cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/lib/common.sh

@@ -185,6 +185,16 @@ read_cred() {
   ' "$_file"
 }
 
+# Optional NFS secrets (not in git): secrets.lab.env
+load_secrets_lab() {
+  _file="${CAST_CLUSTER_ROOT}/secrets.lab.env"
+  [ -f "$_file" ] || return 0
+  set -a
+  # shellcheck source=/dev/null
+  . "$_file"
+  set +a
+}
+
 ssh_node() {
   _host="$1"
   shift