feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

Adds platform/lab-router/ — a narrow service that runs on the Lab Host,
authenticates the Gateway via mTLS, and resolves an opaque routing token to
a local container purely from Docker label state (no Postgres access, no
callback to the Provisioner). Replaces the Gateway's env.internal_ip
assumption (only valid when Gateway and Lab share a Docker daemon) with a
data-driven direct/router decision per lab_host
(lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one
place (platform/gateway/src/lab-endpoint.js's labTarget()) that every
proxy/fetch call site in server.js now goes through.

Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh)
with a second mTLS leaf pair (router-server/gateway-client) for this new
data-plane connection, deployed by the docker-tls Ansible role into a
separate directory from the control-plane pair. Firewall
(rn-lab-host-01.rules) replaces the old speculative wide port-range
allowance with one narrow rule: platform_ip -> the Router's port only.

dev-local stays routing_mode: direct — zero behavior change for local dev,
confirmed by the full existing regression suite passing unmodified.

infra/firewall/rn-lab-host-01.rules

@@ -38,13 +38,14 @@
 # endpoint: ALLOW" example in the Phase 4 spec, encoded literally here.
 -A INPUT -p tcp --dport 2376 -s {{ platform_ip }} -m conntrack --ctstate NEW -j ACCEPT
 
-# Gateway -> per-Lab published port range, rn-platform-01 only. REQUIRED so the Gateway can
-# reach each student's Lab UI/terminal over the network once Labs run on a genuinely separate
-# host — see docs/PRODUCTION_NETWORK_SECURITY.md §"Gateway-to-Lab cross-VM reachability" for
-# why this exists and the small Provisioner/Gateway code change it depends on (NOT YET BUILT —
-# this firewall rule is the network-policy half; the port-publishing half is an explicit,
-# reviewed application-code follow-up, tracked there rather than silently assumed here).
--A INPUT -p tcp --dport {{ lab_gateway_port_range | default('30000:32767') }} -s {{ platform_ip }} -m conntrack --ctstate NEW -j ACCEPT
+# Lab Host Router (8443) — rn-platform-01 (the Gateway) only. This is the DATA-plane
+# equivalent of the Docker TLS rule above: the Gateway never reaches a Lab's Docker-internal
+# address directly (no per-Lab port publishing, no wide port range needed) — it reaches this
+# one mTLS-authenticated Router instead, which resolves the request to a local container on
+# ITS OWN host. See docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1-3 and
+# docs/PRODUCTION_NETWORK_SECURITY.md — this closes the "Gateway-to-Lab cross-VM reachability"
+# gap Phase 4 flagged as a required follow-up; it is no longer open.
+-A INPUT -p tcp --dport {{ lab_router_port | default('8443') }} -s {{ platform_ip }} -m conntrack --ctstate NEW -j ACCEPT
 
 # Prometheus (rn-platform-01) scraping this host's node-exporter/cadvisor — metrics only,
 # read-only exposition endpoints, still restricted to the one legitimate scraper.

infra/firewall/validate-firewall.sh

@@ -21,7 +21,7 @@ render() {
     -e 's/{{ lab_host_ip }}/10.10.10.20/g' \
     -e 's/{{ lab_subnet_range }}/10.42.0.0\/16/g' \
     -e 's/{{ proxmox_mgmt_cidr }}/203.0.113.0\/24/g' \
-    -e "s/{{ lab_gateway_port_range | default('30000:32767') }}/30000:32767/g" \
+    -e "s/{{ lab_router_port | default('8443') }}/8443/g" \
     "$1" > "$2"
 }