feat: add Database-Gateway Cloudron package (Infrastructure) [#639]

Database Gateway 0.24.0 as the 12th package: multi-stage Go build
(CGO required by the libpg_query parser, hence an alpine:3.23 runtime
matching upstream), native OIDC wired to the Cloudron platform identity
provider, postgresql addon storage with goose migrations applied at
start, jq-generated config + OPA policy seeded to /app/data. Verified
end-to-end against a throwaway postgres (migrations, policy compile,
startup to the OIDC handoff). Docs gardened to 12 packages.

Ticket: https://projects.knownelement.com/issues/639

STATUS.md

@@ -3,20 +3,20 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — Rathole packaged
-> (#650, Infrastructure, 11th package); auth gate verdict: no user concept,
-> status page behind the Cloudron auth proxy, tunnels token-authenticated.
+> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — Database Gateway
+> packaged (#639, Infrastructure, 12th package); auth gate verdict: native
+> OIDC (preferred) — platform provider wired via CLOUDRON_OIDC_* env.
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 11 of ~57 upstream applications are
+Cloudron packaging pipeline is operational. 12 of ~57 upstream applications are
 packaged, committed, and pushed. Packaging templates exist for the core
 patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 All remaining apps now carry build tickets (#633-#678) under umbrella
 [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
 ready for the sequential grind-driver pattern.
 
-## Completed Packages (11)
+## Completed Packages (12)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -31,6 +31,7 @@ ready for the sequential grind-driver pattern.
 | 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
 | 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage |
 | 11 | Rathole | Infrastructure | Pre-compiled binaries + auth proxy | 8000, 2333, 5200-5299 | localstorage |
+| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
 
 Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
 `Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -119,7 +120,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 | DevOps-Tools | 1 | 0/1 | |
 | Financial-Payments | 1 | 0/1 | |
 | Financial-Trading | 1 | 0/1 | |
-| Infrastructure | 6 | 2/6 | easy-gate, rathole done |
+| Infrastructure | 6 | 3/6 | easy-gate, rathole, database-gateway done |
 | Legal | 1 | 0/1 | |
 | Project-Management | 1 | 0/1 | |
 | Scientific-Computing | 2 | 0/2 | |
@@ -133,7 +134,7 @@ Auth capability is a hard gate before packaging (see
 LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 (unacceptable / blocked-on-auth).
 
-### Completed packages (11)
+### Completed packages (12)
 
 | App | OIDC | LDAP | Verdict | Note |
 |-----|------|------|---------|------|
@@ -148,6 +149,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) |
 | Easy-Gate | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no user concept; IP-subnet groups only) |
 | Rathole | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional) |
+| Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim |
 
 ### Candidates researched