cluster0: Gmail mail relay (msmtp + PHP SMTP), lab cron

Mirror alpine-be msmtp for CLI; compose uses Gmail SMTP for php-fpm.
Safe secrets.lab.env parser; deploy-mailrelay, install-lab-cron, verify-mail-lab.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/deploy-mailrelay.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Lab cluster outbound mail — msmtp + sendmail shim (same pattern as alpine-be).
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+load_secrets_lab
+
+FROM="${MSMTP_FROM:-bestcastr@gmail.com}"
+USER="${MSMTP_USER:-bestcastr@gmail.com}"
+PASS="$(read_secret MSMTP_APP_PASSWORD)"
+[ -n "$PASS" ] || PASS="${MSMTP_APP_PASSWORD:-}"
+
+[ -n "$PASS" ] || die "MSMTP_APP_PASSWORD missing in ${CAST_CLUSTER_ROOT}/secrets.lab.env"
+
+apk add --no-cache msmtp mailx >/dev/null 2>&1 || apk add --no-cache msmtp
+
+mkdir -p /etc/androidcast
+umask 077
+printf '%s\n' "$PASS" > /etc/androidcast/msmtp.secret
+chmod 600 /etc/androidcast/msmtp.secret
+
+sed -e "s|__MSMTP_FROM__|${FROM}|g" -e "s|__MSMTP_USER__|${USER}|g" \
+  "$ROOT/mail/msmtprc.template" > /etc/msmtprc
+chmod 644 /etc/msmtprc
+
+touch /var/log/msmtp.log
+chmod 666 /var/log/msmtp.log 2>/dev/null || true
+
+rc-update add msmtp default 2>/dev/null || true
+rc-service msmtp restart 2>/dev/null || true
+
+# sendmail → msmtp (php mail() / AuthMailer sendmail transport)
+if [ ! -e /usr/sbin/sendmail ] || [ -L /usr/sbin/sendmail ]; then
+  ln -sf /usr/bin/msmtp /usr/sbin/sendmail 2>/dev/null || true
+fi
+
+log "deploy-mailrelay_ok from=${FROM} user=${USER}"