feat(student): admin student-account management + CSV import, session hardening

- admin-routes.js: create-with-credentials, /convert, /reset-password, /revoke-sessions,
  /sessions, /import (transactional CSV import — whole file validated, one Postgres
  transaction, never accepts a password/hash column from input). Fixed GET
  /api/admin/students to select an explicit safe column list instead of SELECT * — the new
  password_hash/credential_token_hash columns must never be exposed through this route.
- server.js: /api/login now also blocks on credential_token_hash (not just password_hash) —
  closes a real window where a student mid-conversion stayed reachable via the old
  bare-student_id path. studentSession middleware now re-verifies status='active' on every
  request, not just at session creation, matching instructorSession's existing behavior.
- sessions.js: revokeAllStudentSessions, listStudentSessions.
- rbac.js: extracted checkCohortAccess/checkCohortWriteAccess as shared core functions so the
  new classroom/help-request RBAC (next commit) reuses the exact same authorization rule
  instead of a parallel copy.
- student-csv.js + test: hand-rolled parser (no new dependency), unit tested.
- prometheus.yml.j2: activated the platform-api scrape job.

infra/monitoring/prometheus/prometheus.yml.j2

@@ -83,11 +83,10 @@ scrape_configs:
       - target_label: __address__
         replacement: localhost:9115
 
-  # RootNode application metrics — see docs/OBSERVABILITY.md §"exposing /metrics" for the
-  # documented, NOT-YET-BUILT follow-up (Platform API/Gateway/Provisioner don't currently
-  # expose a Prometheus /metrics endpoint; this job is ready for when that lands, disabled
-  # until then rather than scraping a 404 forever).
-  # - job_name: rootnode-platform-api
-  #   static_configs:
-  #     - targets: ["api:4300"]
-  #   metrics_path: /metrics
+  # RootNode application metrics — Phase 5A §34 (platform/api/src/metrics.js): classroom/help-
+  # request/Lab-state gauges and student login counters. No student/instructor id or other
+  # high-cardinality value is ever a label here — see that file's header comment.
+  - job_name: rootnode-platform-api
+    static_configs:
+      - targets: ["api:4300"]
+    metrics_path: /metrics