feat: add Easy-Gate Cloudron package (Infrastructure) [#651]

Easy Gate 2.0.3 dashboard hub: multi-stage Go build (static binary on
cloudron/base 3.2.0), config persisted at /app/data/easy-gate.json with
real-time hot reload. No user model (IP-subnet groups only), so the app
ships behind the Cloudron auth proxy (httpAuth.type=proxy); localstorage
addon only, no database. Build validated green + smoke test HTTP 200.
Docs synced (STATUS/README/JOURNAL at 10/~57).

Ticket: https://projects.knownelement.com/issues/651

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -3,20 +3,20 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — 46 build tickets filed
-> (#633-#678, umbrella #632, Redmine project 55); clone-repos.sh repaired
-> and re-run; Cloudron redis-addon correction (NetBox re-rated viable).
+> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — Easy-Gate packaged
+> (#651, Infrastructure, 10th package); auth gate verdict: no user concept,
+> shipped behind the Cloudron auth proxy.
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 9 of ~57 upstream applications are
+Cloudron packaging pipeline is operational. 10 of ~57 upstream applications are
 packaged, committed, and pushed. Packaging templates exist for the core
 patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 All remaining apps now carry build tickets (#633-#678) under umbrella
 [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
 ready for the sequential grind-driver pattern.
 
-## Completed Packages (9)
+## Completed Packages (10)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -29,6 +29,7 @@ ready for the sequential grind-driver pattern.
 | 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
 | 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
 | 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
+| 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage |
 
 Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
 `Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -117,7 +118,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 | DevOps-Tools | 1 | 0/1 | |
 | Financial-Payments | 1 | 0/1 | |
 | Financial-Trading | 1 | 0/1 | |
-| Infrastructure | 6 | 0/6 | |
+| Infrastructure | 6 | 1/6 | easy-gate done |
 | Legal | 1 | 0/1 | |
 | Project-Management | 1 | 0/1 | |
 | Scientific-Computing | 2 | 0/2 | |
@@ -131,7 +132,7 @@ Auth capability is a hard gate before packaging (see
 LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 (unacceptable / blocked-on-auth).
 
-### Completed packages (9)
+### Completed packages (10)
 
 | App | OIDC | LDAP | Verdict | Note |
 |-----|------|------|---------|------|
@@ -144,6 +145,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
 | draw.io | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no users, stateless) |
 | Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) |
+| Easy-Gate | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no user concept; IP-subnet groups only) |
 
 ### Candidates researched