feat: add InvenTree Cloudron package (Business-Apps) [#658]

Official-image wrapper of inventree/inventree 1.5.2 (digest-pinned).
allauth OIDC provider JSON built from the platform env; invoke update
on boot; RQ worker behind the web-port gate; admin seeded with a
generated password. grind-stack: lowercase image names. 19th package.
Verified: health 200, SSO route 302s to issuer, migrations clean.

Detail: https://projects.knownelement.com/issues/658#note-5086

STATUS.md

@@ -14,14 +14,14 @@
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 18 of 46 remaining-set applications are
+Cloudron packaging pipeline is operational. 19 of 46 remaining-set applications are
 packaged, committed, and pushed. Packaging templates exist for the core
 patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 All remaining apps now carry build tickets (#633-#678) under umbrella
 [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
 ready for the sequential grind-driver pattern.
 
-## Completed Packages (18)
+## Completed Packages (19)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -80,7 +80,7 @@ GitUrlList pruned 56 → 46 accordingly.
 | #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending |
 | #656 | Gophish | Security | blocked-on-auth |
 | #657 | SniperPhish | Security | upstream gone (404) — ruling pending |
-| #658 | InvenTree | Business-Apps | GO: official image, OIDC+LDAP core |
+| #658 | InvenTree | Business-Apps | DONE 2026-09-06 (19th package, grind-verified) |
 | #659 | Mender | System-Administration | build |
 | #661 | WireViz | Documentation-Tools | disposition: covered by wireviz-web package |
 | #662 | KillBill | Business-Apps | build |
@@ -116,7 +116,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 | Low-Code | 2 | 1/2 | corteza done (openblocks removed) |
 | Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) |
 | Automation | 3 | 1/3 | windmill done (huginn removed) |
-| Business-Apps | 6 | 1/6 | elabftw done (midday removed) |
+| Business-Apps | 6 | 2/6 | elabftw, inventree done (midday removed) |
 | Collaboration | 2 | 1/2 | consuldemocracy done |
 | Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done |
 | Data-Management | 2 | 0/2 | datahub, seatunnel |
@@ -135,7 +135,7 @@ Auth capability is a hard gate before packaging (see
 LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 (unacceptable / blocked-on-auth).
 
-### Completed packages (18)
+### Completed packages (19)
 
 | App | OIDC | LDAP | Verdict | Note |
 |-----|------|------|---------|------|
@@ -157,6 +157,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
 | ConsulDemocracy | yes | no | ✅ preferred | **Packaged**; omniauth_openid_connect (discovery) wired into generated secrets.yml; `feature.oidc_login` auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded |
 | GoAlert | yes | no | ✅ preferred | **Packaged**; native generic OIDC (go-oidc, any issuer) wired via GOALERT_OIDC_* from the platform provider; new-user creation on; optional first-admin basic auth via GOALERT_ADMIN_USER/PASS; callback /api/v2/identity/providers/oidc/callback |
+| InvenTree | yes | yes | ✅ preferred | **Packaged**; django-allauth openid_connect provider JSON built from CLOUDRON_OIDC_* (server_url discovery, PKCE); SSO at /accounts/oidc/cloudron/; LDAP also available; local admin seeded (generated password in /app/data/.admin_password) |
 
 ### Candidates researched