feat: add Easy-Gate Cloudron package (Infrastructure) [#651]

Easy Gate 2.0.3 dashboard hub: multi-stage Go build (static binary on
cloudron/base 3.2.0), config persisted at /app/data/easy-gate.json with
real-time hot reload. No user model (IP-subnet groups only), so the app
ships behind the Cloudron auth proxy (httpAuth.type=proxy); localstorage
addon only, no database. Build validated green + smoke test HTTP 200.
Docs synced (STATUS/README/JOURNAL at 10/~57).

Ticket: https://projects.knownelement.com/issues/651

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

JOURNAL.md

@@ -4,7 +4,7 @@
 **Project**: TSYSDevStack-SupportStack-Cloudron
 **Goal**: Package ~57 applications for Cloudron PaaS platform
 **Start Date**: 2025-01-24
-**Current Status**: 7/~57 packages completed (~12%)
+**Current Status**: 10/~57 packages completed (~18%)
 
 ## Completed Packages
 
@@ -770,6 +770,57 @@ Dockerfile
 
 **Commit**: `feat: add Windmill Cloudron package (Automation)`
 
+### 10. Easy-Gate (Infrastructure) ✅
+**Date**: 2026-09-01
+**Application**: Easy Gate — web dashboard hub for self-hosted infrastructure
+(config-file driven, real-time hot reload, IP-subnet group visibility)
+**Package Size**: 3.18GB (cloudron/base 3.2.0 dominates)
+**Port**: 8080
+**Addons**: localstorage (auth proxy, no database)
+
+**Key Learnings**:
+- **Auth gate verdict**: Easy Gate has NO user model at all — visibility is
+  purely IP-subnet based (groups with CIDR ranges), no login/OIDC/LDAP
+  anywhere in the codebase → packaged with `httpAuth.type = proxy` (the
+  draw.io pattern for user-less apps)
+- Multi-stage Go build from the cloned repo (Webhook pattern):
+  `golang:1.23-alpine` builder, `CGO_ENABLED=0 -trimpath -ldflags="-w -s"`
+  (mirrors upstream Makefile), static binary onto `cloudron/base:3.2.0`
+- Config-driven design: the app re-parses `easy-gate.json` every second —
+  no restart needed on config edits; start.sh only seeds the first copy
+- `behind_proxy: true` matters on Cloudron: group subnet matching uses
+  `X-Forwarded-For` (Cloudron's nginx passes the real client IP)
+- No `.env.example` shipped: the only knob is the JSON config file itself
+  (documented in the package README instead)
+- Package-root `.dockerignore` (`repo/.git`, `repo/.github`, ...) keeps the
+  cloned repo's git history out of the build context (webhook shipped
+  without one and paid the context-size cost)
+
+**Build Process**:
+- Upstream `wiredlush/easy-gate` v2.0.3 cloned into `repo/` (gitignored)
+- `go mod download` cached before `COPY repo/ .` for layer reuse
+- Logo converted from upstream `assets/logo.svg` to a 234x256 PNG via
+  ImageMagick on the host
+- start.sh: seeds `/app/data/easy-gate.json` on first run, then
+  `exec /usr/local/bin/easy-gate` (env `EASY_GATE_CONFIG_PATH`)
+
+**Validation**:
+- `docker build --cgroup-parent ukrrs-batch.slice -t easy-gate-cloudron:test` → green
+- Throwaway smoke container: `GET /` → HTTP 200, seeded config verified
+  (`behind_proxy: true`), container removed after test
+
+**Files Created**:
+- Dockerfile (multi-stage Go build)
+- CloudronManifest.json (port 8080, localstorage only, httpAuth proxy,
+  healthCheckPath /, 256MB memory)
+- start.sh (first-run config seed) — committed executable
+- README.md (auth story, config table, usage)
+- CHANGELOG.md
+- .dockerignore (build-context hygiene)
+- logo.png (upstream logo.svg → PNG)
+
+**Commit**: `feat: add Easy-Gate Cloudron package (Infrastructure) [#651]`
+
 ---
 
 ## Packaging Pattern: Download Pre-Compiled Binaries