Lab: remember-me, Grafana proxy fix, builder cache dirs, branded QR alerts.

Grafana auth restore + nginx proxy_cookie_path; alert-notifier branded QR; prepare-be-builder-dirs shared ccache/gradle; bump ac-scripts for Docker DLC maintenance.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/prune-builder-artifacts.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Prune obsolete Docker layers and old build artifact trees on builder nodes.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+KEEP_BUILDS="${KEEP_BUILDS:-5}"
+BUILDS="${BUILDER_BUILDS_DIR:-/var/www/ac/broadcast/builds}"
+
+log "prune docker build cache + dangling images"
+docker builder prune -af 2>/dev/null || true
+docker image prune -af 2>/dev/null || true
+
+if [ -d "${BUILDS}" ]; then
+  log "prune build dirs under ${BUILDS} (keep newest ${KEEP_BUILDS})"
+  # Numeric build IDs only; sort descending, drop oldest beyond KEEP_BUILDS.
+  ls -1 "${BUILDS}" 2>/dev/null | awk '/^[0-9]+$/' | sort -rn | tail -n +"$((KEEP_BUILDS + 1))" | while read -r id; do
+    log "  remove builds/${id}"
+    rm -rf "${BUILDS}/${id}"
+  done
+fi
+
+docker system df 2>/dev/null || true
+df -h / /shared 2>/dev/null || true
+log "prune-builder-artifacts_ok $(host_short)"