e
+         JOIN cohort_instructors ci ON ci.cohort_id = e.cohort_id
+         WHERE e.student_id = $1 AND e.enrollment_status = 'enrolled' AND ci.instructor_id = $2`,
+        [studentId, instructor.instructor_id]
+      );
+      if (!rows.length || rows.every((r) => r.role_in_cohort === 'viewer')) {
+        await recordAudit(pool, {
+          actorType: 'instructor', actorId: instructor.instructor_id, action: 'authz_denied',
+          resourceType: 'student', resourceId: studentId, result: 'failure', sourceIp: req.ip,
+          metadata: rows.length ? { reason: 'viewer_role' } : undefined,
+        });
+        return res.status(403).json({ error: 'forbidden' });
+      }
+      next();
+    };
+  }
+
+  return {
+    requireRole, requireOwner, requireAdminOrOwner, requireAnyInstructor,
+    requireCohortAccess, requireStudentCohortAccess,
+    requireCohortWriteAccess, requireStudentCohortWriteAccess,
+  };
 };