cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/gitea/README.md

@@ -0,0 +1,65 @@
+# Gitea on cluster0 (cast01 primary)
+
+Browse UI (after FE `ac-fe.conf` + DNS):  
+`https://acl0.f0xx.org/app/androidcast_project/git/`
+
+Direct on cast01 (debug): `http://127.0.0.1:3000/` (nginx public path strips `/app/.../git/`).
+
+## This step (basic config only)
+
+- Prod `app.ini` layout copied and adapted in `app.ini.template`
+- Paths under `/var/lib/gitea` (repos, LFS, logs)
+- SQLite DB at `/var/lib/gitea/gitea.db` (`GITEA_DB_TYPE=sqlite3` in `cluster.env`; optional `mysql` for prod-like)
+- Nginx on cast01 proxies `/app/androidcast_project/git/` → `127.0.0.1:3000`
+- **No** repo mirrors / org migration yet — run later via scripts under  
+  `lab-seeds/backend/scripts/gitea/` (same as prod BE)
+
+## Deploy
+
+```bash
+# On cast01 after populate app phase (or standalone):
+sudo sh /shared/cluster/scripts/deploy-gitea.sh
+sudo sh /shared/cluster/scripts/configure-nginx.sh
+sudo rc-service gitea status
+curl -sS -o /dev/null -w 'gitea_direct=%{http_code}\n' http://127.0.0.1:3000/
+curl -sS -o /dev/null -w 'gitea_nginx=%{http_code}\n' \
+  http://127.0.0.1/app/androidcast_project/git/
+```
+
+Enable in `cluster.env`: `GITEA_ENABLE=1` (set by default in tree).
+
+## Lab admin login
+
+| Field | Value |
+|-------|--------|
+| User | `admin` (override `GITEA_ADMIN_USER`) |
+| Password | `[gitea_admin]` in `credentials.txt` (falls back to mariadb_app password) |
+
+Create org **AndroidCast** in UI before mirror scripts, or run `gitea_migrate_org_setup.sh` later.
+
+## Later: mirror `ac/*` repos
+
+When ready (not part of this step):
+
+```bash
+sudo sh /shared/cluster/scripts/mirror-gitea-ac-org.sh
+```
+
+Uses `gitea/ac-repos.list` and `lab-seeds/backend/scripts/gitea/*` (API pull mirrors, org **ac**).
+
+**Lab status (cluster0):** all mirrors in `gitea/ac-repos.list` — run `sudo sh /shared/cluster/scripts/verify-gitea-mirrors.sh` on cast01.
+
+See `lab-seeds/backend/scripts/gitea/README.md` for full mirror/protect flows.
+
+## Integration map
+
+| Layer | Config |
+|-------|--------|
+| cast01 BE nginx | `nginx/apps-port80.conf` → `:3000` |
+| Gentoo FE lab vhost | `ac-platform-edge/fe/ac-fe.conf` → `cast01:80` (git via BE nginx) |
+| Git server (canonical) | `git://f0xx.org/ac/*` — unchanged; Gitea is browse mirror only |
+
+Secrets generated once in `/var/lib/gitea/.lab-secrets.env` on cast01 (not in git).  
+Mirror API token: `/var/lib/gitea/.mirror-admin-token` — recovery in `ac-docs/docs/SECRETS_AND_RECOVERY.md`.
+
+**Note:** first start after fresh DB can take **30–90s** (SQLite schema migration). `deploy-gitea.sh` waits up to 6 minutes.