fix(consuldemocracy): verify end-to-end + harden seed/OIDC [#653]

Seed verification over marker trust (observed exit-0 no-op seed),
first-boot-only OIDC auto-enable, logo added, docs synced (JOURNAL
s17, counts 17/~57). grind-stack verified: homepage 200, OIDC SSO
button live.

Detail: https://projects.knownelement.com/issues/653#note-5044

Package-Workspace/Collaboration/consuldemocracy/README.md

@@ -18,6 +18,9 @@ regenerates secrets.yml on every boot with the Cloudron platform
 provider values (`CLOUDRON_OIDC_*`).
 
 - SSO redirect: `https://<app-domain>/users/auth/oidc/callback`
+- The SSO button (`feature.oidc_login`, default off upstream) is
+  auto-enabled on FIRST boot when the platform provider is present —
+  after that it's yours to toggle in Admin → Settings → Features.
 - Local login stays available alongside SSO.
 - SAML is also supported (saml_* keys in secrets.yml) if an external
   IdP is preferred.