feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

Adds platform/lab-router/ — a narrow service that runs on the Lab Host,
authenticates the Gateway via mTLS, and resolves an opaque routing token to
a local container purely from Docker label state (no Postgres access, no
callback to the Provisioner). Replaces the Gateway's env.internal_ip
assumption (only valid when Gateway and Lab share a Docker daemon) with a
data-driven direct/router decision per lab_host
(lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one
place (platform/gateway/src/lab-endpoint.js's labTarget()) that every
proxy/fetch call site in server.js now goes through.

Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh)
with a second mTLS leaf pair (router-server/gateway-client) for this new
data-plane connection, deployed by the docker-tls Ansible role into a
separate directory from the control-plane pair. Firewall
(rn-lab-host-01.rules) replaces the old speculative wide port-range
allowance with one narrow rule: platform_ip -> the Router's port only.

dev-local stays routing_mode: direct — zero behavior change for local dev,
confirmed by the full existing regression suite passing unmodified.

infra/scripts/validate-compose.sh

@@ -36,3 +36,17 @@ sed -e 's/{{ academy_domain }}/academy.example.com/g' -e 's/{{ management_cidr }
 chmod a+r "$TMPDIR/Caddyfile"
 docker run --rm -v "$TMPDIR:/etc/caddy:ro" caddy:2-alpine caddy validate --config /etc/caddy/Caddyfile 2>&1 | grep -q "Valid configuration" \
   && echo "OK: Caddyfile is valid" || { echo "FAIL: Caddyfile did not validate"; exit 1; }
+
+# Phase 4.1: rn-lab-host-01's compose file (egress-proxy, lab-router, observability agents)
+# was never covered here before — added when the lab-router service landed.
+echo
+echo "--- lab-host production compose ---"
+LABHOST_TMPDIR="$(mktemp -d)"
+sed \
+  -e 's/{{ registry }}/registry.example.com/g' \
+  -e 's/{{ image_tag }}/test/g' \
+  -e "s/{{ lab_router_port | default('8443') }}/8443/g" \
+  ../lab-host/docker-compose.production.yml > "$LABHOST_TMPDIR/docker-compose.yml"
+docker compose -f "$LABHOST_TMPDIR/docker-compose.yml" config --quiet
+echo "OK: lab-host production compose file is well-formed YAML and passes docker compose's own schema validation"
+rm -rf "$LABHOST_TMPDIR"