feat(cluster0): add Janus SFU deploy script and graph gzip smoke test

deploy-janus-sfu.sh installs Janus on cast02, writes signaling config, and templates CAST02_IP into nginx; populate gains --phase sfu.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/deploy-janus-sfu.sh

@@ -0,0 +1,83 @@
+#!/bin/sh
+# Janus SFU on cast02 + ac-ms-sfu-signaling config on all app nodes.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+WS="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}"
+AC_REPO="${AC_MONOREPO_ROOT:-/mnt/repos/ac}"
+SFU_WS="${WS}/ac-ms-sfu-signaling"
+if [ ! -d "$SFU_WS" ] && [ -d "${AC_REPO}/ac-ms-sfu-signaling" ]; then
+  mkdir -p "$(dirname "$SFU_WS")"
+  rsync -a --delete "${AC_REPO}/ac-ms-sfu-signaling/" "$SFU_WS/" 2>/dev/null \
+    || cp -a "${AC_REPO}/ac-ms-sfu-signaling/." "$SFU_WS/"
+fi
+[ -d "$SFU_WS" ] || die "missing ac-ms-sfu-signaling (run deploy-ac-workspace.sh first)"
+
+PUBLIC_ORIGIN="${LAB_PUBLIC_ORIGIN:-https://apps.f0xx.org}"
+JANUS_HTTP="http://${CAST02_IP}:8088/janus"
+JANUS_WS="ws://${CAST02_IP}:8188"
+
+install_janus_on_cast02() {
+  [ "$(host_short)" = "$CAST02_HOST" ] || return 0
+  log "cast02: install/configure Janus SFU"
+  if ! command -v janus >/dev/null 2>&1; then
+    apk add --no-cache janus-gateway janus-gateway-openrc
+  fi
+  for _pair in \
+    "janus.jcfg janus.jcfg.sample" \
+    "janus.transport.http.jcfg janus.transport.http.jcfg.sample" \
+    "janus.transport.websockets.jcfg janus.transport.websockets.jcfg.sample" \
+    "janus.plugin.videoroom.jcfg janus.plugin.videoroom.jcfg.sample"
+  do
+    _dst="${_pair%% *}"
+    _src="${_pair#* }"
+    [ -f "/etc/janus/${_dst}" ] || cp "/etc/janus/${_src}" "/etc/janus/${_dst}"
+  done
+  rc-update add janus-gateway default 2>/dev/null || true
+  rc-service janus-gateway restart 2>/dev/null || rc-service janus-gateway start 2>/dev/null || true
+  if curl -sf "http://127.0.0.1:8088/janus/info" >/dev/null 2>&1; then
+    log "cast02: Janus HTTP API OK"
+  else
+    log "WARN cast02: Janus health check failed (may still be starting)"
+  fi
+}
+
+write_sfu_config() {
+  DB_PASS="$(read_cred mariadb_app password 2>/dev/null || echo 'CHANGE_ME')"
+  mkdir -p "${SFU_WS}/config"
+  cat > "${SFU_WS}/config/config.php" <<PHPEOF
+<?php
+return [
+    'janus_url'     => '${JANUS_HTTP}',
+    'janus_ws_url'  => '${JANUS_WS}',
+    'signaling_url' => '${PUBLIC_ORIGIN}/app/androidcast_project/sfu/ws',
+    'db_dsn'        => 'mysql:host=${PRIMARY_DB_HOST};dbname=androidcast_crashes;charset=utf8mb4',
+    'db_user'       => 'androidcast',
+    'db_pass'       => '${DB_PASS}',
+];
+PHPEOF
+  chown -R nginx:nginx "$SFU_WS" 2>/dev/null || true
+  log "sfu signaling config → ${SFU_WS}/config/config.php"
+}
+
+apply_sfu_schema() {
+  is_primary_node || return 0
+  log "primary: apply SFU schema migrations"
+  run_script "$ROOT/scripts/load-schemas.sh" || log "WARN load-schemas returned non-zero (may already be applied)"
+}
+
+install_janus_on_cast02
+write_sfu_config
+apply_sfu_schema
+run_script "$ROOT/scripts/configure-nginx.sh"
+rc-service php-fpm83 restart 2>/dev/null || true
+
+if [ "$(host_short)" = "$CAST02_HOST" ]; then
+  curl -sf "http://127.0.0.1:8088/janus/info" | head -c 120 || true
+  echo
+fi
+
+log "deploy-janus-sfu_ok $(host_short)"