cluster0: Gmail mail relay (msmtp + PHP SMTP), lab cron

Mirror alpine-be msmtp for CLI; compose uses Gmail SMTP for php-fpm.
Safe secrets.lab.env parser; deploy-mailrelay, install-lab-cron, verify-mail-lab.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/install-lab-cron.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Lab maintenance cron on primary (cast01) — mirrors alpine-be schedules where applicable.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+is_primary_node || { log "install-lab-cron: skip non-primary"; exit 0; }
+
+COMPOSED="${COMPOSE_BACKEND:-/var/www/ac/composed/backend}"
+SHORTENER="/var/www/url-shortener"
+CRON_FILE=/etc/crontabs/root
+MARK="# ac-cluster0-lab"
+
+grep -v "$MARK" "$CRON_FILE" 2>/dev/null > /tmp/crontab.ac.new || : > /tmp/crontab.ac.new
+
+if [ -f "${COMPOSED}/scripts/purge_remote_access.php" ]; then
+  echo "0 * * * * cd ${COMPOSED} && php83 scripts/purge_remote_access.php --hours=24 ${MARK}" >> /tmp/crontab.ac.new
+fi
+if [ -f "${SHORTENER}/scripts/purge_url_shortener.php" ]; then
+  echo "0 4 * * * cd ${SHORTENER} && php83 scripts/purge_url_shortener.php ${MARK}" >> /tmp/crontab.ac.new
+fi
+
+mv /tmp/crontab.ac.new "$CRON_FILE"
+chmod 600 "$CRON_FILE"
+rc-service crond restart 2>/dev/null || rc-service crond start 2>/dev/null || true
+log "install-lab-cron_ok"