feat: add Database-Gateway Cloudron package (Infrastructure) [#639]

Database Gateway 0.24.0 as the 12th package: multi-stage Go build
(CGO required by the libpg_query parser, hence an alpine:3.23 runtime
matching upstream), native OIDC wired to the Cloudron platform identity
provider, postgresql addon storage with goose migrations applied at
start, jq-generated config + OPA policy seeded to /app/data. Verified
end-to-end against a throwaway postgres (migrations, policy compile,
startup to the OIDC handoff). Docs gardened to 12 packages.

Ticket: https://projects.knownelement.com/issues/639

Package-Workspace/Infrastructure/database-gateway/.env.example

@@ -0,0 +1,30 @@
+# Environment knobs for the Database Gateway Cloudron package.
+#
+# The app itself is configured through /app/data/config.json (seeded on
+# first start; see README.md). The variables below are consumed by
+# start.sh at seed time and are provided automatically by Cloudron —
+# do NOT set them by hand.
+
+# --- Cloudron platform OIDC provider (injected by Cloudron) -------------------
+# Written into users.* of /app/data/config.json on first start.
+#CLOUDRON_OIDC_ISSUER=https://my.example.com/openid
+#CLOUDRON_OIDC_CLIENT_ID=
+#CLOUDRON_OIDC_CLIENT_SECRET=
+#CLOUDRON_OIDC_TOKEN_SIGNATURE_ALGORITHM=RS256
+
+# --- App origin (injected by Cloudron) ----------------------------------------
+# Redirect URL is derived as ${CLOUDRON_APP_ORIGIN}/auth/callback.
+#CLOUDRON_APP_ORIGIN=https://dbgw.example.com
+
+# --- PostgreSQL addon (injected by Cloudron) ----------------------------------
+# Gateway storage: profiles, bookmarks, query results, migrations.
+#CLOUDRON_POSTGRESQL_HOST=
+#CLOUDRON_POSTGRESQL_PORT=5432
+#CLOUDRON_POSTGRESQL_DATABASE=
+#CLOUDRON_POSTGRESQL_USERNAME=
+#CLOUDRON_POSTGRESQL_PASSWORD=
+
+# --- Operator-editable files in /app/data -------------------------------------
+# config.json      database targets + role mapping (restart after edit)
+# opa/simple.rego  query authorization policy (restart after edit)
+# .cookie_secret   session cookie secret (rotate = logout everyone)