feat(consuldemocracy): add initial Cloudron package

Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.

Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.

Package-Workspace/Collaboration/consuldemocracy/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog — ConsulDemocracy Cloudron Package
+
+## 1.0.0 — 2026-09-06
+
+- Initial package: build-from-source on ruby:3.4.10-trixie (upstream
+  commit at package time; trimmed dev Dockerfile — no Chromium)
+- postgresql + localstorage addons; Rails server on :3000
+- Generated configs (database.yml / secrets.yml) under /app/data,
+  regenerated each boot; persisted secret_key_base
+- First-boot db:create/migrate/seed with marker; gated delayed_job
+  worker; in-container memcached
+- Platform OIDC wired into secrets.yml; local admin seeded
+  (admin@consul.dev — password change required on first login)