cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/gitea/app.ini.template

@@ -0,0 +1,84 @@
+# Lab Gitea — rendered by deploy-gitea.sh → /etc/gitea/app.ini
+# Based on prod artc0 layout; paths and URLs adjusted for cluster0 (acl0.f0xx.org).
+# Repo migration (mirrors) is a separate step — see gitea/README.md.
+
+RUN_USER = gitea
+RUN_MODE = prod
+APP_NAME = AndroidCast lab (cluster0)
+WORK_PATH = @GITEA_APP_DATA@
+
+[repository]
+ROOT = @GITEA_APP_DATA@/data/gitea-repositories
+DEFAULT_MIRROR_INTERVAL = 10m
+MIRROR_UPDATE_INTERVAL = 10m
+
+[server]
+LFS_START_SERVER = true
+PROTOCOL = http
+DOMAIN = @GITEA_DOMAIN@
+ROOT_URL = @GITEA_ROOT_URL@
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = @GITEA_HTTP_PORT@
+APP_DATA_PATH = @GITEA_APP_DATA@
+STATIC_ROOT_PATH = /usr/share/webapps/gitea
+DISABLE_SSH = true
+OFFLINE_MODE = true
+LFS_JWT_SECRET = @GITEA_LFS_JWT@
+
+[database]
+DB_TYPE = sqlite3
+PATH = @GITEA_APP_DATA@/gitea.db
+LOG_SQL = false
+
+[session]
+PROVIDER = file
+
+[log]
+ROOT_PATH = /var/log/gitea
+MODE = file
+LEVEL = info
+
+[lfs]
+PATH = @GITEA_APP_DATA@/lfs
+
+[mailer]
+ENABLED = false
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DISABLE_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+
+[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = @GITEA_INTERNAL_TOKEN@
+PASSWORD_HASH_ALGO = pbkdf2
+
+[oauth2]
+JWT_SECRET = @GITEA_OAUTH_JWT@
+
+[migrations]
+ALLOW_LOCALNETWORKS = true
+ALLOWED_DOMAINS = *,github.com,*.github.com,chromium.googlesource.com,git.zx2c4.com,f0xx.org,*.f0xx.org
+BLOCKED_DOMAINS =
+
+[mirror]
+MIN_INTERVAL = 1m
+
+[cron.update_mirrors]
+ENABLED = true
+SCHEDULE = @every 10m
+RUN_AT_START = true
+
+[actions]
+ENABLED = false
+
+[cron.update_checker]
+ENABLED = false
+
+[indexer]
+ISSUE_INDEXER_TYPE = db