feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

Adds platform/lab-router/ — a narrow service that runs on the Lab Host,
authenticates the Gateway via mTLS, and resolves an opaque routing token to
a local container purely from Docker label state (no Postgres access, no
callback to the Provisioner). Replaces the Gateway's env.internal_ip
assumption (only valid when Gateway and Lab share a Docker daemon) with a
data-driven direct/router decision per lab_host
(lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one
place (platform/gateway/src/lab-endpoint.js's labTarget()) that every
proxy/fetch call site in server.js now goes through.

Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh)
with a second mTLS leaf pair (router-server/gateway-client) for this new
data-plane connection, deployed by the docker-tls Ansible role into a
separate directory from the control-plane pair. Firewall
(rn-lab-host-01.rules) replaces the old speculative wide port-range
allowance with one narrow rule: platform_ip -> the Router's port only.

dev-local stays routing_mode: direct — zero behavior change for local dev,
confirmed by the full existing regression suite passing unmodified.

infra/environments/staging/provisioner-config/lab-hosts.yaml

@@ -1,16 +1,17 @@
-# Production lab_hosts seed — points at the real rn-lab-host-01 VM instead of Phase 1's dev
-# Unix socket. Same mechanism the Provisioner has had since Phase 1
-# (platform/provisioner/config/lab-hosts.seed.yaml), just pointed at a real remote endpoint —
-# no application code changes required for this, see docs/PRODUCTION_NETWORK_SECURITY.md §7.
-#
-# {{ lab_host_ip }} is an Ansible template variable — see infra/ansible/group_vars/production.yml.
-# Rendered by the `platform` role; the raw file here keeps the placeholder for readability.
+# Staging lab_hosts seed — see infra/environments/production/provisioner-config/lab-hosts.yaml
+# for the full explanation; this is the same shape, lower stakes. Staging's `lab_host_ip` is
+# distinct from production's own (infra/ansible/group_vars/staging.yml), so it needs the same
+# router routing_mode as production once staging genuinely runs on two hosts. If staging is
+# ever collapsed onto a single host instead, change routing_mode to `direct` and drop
+# router_endpoint — that's the only edit needed either way.
 
 lab_hosts:
   - lab_host_id: labhost-01
-    display_name: "RootNode Lab Host VM 01 (production)"
+    display_name: "RootNode Lab Host VM 01 (staging)"
     endpoint: "tcp://{{ lab_host_ip }}:2376"
     tls_ca_path: /etc/rootnode/docker-tls/ca.pem
     tls_cert_path: /etc/rootnode/docker-tls/provisioner-client-cert.pem
     tls_key_path: /etc/rootnode/docker-tls/provisioner-client-key.pem
     enabled: true
+    routing_mode: router
+    router_endpoint: "https://{{ lab_host_ip }}:8443"