fix(api-gateway): rewrite APISIX package and deploy to production

The 09-01 package referenced a nonexistent Cloudron etcd addon and an
unpinned base image. Rewritten: digest-pinned apisix 3.18.0 with an
embedded single-node etcd, loopback-only Admin API, and read-only
rootfs support. Deployed live at apigw.knownelement.com (healthz 200).

Umbrella: https://projects.knownelement.com/issues/632

Package-Workspace/API-Gateway/apisix/CHANGELOG.md

@@ -1,21 +1,34 @@
 # Changelog
 
-## [3.12.0] - 2025-01-24
+## [1.0.2] - 2026-09-07
 
-### Added
-- Initial Cloudron package for APISIX
-- Official Apache APISIX Docker image wrapper
-- Automatic etcd configuration via Cloudron addon
-- Admin API key configuration
-- Health check endpoint
-- Documentation with usage examples
-- Architecture diagram
+### Fixed
+- Read-only rootfs: relocate the whole APISIX runtime tree (CLI, deps,
+  config.yaml, nginx.conf, logs, sockets) to /app/data/apisix - Cloudron 8
+  mounts app root filesystems read-only
+- Patched the CLI's hardcoded apisix_home in the copied tree so nginx.conf
+  generation lands on the writable volume
 
-### Features
-- Multi-protocol support (HTTP/HTTPS, TCP/UDP, Dubbo, MQTT, gRPC, WebSocket)
-- Dynamic configuration without restarts
-- Load balancing with multiple strategies
-- Rich plugin ecosystem (100+ plugins)
-- Security features (IP restrictions, JWT, API Key auth)
-- Traffic management (rate limiting, circuit breaking, canary releases)
-- AI Gateway capabilities for LLM proxying
+### Changed
+- Upgraded APISIX 3.12.0 -> 3.18.0-debian, pinned by tag AND digest
+- etcd copied from quay.io/coreos/etcd v3.5.33 (digest-pinned)
+
+## [1.0.1] - 2026-09-07
+
+### Fixed
+- Run as root: Cloudron does not chown /app/data to arbitrary non-root
+  image users, so the apisix user could not persist state
+
+## [1.0.0] - 2026-09-07
+
+### Changed
+- REWRITE of the 2026-09-01 package, which referenced a nonexistent
+  Cloudron "etcd addon" and an unpinned apache/apisix:latest
+- Embedded single-node etcd (no platform addon dependency); Admin API on
+  127.0.0.1:9180 with a persisted random key in /app/data/.admin_key
+- healthCheckPath "/" (Cloudron treats 4xx as alive); /healthz route
+  seeded for external monitoring
+- Manifest: semver version, localstorage-only addons, 1 GiB memory limit
+
+### Deployed
+- Production Cloudron at https://apigw.knownelement.com (2026-09-07)