feat(consuldemocracy): add initial Cloudron package

Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.

Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.

scripts/grind-stack.sh

@@ -75,8 +75,9 @@ cmd_up() {
       $(label_args) redis:7-alpine --requirepass testrd >/dev/null ;;
   esac
 
-  # the same env contract Cloudron injects, pointed at the test services
-  docker run -d --rm --name "$APP" --cgroup-parent "$SLICE" --network "$NET" \
+  # the same env contract Cloudron injects, pointed at the test services.
+  # No --rm on the app: a crashed container must keep its logs for `logs`.
+  docker run -d --name "$APP" --cgroup-parent "$SLICE" --network "$NET" \
     $(label_args) -v "grind-$APPNAME-data:/app/data" \
     -p "127.0.0.1:$TESTPORT:$PORT" \
     -e CLOUDRON_POSTGRESQL_HOST="$PG" -e CLOUDRON_POSTGRESQL_PORT=5432 \