cluster0: lab verify-email short links via prod s.f0xx.org API

Lab MariaDB slugs are not on public s.f0xx.org; outbound mail calls prod
shorten API (internal artc0 + Host header) with API bearer token in secrets.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/compose-lab-backend.sh

@@ -138,6 +138,13 @@ unset _MSMTP_PASS _mail_from_secret
 MAIL_FROM_PHP="$(printf '%s' "$MAIL_FROM" | sed "s/'/\\\\'/g")"
 AUTH_BEARER_ID="$(read_secret URL_SHORTENER_AUTH_BEARER_ID 2>/dev/null || true)"
 [ -n "$AUTH_BEARER_ID" ] || AUTH_BEARER_ID="${URL_SHORTENER_AUTH_BEARER_ID:-0}"
+API_BEARER_TOKEN="$(read_secret URL_SHORTENER_API_BEARER_TOKEN 2>/dev/null || true)"
+API_BEARER_PHP=""
+if [ -n "$API_BEARER_TOKEN" ]; then
+  API_BEARER_PHP="$(printf '%s' "$API_BEARER_TOKEN" | sed "s/'/\\\\'/g")"
+fi
+URL_SHORTENER_API_BASE_CFG="${URL_SHORTENER_API_BASE:-${SHORT_LINKS_PUBLIC_BASE}}"
+URL_SHORTENER_API_HOST_CFG="${URL_SHORTENER_API_HOST:-}"
 mkdir -p "${COMPOSED}/config"
 log "write composed config.php base_path=${ISSUES_BASE}"
 cat > "${COMPOSED}/config/config.php" <<PHP
@@ -190,6 +197,9 @@ return [
     'url_shortener' => [
         'enabled' => true,
         'public_base' => '${SHORT_LINKS_PUBLIC_BASE}',
+        'api_base' => '${URL_SHORTENER_API_BASE_CFG}',
+        'api_host' => '${URL_SHORTENER_API_HOST_CFG}',
+        'api_bearer_token' => '${API_BEARER_PHP}',
         'auth_bearer_id' => ${AUTH_BEARER_ID:-0},
         'db' => [
             'mysql' => [

sim/cluster0/scripts/ensure-auth-email-api-bearer.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# Store prod s.f0xx.org API bearer for lab outbound mail (links must live in prod DB).
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+TOKEN="${1:-}"
+if [ -z "$TOKEN" ]; then
+  die "usage: ensure-auth-email-api-bearer.sh <bearer_token>
+Mint on prod BE: php81 /var/www/localhost/htdocs/apps/s/scripts/seed_bearer.php --label=auth-email-system"
+fi
+
+SECRETS="${CAST_CLUSTER_ROOT}/secrets.lab.env"
+touch "$SECRETS"
+chmod 600 "$SECRETS"
+grep -v '^URL_SHORTENER_API_BEARER_TOKEN=' "$SECRETS" > /tmp/secrets.new || true
+printf 'URL_SHORTENER_API_BEARER_TOKEN=%s\n' "$TOKEN" >> /tmp/secrets.new
+mv /tmp/secrets.new "$SECRETS"
+chmod 600 "$SECRETS"
+
+_short="$(curl -fsS -X POST "${URL_SHORTENER_API_BASE:-http://artc0.intra.raptor.org}/api/v1/shorten" \
+  -H 'Content-Type: application/json' \
+  -H "Host: ${URL_SHORTENER_API_HOST:-s.f0xx.org}" \
+  -d "{\"url\":\"https://example.com/lab-smoke\",\"bearer\":\"${TOKEN}\",\"ttl\":60}" \
+  | php83 -r '$j=json_decode(stream_get_contents(STDIN),true); echo (string)($j["u"]??"");' 2>/dev/null)" || _short=""
+[ -n "$_short" ] || die "API smoke failed — token rejected by ${SHORT_LINKS_PUBLIC_BASE:-https://s.f0xx.org}"
+
+log "ensure-auth-email-api-bearer_ok smoke=${_short}"
+log "next: compose-lab-backend.sh && verify-mail-lab.sh …"