fix(cluster0): Gitea cluster proxy, 2FA seed, hub downloads nginx

Bind Gitea on all interfaces for cast02/03 proxy, fix stale 2FA lab-seed
approve flow, add /v0/downloads/ and GITEA_UPSTREAM_HOST, and guard nginx
configure against empty templates.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/deploy-hub-downloads.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Publish hub download artifacts (Session Studio jar) to BE downloads mount.
+# APK is served via OTA stable channel (/v0/ota/) — run ci-build-and-publish-ota.sh separately.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+DOWNLOADS_ROOT="${APP_ROOT:-/var/www/localhost/htdocs/apps/app/androidcast_project}/downloads"
+WS="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}"
+STUDIO_JAR="${WS}/ac-session-studio/build/libs/ac-session-studio.jar"
+
+mkdir -p "$DOWNLOADS_ROOT"
+
+if [ -f "$STUDIO_JAR" ]; then
+  install -m 644 "$STUDIO_JAR" "${DOWNLOADS_ROOT}/ac-session-studio.jar"
+  log "installed Session Studio jar → ${DOWNLOADS_ROOT}/ac-session-studio.jar"
+else
+  log "WARN: Session Studio jar not built at ${STUDIO_JAR}"
+  log "      cd ac-session-studio && ./gradlew shadowJar (or installDist) on builder node"
+fi
+
+log "Hub downloads dir: ${DOWNLOADS_ROOT}"
+log "URL: ${PUBLIC_ORIGIN:-https://apps.f0xx.org}/v0/downloads/ac-session-studio.jar"