cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/nginx.conf

@@ -0,0 +1,42 @@
+# Example nginx site for https://f0xx.org/app/androidcast_project/crashes/
+# Adjust paths and upstream socket to your host.
+
+server {
+    listen 443 ssl http2;
+    server_name f0xx.org;
+
+    # ssl_certificate     /etc/letsencrypt/live/f0xx.org/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/f0xx.org/privkey.pem;
+
+    root /var/www/androidcast_crashes/public;
+    index index.php;
+
+    location /app/androidcast_project/crashes/ {
+        alias /var/www/androidcast_crashes/public/;
+        try_files $uri $uri/ /app/androidcast_project/crashes/index.php?$query_string;
+    }
+
+    location ~ ^/app/androidcast_project/crashes/api/upload\.php$ {
+        gunzip on;
+        gunzip_types application/json;
+        alias /var/www/androidcast_crashes/public/api/upload.php;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/androidcast_crashes/public/api/upload.php;
+        fastcgi_pass unix:/run/php-fpm/www.sock;
+        client_max_body_size 8m;
+    }
+
+    location ~ ^/app/androidcast_project/crashes/.+\.php$ {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $request_filename;
+        fastcgi_pass unix:/run/php-fpm/www.sock;
+    }
+
+    location ~ ^/app/androidcast_project/crashes/ {
+        try_files $uri /app/androidcast_project/crashes/index.php?$query_string;
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+}