fix(consuldemocracy): verify end-to-end + harden seed/OIDC [#653]

Seed verification over marker trust (observed exit-0 no-op seed),
first-boot-only OIDC auto-enable, logo added, docs synced (JOURNAL
s17, counts 17/~57). grind-stack verified: homepage 200, OIDC SSO
button live.

Detail: https://projects.knownelement.com/issues/653#note-5044

JOURNAL.md

@@ -1304,6 +1304,69 @@ terminal); SSO users register WITHOUT privileges.
 
 ---
 
+### 17. ConsulDemocracy (Collaboration) ✅
+**Date**: 2026-09-06
+**Application**: ConsulDemocracy — citizen participation platform behind
+Madrid's Consul (proposals, participatory budgeting, debates, polls,
+collaborative legislation). Upstream:
+https://github.com/consuldemocracy/consuldemocracy (MIT). Rails 8 +
+PostgreSQL + delayed_job + memcached. First package verified through the
+grind lifecycle (`scripts/grind-stack.sh`) end to end.
+
+**Ticket**: [#653](https://projects.knownelement.com/issues/653)
+
+**Pattern**: build-from-source on ruby:3.4.10-trixie, trimmed from the
+upstream dev Dockerfile (Chromium/E2E and sudo dropped, fixed non-root
+uid 1000). No published upstream image exists.
+
+**Auth gate verdict**: ✅ OIDC preferred. Generic OpenID Connect via
+`omniauth_openid_connect` (devise.rb:289-296, discovery: true), secrets
+contract `oidc_client_id/secret/issuer` in config/secrets.yml — wired
+from `CLOUDRON_OIDC_*` by start.sh. SAML also available.
+
+**Key decisions / lessons (four build-breaking gotchas, all fixed)**:
+
+1. **`ruby file: ".ruby-version"`**: the Gemfile resolves its ruby
+   version from `.ruby-version` BY NAME — copying it under a different
+   name kills `bundle install` with a bare backtrace.
+2. **`eval_gemfile "./Gemfile_custom"`**: the Gemfile expects a
+   developer-local `Gemfile_custom` that isn't in git — `touch` an empty
+   one before `bundle install`.
+3. **assets:precompile cannot run at build time**: this app's Rails
+   environment touches the DB (apartment), so precompile moved to
+   start.sh after the postgres wait (idempotent; slow only first boot).
+   Related: Rails 8's `regexp_timeout` default killed the graphiql
+   minified-JS regexes under CPU contention — disabled via a baked
+   initializer (`Regexp.timeout = nil`).
+4. **Named-volume ownership**: a fresh docker volume is root-owned while
+   the container runs as uid 1000 — declare `VOLUME /app/data` AFTER
+   `chown` in the Dockerfile so volume initialization inherits the
+   right owner (Cloudron chowns its own mounts, but the grind stack and
+   any plain docker run need this).
+5. **Seed verification over marker trust**: one boot observed
+   `db:create db:migrate db:seed` exit 0 while persisting nothing; a
+   standalone re-seed landed fine. start.sh now checks `Setting.count`
+   and re-seeds an empty database regardless of the marker file.
+6. **`feature.oidc_login` defaults to false** upstream — start.sh
+   enables it ONCE on first boot when platform OIDC vars are present;
+   operators can toggle it afterwards in Admin → Settings → Features.
+
+**Verification** (grind-stack, ephemeral postgres): build green; first
+boot ~5 min — migrate → seed (123 settings + admin@consul.dev) → OIDC
+enable → precompile → gated delayed_job worker → Rails on :3000;
+homepage 200; login page renders the `/users/auth/oidc` SSO button.
+
+**Files Created**: Dockerfile, CloudronManifest.json (port 3000,
+localstorage + postgresql, 2048MB), start.sh (config generation, seed
+verify, memcached, worker gate), README.md, CHANGELOG.md,
+.dockerignore (repo/.git only — the source IS the build context),
+logo.png (upstream public/consul_logo.png).
+
+**Commit**: `feat(consuldemocracy): add initial Cloudron package` (7c65dc1,
+landed mid-flight) + verification hardening follow-up
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use