feat(consuldemocracy): add initial Cloudron package

Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.

Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.

Package-Workspace/Collaboration/consuldemocracy/Dockerfile

@@ -0,0 +1,86 @@
+# ConsulDemocracy Cloudron Package
+#
+# ConsulDemocracy is the citizen participation platform behind Madrid's
+# Consul (MIT): proposals, participatory budgeting, debates, polls,
+# legislation co-editing. Rails 8 + PostgreSQL, single web process plus
+# a delayed_job worker; memcached for the fragment cache.
+#
+# Upstream: https://github.com/consuldemocracy/consuldemocracy
+#   - No published image; the in-repo Dockerfile targets local dev
+#     (bind-mount uid remapping, Chromium for E2E tests). This package
+#     builds from source on the same ruby base, trimmed: no Chromium,
+#     no sudo, fixed non-root user, runtime configs via symlinks into
+#     /app/data (generated by start.sh on every boot).
+#
+# Authentication: NATIVE OIDC (preferred). devise + omniauth with
+# omniauth_openid_connect (name: :oidc, discovery: true) configured
+# per-environment in config/secrets.yml (oidc_client_id /
+# oidc_client_secret / oidc_issuer - see devise.rb:289-296 and
+# app/lib/omniauth_tenant_setup.rb). start.sh maps the Cloudron
+# platform provider (CLOUDRON_OIDC_*) into the generated secrets.yml.
+# SAML is also available; local login remains for the seeded admin.
+#
+# Pattern: build-from-source (Rails). Gemfile.lock + package.json are
+# committed upstream, so bundle/npm install are deterministic.
+FROM ruby:3.4.10-trixie
+
+ENV RAILS_ROOT=/var/www/consul \
+    RAILS_ENV=production \
+    RAILS_LOG_TO_STDOUT=true
+
+# runtime deps: imagemagick (upload processing), libpq + postgres client
+# (pg gem + db tasks), memcached (production cache_store is mem_cache_store
+# with dalli), plus build headers for the native gems below
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+      build-essential cmake pkg-config imagemagick libpq-dev \
+      postgresql-client memcached \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN adduser --shell /bin/bash --disabled-password --gecos "" --uid 1000 consul
+
+WORKDIR $RAILS_ROOT
+
+# gem layer first (cache marker): lockfile-driven, system-wide install
+# (.ruby-version MUST keep its name: the Gemfile resolves ruby file: ".ruby-version")
+COPY repo/.ruby-version ./
+COPY repo/Gemfile repo/Gemfile.lock ./
+# the Gemfile evals ./Gemfile_custom (developer-local, not in git); empty is valid
+RUN touch Gemfile_custom && \
+    bundle config set --local without 'development test' && bundle install --jobs 4
+
+# node for the asset pipeline (node-build pinned by .node-version)
+COPY repo/.node-version ./
+ENV PATH=/usr/local/node/bin:$PATH
+RUN curl -sL https://github.com/nodenv/node-build/archive/master.tar.gz | tar xz -C /tmp/ && \
+    /tmp/node-build-master/bin/node-build "$(cat .node-version)" /usr/local/node && \
+    rm -rf /tmp/node-build-master
+
+COPY repo/package.json repo/package-lock.json ./
+RUN npm install
+
+COPY repo/ ./
+
+# Rails 8's regexp_timeout default kills assets:precompile on the
+# graphiql minified-JS regexes under CPU contention; disable it (the
+# platform proxy bounds request time anyway). Also let the runtime user
+# write tmp/log/public/assets and db/ (apartment schema dump warning).
+RUN echo 'Regexp.timeout = nil' > config/initializers/00_cloudron_regexp_timeout.rb && \
+    mkdir -p public/assets tmp/pids tmp/sockets log db && \
+    chown -R consul:consul public/assets tmp log db
+
+# persistence: runtime-generated configs + marker files live in localstorage
+# (repo ships only .example files, the real ones are generated at start).
+# VOLUME + ownership: a fresh named volume inherits this dir's owner, so
+# start.sh (running as consul, uid 1000) can write its generated configs
+RUN mkdir -p /app/data && chown consul:consul /app/data && \
+    ln -s /app/data/secrets.yml config/secrets.yml && \
+    ln -s /app/data/database.yml config/database.yml
+VOLUME /app/data
+
+COPY start.sh /app/start.sh
+
+EXPOSE 3000
+
+USER consul
+
+ENTRYPOINT ["/bin/bash", "/app/start.sh"]