feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

Adds platform/lab-router/ — a narrow service that runs on the Lab Host,
authenticates the Gateway via mTLS, and resolves an opaque routing token to
a local container purely from Docker label state (no Postgres access, no
callback to the Provisioner). Replaces the Gateway's env.internal_ip
assumption (only valid when Gateway and Lab share a Docker daemon) with a
data-driven direct/router decision per lab_host
(lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one
place (platform/gateway/src/lab-endpoint.js's labTarget()) that every
proxy/fetch call site in server.js now goes through.

Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh)
with a second mTLS leaf pair (router-server/gateway-client) for this new
data-plane connection, deployed by the docker-tls Ansible role into a
separate directory from the control-plane pair. Firewall
(rn-lab-host-01.rules) replaces the old speculative wide port-range
allowance with one narrow rule: platform_ip -> the Router's port only.

dev-local stays routing_mode: direct — zero behavior change for local dev,
confirmed by the full existing regression suite passing unmodified.

platform/provisioner/migrations/004_lab_hosts_routing.sql

@@ -0,0 +1,32 @@
+-- lab_hosts routing mode — Phase 4.1, docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1.
+--
+-- Removes the Gateway's dependency on env.internal_ip being reachable directly, which only
+-- holds when Gateway and the Lab container share a Docker daemon (true in dev, false once
+-- Labs run on a genuinely separate rn-lab-host-01 VM). A lab_host is either:
+--   'direct' — Gateway reaches env.internal_ip:internal_port itself. Correct when Gateway and
+--              this lab_host's Docker daemon share a network namespace (dev, single-host).
+--   'router' — Gateway reaches this lab_host's Lab Host Router (router_endpoint) over mTLS
+--              instead, carrying the environment's routing_token in a header; the Router
+--              resolves that token to a local container on ITS OWN host and reverse-proxies.
+--              Correct once this lab_host is a genuinely separate VM.
+--
+-- Existing 'dev-local' row keeps routing_mode='direct' (the default) — no behavior change for
+-- current dev/single-host setups. All existing lab_hosts rows and every environments row are
+-- untouched; this only adds columns.
+
+ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS routing_mode TEXT NOT NULL DEFAULT 'direct';
+ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS router_endpoint TEXT;
+
+DO $$ BEGIN
+  ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_routing_mode_check
+    CHECK (routing_mode IN ('direct', 'router'));
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$ BEGIN
+  ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_router_endpoint_required_check
+    CHECK (routing_mode = 'direct' OR router_endpoint IS NOT NULL);
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;