Cluster deploy: ac/* only, hub assets, auth routes at project root.

Remove monolith clone path; add hub deploy, legacy purge, composed-backend
login/logout nginx locations, and full hub asset rsync validation.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/deploy-app.sh

@@ -1,116 +1,21 @@
 #!/bin/sh
-# Deploy androidcast project tree + lab config.php (local disk, not NFS).
+# DEPRECATED — cluster uses ac/* only (ac-workspace + compose-lab-backend.sh).
+# This script refuses to clone git://f0xx.org/android_cast.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 # shellcheck source=/dev/null
 . "$ROOT/scripts/lib/common.sh"
-ensure_shared_mounted
+load_cluster_env
 
-if [ "${COMPOSE_SKIP_MONOLITH:-0}" = "1" ]; then
-  log "COMPOSE_SKIP_MONOLITH=1 — skip monolith git pull (use lab-seeds + compose-lab-backend.sh)"
-  exit 0
+LEGACY="${APP_ROOT}/android_cast"
+if [ -d "${LEGACY}/.git" ]; then
+  _url="$(git -C "$LEGACY" config --get remote.origin.url 2>/dev/null || true)"
+  case "$_url" in
+    *android_cast*)
+      die "legacy monolith still present at $LEGACY ($_url). Run: sudo sh $ROOT/scripts/purge-legacy-monolith.sh"
+      ;;
+  esac
 fi
 
-APP_PASS="$(read_cred mariadb_app password)"
-DB_HOST="$PRIMARY_DB_HOST"
-if is_primary_node; then
-  DB_HOST=127.0.0.1
-fi
-
-mkdir -p "$(dirname "$APP_ROOT")"
-GIT_ROOT="${APP_ROOT}/android_cast"
-BACKEND="${GIT_ROOT}/examples/crash_reporter/backend"
-CONFIG="${BACKEND}/config/config.php"
-
-case "$APP_SOURCE" in
-  git)
-    if [ -d "${GIT_ROOT}/.git" ]; then
-      log "git pull ${GIT_BRANCH} in ${GIT_ROOT}"
-      git config --global --add safe.directory "$GIT_ROOT" 2>/dev/null || true
-      # Lab config.php is generated below — never block monolith pull on it.
-      git -C "$GIT_ROOT" checkout -- examples/crash_reporter/backend/config/config.php 2>/dev/null || true
-      git -C "$GIT_ROOT" fetch origin
-      git -C "$GIT_ROOT" checkout "$GIT_BRANCH"
-      git -C "$GIT_ROOT" pull --ff-only origin "$GIT_BRANCH" || git -C "$GIT_ROOT" reset --hard "origin/${GIT_BRANCH}"
-    else
-      log "git clone ${GIT_ORIGIN} → ${GIT_ROOT}"
-      rm -rf "$GIT_ROOT"
-      git clone --branch "$GIT_BRANCH" --depth 1 "$GIT_ORIGIN" "$GIT_ROOT"
-      git config --global --add safe.directory "$GIT_ROOT" 2>/dev/null || true
-    fi
-    ;;
-  bundle)
-    BUNDLE="${ROOT}/release/current"
-    [ -d "$BUNDLE" ] || die "missing bundle dir $BUNDLE (APP_SOURCE=bundle)"
-    log "rsync bundle $BUNDLE → ${APP_ROOT}"
-    mkdir -p "$APP_ROOT"
-    rsync -a --delete "$BUNDLE/" "$APP_ROOT/"
-    ;;
-  *)
-    die "unknown APP_SOURCE=$APP_SOURCE"
-    ;;
-esac
-
-mkdir -p "${BACKEND}/config" "${BACKEND}/data" "${BACKEND}/storage"
-chown -R nginx:nginx "$APP_ROOT" 2>/dev/null || true
-
-if [ ! -f "$CONFIG" ] || [ "${FORCE_CONFIG:-1}" = "1" ]; then
-  log "writing lab config.php"
-  cat > "$CONFIG" <<PHP
-<?php
-return [
-    'app_name' => 'Android Cast Issues',
-    'base_path' => '${APP_BASE_PATH}',
-    'db' => [
-        'driver' => 'mariadb',
-        'sqlite_path' => __DIR__ . '/../data/crashes.sqlite',
-        'mysql' => [
-            'host' => '${DB_HOST}',
-            'port' => ${PRIMARY_DB_PORT},
-            'socket' => '',
-            'database' => 'androidcast_crashes',
-            'username' => 'androidcast',
-            'password' => '${APP_PASS}',
-            'charset' => 'utf8mb4',
-        ],
-    ],
-    'session_name' => 'ac_crash_sess',
-    'session_cookie_path' => '${APP_HUB_PATH}',
-    'debug' => true,
-    'rbac' => [
-        'default_company_slug' => 'default',
-        'default_company_id' => 1,
-    ],
-    'analytics' => ['enabled' => false, 'measurement_id' => '', 'debug' => false],
-    'remote_access' => [
-        'wg_endpoint' => '',
-        'wg_server_public_key' => '',
-        'provision_peers' => false,
-        'require_wg_tools' => false,
-    ],
-    'auth' => [
-        'encryption_key' => 'lab-cluster-dev-32-char-min-secret!!',
-        'max_attempts' => 8,
-        'lockout_window_minutes' => 15,
-    ],
-    'url_shortener' => [
-        'enabled' => true,
-        'public_base' => '${SHORT_LINKS_PUBLIC_BASE}',
-        'db' => [
-            'mysql' => [
-                'host' => '${DB_HOST}',
-                'port' => ${PRIMARY_DB_PORT},
-                'socket' => '',
-                'database' => 'url_shortener',
-                'username' => 'androidcast',
-                'password' => '${APP_PASS}',
-                'charset' => 'utf8mb4',
-            ],
-        ],
-    ],
-];
-PHP
-  chown nginx:nginx "$CONFIG" 2>/dev/null || true
-fi
-
-log "deploy-app_ok $(host_short)"
+log "deploy-app: skipped (ac/* compose path — see deploy-ac-workspace.sh + compose-lab-backend.sh)"
+exit 0