fix(consuldemocracy): verify end-to-end + harden seed/OIDC [#653]

Seed verification over marker trust (observed exit-0 no-op seed),
first-boot-only OIDC auto-enable, logo added, docs synced (JOURNAL
s17, counts 17/~57). grind-stack verified: homepage 200, OIDC SSO
button live.

Detail: https://projects.knownelement.com/issues/653#note-5044

Package-Workspace/Collaboration/consuldemocracy/CHANGELOG.md

@@ -7,7 +7,17 @@
 - postgresql + localstorage addons; Rails server on :3000
 - Generated configs (database.yml / secrets.yml) under /app/data,
   regenerated each boot; persisted secret_key_base
-- First-boot db:create/migrate/seed with marker; gated delayed_job
-  worker; in-container memcached
-- Platform OIDC wired into secrets.yml; local admin seeded
+- First-boot db:create/migrate/seed with marker + empty-DB verification
+  (a stale marker against a fresh database re-seeds); gated delayed_job
+  worker; in-container memcached; assets:precompile at start (the app's
+  environment needs the DB, so precompile cannot run at build time)
+- Platform OIDC wired into secrets.yml; `feature.oidc_login` auto-enabled
+  on first boot when the provider is present; local admin seeded
   (admin@consul.dev — password change required on first login)
+
+## Verification (2026-09-06)
+
+Full-stack grind-stack test against ephemeral postgres: build green,
+first boot ~5 min (migrate → seed [123 settings, admin] → OIDC enable →
+precompile → delayed_job → Rails), homepage 200, login page renders the
+`/users/auth/oidc` SSO button.