feat(consuldemocracy): add initial Cloudron package

Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.

Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.

Package-Workspace/Collaboration/consuldemocracy/CloudronManifest.json

@@ -0,0 +1,22 @@
+{
+  "manifestVersion": 2,
+  "type": "app",
+  "id": "io.cloudron.consuldemocracy",
+  "title": "ConsulDemocracy",
+  "description": "Open-source citizen participation platform (the engine behind Madrid's Consul): proposals with supports, participatory budgeting, debates, polls, collaborative legislation, and community voting. Rails on PostgreSQL with delayed_job background jobs. Single sign-on via the Cloudron OIDC provider; local login available for the seeded admin.",
+  "author": "Consul Democracy contributors",
+  "website": "https://consuldemocracy.org/",
+  "contactEmail": "cloudron@tsys.dev",
+  "tagline": "Citizen participation: proposals, budgets, debates and voting",
+  "version": "1.0.0",
+  "healthCheckPath": "/",
+  "httpPort": 3000,
+  "memoryLimit": 2048,
+  "addons": {
+    "localstorage": {},
+    "postgresql": {}
+  },
+  "mediaLinks": [],
+  "changelog": "Initial Cloudron package for ConsulDemocracy (build-from-source on ruby 3.4.10, trimmed from the upstream dev Dockerfile: no Chromium, fixed non-root user). start.sh regenerates config/database.yml + config/secrets.yml under /app/data every boot (addon credentials rotate), runs memcached locally, seeds the DB once (marker file; local admin admin@consul.dev - password must be changed on first login), backgrounds a gated delayed_job worker and serves Rails on :3000. OIDC wired from the platform provider into secrets.yml.",
+  "icon": "file://logo.png"
+}