feat: add eLabFTW Cloudron package (Business-Apps) [#669]

Official-image wrapper of elabftw/elabimg 5.6.12 (tag+digest pinned);
localstorage + mysql + ldap addons; httpPort 443 via DISABLE_HTTPS.
No OIDC upstream -> native LDAP flagged auth-risk. First mysql-addon
and first Business-Apps package; 15/~57. Build verified green under
ukrrs-batch.slice. Docs synced (JOURNAL s15, README, STATUS).

Detail + verification: https://projects.knownelement.com/issues/669#note-3938

JOURNAL.md

@@ -4,7 +4,7 @@
 **Project**: TSYSDevStack-SupportStack-Cloudron
 **Goal**: Package ~57 applications for Cloudron PaaS platform
 **Start Date**: 2025-01-24
-**Current Status**: 14/~57 packages completed (~25%)
+**Current Status**: 15/~57 packages completed (~26%)
 
 ## Completed Packages
 
@@ -1135,6 +1135,82 @@ client_secret, redirect_url, scopes; PKCE + nonce state stored in Redis).
 
 ---
 
+### 15. eLabFTW (Business-Apps) ✅
+**Date**: 2026-09-01
+**Application**: eLabFTW — open-source electronic lab notebook (ELN) and
+lab inventory manager (experiments, resources database, scheduling,
+digital signatures/timestamps, PDF/export pipelines). Upstream:
+https://github.com/elabftw/elabftw (AGPL-3.0), v5.6.12. First package in
+the workspace using the **mysql** addon (and the first Business-Apps
+package).
+
+**Ticket**: [#669](https://projects.knownelement.com/issues/669)
+
+**Pattern**: official-image wrapper. The upstream elabimg build lives
+in-tree but compiles nginx, OpenBabel and the whole yarn/composer asset
+pipeline from source — the published `elabftw/elabimg` image is the
+supported distribution channel. Wrapper is a digest-pinned FROM + a
+start.sh ENTRYPOINT; final image 906MB (~209MB compressed on the Hub).
+
+**Auth gate verdict**: ⚠️ LDAP acceptable-with-risk. eLabFTW 5.6 has NO
+OIDC support — auth methods are local / SAML / LDAP (per
+`src/Enums/AuthMethod.php`). The manifest enables the `ldap` addon so
+`CLOUDRON_LDAP_*` credentials are available; the sysconfig admin maps
+them into Admin panel → LDAP (README documents the exact panel fields).
+Flagged auth-risk: LDAP in STATUS.md/README — must be validated on the
+live Cloudron before production. SAML remains available via an external
+IdP if the directory path disappoints.
+
+**Key decisions**:
+
+- **Port 443 for plain HTTP**: elabimg with `DISABLE_HTTPS=true` serves
+  plain HTTP on port 443 (TLS terminates at the Cloudron proxy) — the
+  manifest's `httpPort` is 443, which reads odd but is upstream's
+  contract.
+- **Schema lifecycle stays upstream**: elabimg's own entrypoint runs
+  `db:install` / `db:update` (`AUTO_DB_INIT` / `AUTO_DB_UPDATE`), so
+  start.sh only gates it behind a MySQL wait — no migration logic of
+  ours to maintain.
+- **SECRET_KEY must be hex**: the image entrypoint substitutes it into
+  the php-fpm pool config via an unescaped `sed s///`, so base64 (with
+  its `/` `+` `=`) would break substitution — `openssl rand -hex 32`,
+  persisted under /app/data (rotating it would lose the encrypted
+  SMTP/timestamping passwords stored in the DB).
+- **Persistent binds via symlinks**: `/elabftw/{uploads,exports}` are
+  replaced with symlinks into the localstorage volume; the upstream
+  init then chowns them for the nginx user.
+- **Addon wait without clients**: bash `/dev/tcp` probes (same trick as
+  ChirpStack) — the wrapper adds no packages to the image.
+- **Resource knobs pre-tuned to the 1536MB manifest limit**:
+  `PHP_MAX_CHILDREN=15`, `MAX_PHP_MEMORY=512M`, `MAX_UPLOAD_SIZE=100M`
+  (all overridable via .env).
+
+**Verification**:
+
+- `docker build --cgroup-parent ukrrs-batch.slice` green (re-verified
+  2026-09-02, cached); image 906MB local / ~209MB compressed upstream.
+- start.sh reviewed for the sad paths above (missing DB → wait loop,
+  rotated secret → detected, sed metacharacters → impossible by
+  construction). Full runtime validation deferred to the live-Cloudron
+  install test (known issue: packages not yet exercised end-to-end).
+
+**Files Created**:
+
+- Dockerfile (official-image wrapper, tag+digest pinned)
+- CloudronManifest.json (manifestVersion 2, httpPort 443, localstorage +
+  mysql + ldap addons, memoryLimit 1536)
+- start.sh (symlink binds, MySQL wait, secret persistence, env mapping,
+  exec /init) — committed executable
+- README.md (auth story + LDAP panel wiring, config layout, knobs)
+- CHANGELOG.md
+- .env.example (ELABFTW_TZ / AUTO_DB / PHP knobs)
+- .dockerignore (excludes the cloned repo/ from the build context)
+- logo.png
+
+**Commit**: `feat: add eLabFTW Cloudron package (Business-Apps) [#669]`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use