fix(consuldemocracy): verify end-to-end + harden seed/OIDC [#653]

Seed verification over marker trust (observed exit-0 no-op seed),
first-boot-only OIDC auto-enable, logo added, docs synced (JOURNAL
s17, counts 17/~57). grind-stack verified: homepage 200, OIDC SSO
button live.

Detail: https://projects.knownelement.com/issues/653#note-5044

Package-Workspace/Collaboration/consuldemocracy/start.sh

@@ -97,11 +97,30 @@ memcached -d -p 11211 -u consul -m 64
 # --- 3. database lifecycle -------------------------------------------------------
 wait_tcp "${DB_HOST}" "${DB_PORT}" "PostgreSQL"
 
-if [[ ! -f "${MARKER}" ]]; then
-  echo "First boot: creating + migrating + seeding the database ..."
+# seed decision: the marker alone is not trusted - a marker left by a
+# previous database (restore, migration, fresh test DB) must not skip
+# seeding an empty one (observed: seed chain exits 0 yet persists
+# nothing when re-run in the same first-boot process; a standalone
+# re-seed lands fine, so verify + retry instead of debugging ghosts)
+SEED_COUNT="$(bundle exec rails runner 'print Setting.count' 2>/dev/null || echo 0)"
+if [[ ! -f "${MARKER}" || "${SEED_COUNT}" = "0" ]]; then
+  echo "First boot (or empty database): creating + migrating + seeding ..."
   bundle exec rails db:create db:migrate db:seed
+  SEED_COUNT="$(bundle exec rails runner 'print Setting.count' 2>/dev/null || echo 0)"
+  if [[ "${SEED_COUNT}" = "0" ]]; then
+    echo "seed pass 1 did not persist - retrying standalone seed"
+    bundle exec rails db:seed
+  fi
   touch "${MARKER}"
   echo "Database seeded (local admin: admin@consul.dev - change the password!)"
+
+  # first-boot only: expose the SSO button when the platform provider is
+  # wired (feature.oidc_login defaults to false; operators can toggle it
+  # later in Admin > Settings > Features without us re-enabling it)
+  if [[ -n "${CLOUDRON_OIDC_CLIENT_ID:-}" ]]; then
+    bundle exec rails runner 'Setting["feature.oidc_login"] = true' || true
+    echo "OIDC login enabled (admin panel can toggle it)"
+  fi
 else
   bundle exec rails db:migrate
 fi