feat: add GoAlert Cloudron package (Monitoring) [#633]

Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned),
single Go binary + postgresql only. Native generic OIDC wired from
the platform provider (GOALERT_OIDC_*), data-encryption key
persisted, optional first-admin basic auth. grind-stack verified:
full migration chain, serving, origin canonicalization correct.
18th package; category table reconciled to the 46-app set.

JOURNAL.md

@@ -1367,6 +1367,58 @@ landed mid-flight) + verification hardening follow-up
 
 ---
 
+### 18. GoAlert (Monitoring) ✅
+**Date**: 2026-09-06
+**Application**: GoAlert — Target's open-source on-call alerting
+(escalation chains, rotations, Slack/Twilio notifications, heartbeats,
+status dashboards). Upstream: https://github.com/target/goalert
+(Apache-2.0), v0.34.1. The cleanest Cloudron shape in the workspace: a
+single Go binary, PostgreSQL as the only store, migrations automatic.
+
+**Ticket**: [#633](https://projects.knownelement.com/issues/633)
+
+**Pattern**: official-image wrapper of `goalert/goalert:0.34.1`
+(amd64-manifest digest pinned; alpine + `apk add bash` for the
+/dev/tcp wait loop, same as ChirpStack).
+
+**Auth gate verdict**: ✅ OIDC preferred. Generic OIDC is first-class in
+core (config.go OIDC struct on go-oidc, any issuer):
+`GOALERT_OIDC_{ENABLE,ISSUER_URL,CLIENT_ID,CLIENT_SECRET,NEWUSERS}`
+wired from `CLOUDRON_OIDC_*`. Callback:
+`/api/v2/identity/providers/oidc/callback` (verified in
+auth/handler.go:271,392 + oidc provider appends `/callback`).
+GitHub OAuth + basic auth also exist; start.sh exposes optional
+first-admin basic auth via `GOALERT_ADMIN_USER/PASS` app env vars.
+
+**Key decisions**:
+
+- `GOALERT_DB_URL` built from the postgresql addon env (sslmode=disable
+  — the addon is on the platform network).
+- `GOALERT_DATA_ENCRYPTION_KEY` persisted under /app/data (rotating it
+  loses encrypted notification-provider credentials).
+- `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN`: GoAlert canonicalizes
+  every request to the https origin — behind Cloudron's TLS proxy that
+  is exactly right; during local verification every path 307s to the
+  origin (expected, not a loop).
+- Observed under the CPUWeight-25 batch slice: `slow cycle finished`
+  engine warnings (~5s cycles vs the 5s threshold) — contention
+  artifact, not a package defect; note for live sizing.
+
+**Verification** (grind-stack, ephemeral postgres): build green
+(small image — single binary); boot = PG wait → key generation → full
+migration chain applied → serving 307→https origin on :8081; container
+stable 5+ min under load.
+
+**Files Created**: Dockerfile, CloudronManifest.json (port 8081,
+localstorage + postgresql, 1024MB, healthCheckPath /api/v2/heartbeat),
+start.sh, README.md (auth table + admin bootstrap), CHANGELOG.md,
+.dockerignore, logo.png (Target org avatar — repo embeds its frontend,
+no logo file ships).
+
+**Commit**: `feat: add GoAlert Cloudron package (Monitoring) [#633]`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use