cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/verify-mail-lab.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Lab SMTP smoke — requires secrets.lab.env SMTP_* or local relay on cast01.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+load_secrets_lab
+
+TO="${1:-}"
+[ -n "$TO" ] || die "usage: verify-mail-lab.sh recipient@example.com"
+
+COMPOSED="${COMPOSE_BACKEND:-/var/www/ac/composed/backend}"
+[ -f "${COMPOSED}/config/config.php" ] || die "missing composed backend — run compose-lab-backend.sh"
+
+export MAIL_TEST_TO="$TO"
+_out="$(php -r '
+require "'"${COMPOSED}"'/src/bootstrap.php";
+$to = getenv("MAIL_TEST_TO") ?: "";
+$origin = rtrim((string) cfg("public_origin", "https://acl0.f0xx.org"), "/");
+$base = rtrim((string) cfg("base_path", ""), "/");
+$ok = AuthMailer::sendVerifyEmail($to, $origin . $base . "/verify-email?token=lab-smoke");
+echo $ok ? "mail_ok" : "mail_fail";
+' 2>&1)" || _out="mail_fail"
+
+log "$_out to=$TO"
+case "$_out" in
+  mail_ok) exit 0 ;;
+  *) exit 1 ;;
+esac