docs: developer onboarding, fresh clone guide, secrets recovery

Add DEVELOPER_SETUP, FRESH_ENV_CLONE, and SECRETS_AND_RECOVERY for the ac/*
workspace; link from README for clean-laptop and lab credential procedures.

Co-authored-by: Cursor <cursoragent@cursor.com>

DEVELOPER_SETUP.md

@@ -0,0 +1,68 @@
+# Developer setup — org `ac`
+
+**Clean machine?** Start with [docs/FRESH_ENV_CLONE.md](docs/FRESH_ENV_CLONE.md) and run `ac-scripts/fresh-clone-dev-env.sh`.
+
+Canonical entry point: **`ac-workspace`** (submodule manifest).
+
+```bash
+git clone git://f0xx.org/ac/ac-workspace
+cd ac-workspace
+git checkout next
+git submodule update --init --recursive
+```
+
+## Which repo for what
+
+| Area | Repo(s) |
+|------|---------|
+| Android app | `ac-mobile-android` |
+| Issues / crash console PHP | `ac-ms-issues`, `ac-be-issues`, `ac-platform-php`, `ac-platform-web` |
+| Auth / 2FA UI | `ac-be-auth`, `ac-ms-identity` |
+| Graphs | `ac-ms-graphs`, `ac-be-graphs` |
+| Tickets, RBAC, devices, remote access | `ac-ms-tickets`, `ac-ms-rbac`, `ac-ms-devices`, `ac-ms-remote-access`, matching `ac-be-*` |
+| URL shortener | `ac-ms-url-shortener` (submodule in workspace) |
+| Hub / builder | `ac-be-hub`, `ac-be-builder` |
+| Nginx FE/BE snippets | `ac-platform-edge` (`fe/ac-fe.conf` for Gentoo FE) |
+| DB schema / migrations | `ac-platform-db` |
+| Lab deploy scripts | `ac-deploy` (`sim/cluster0/`) |
+| Docs | `ac-docs` |
+
+Legacy monolith `git://f0xx.org/android_cast` is **frozen read-only** — do not commit there.
+
+## Local PHP (optional)
+
+1. Clone workspace as above.
+2. Copy `ac-deploy/sim/cluster0/lab-seeds/backend/config/config.example.php` → `config/config.php` and set SQLite or local MariaDB.
+3. Point a local vhost at `public/` with `base_path` `/app/androidcast_project/issues` (see `ac-platform-edge` fragments).
+
+## Lab cluster (cast01–03)
+
+Deployed tree on nodes:
+
+| Path | Content |
+|------|---------|
+| `/var/www/ac/workspace/` | `ac-workspace` + submodules |
+| `/var/www/ac/composed/backend/` | overlay from `compose-lab-backend.sh` |
+| `/var/www/ac/platform/` | shared session / footer helpers |
+| cast01 `:3000` | Gitea browse UI (org **ac**, pull mirrors) |
+
+Scripts: `ac-deploy/sim/cluster0/scripts/` — run on cast01 as `ai` after NFS sync.
+
+**Secrets / recovery:** [docs/SECRETS_AND_RECOVERY.md](docs/SECRETS_AND_RECOVERY.md) — passwords, tokens, WireGuard, RSSH.  
+Lab shared files: `cluster/credentials.txt`, `cluster/secrets.lab.env` (from `secrets.lab.env.example`).
+
+**Public lab URL (after FE install):** `https://acl0.f0xx.org/app/androidcast_project/issues/`  
+**Gitea (lab):** `https://acl0.f0xx.org/app/androidcast_project/git/ac/` — `[gitea_admin]` in `credentials.txt`  
+FE config: `ac-platform-edge/fe/INSTALL.md` → `/etc/nginx/ac-fe.conf` on monstro (PO applies).
+
+## Mobile defaults
+
+Production REST base: `https://apps.f0xx.org/app/androidcast_project/issues/`  
+(`ac-mobile-android` → `BackendEndpoints.ISSUES_BASE`). For lab QA, override upload URL in app settings or build flavor.
+
+After migration, **minor app/BE version will bump**; unreleased older mobile builds may be rejected by lab/prod — always build from current `next`.
+
+## Tests
+
+- Android unit: `./gradlew :app:testDebugUnitTest` (from `ac-mobile-android` checkout).
+- Cluster verify: `ac-deploy/sim/cluster0/scripts/verify_lab_setup.sh --local` / `--cluster`.