feat: add GoAlert Cloudron package (Monitoring) [#633]

Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned),
single Go binary + postgresql only. Native generic OIDC wired from
the platform provider (GOALERT_OIDC_*), data-encryption key
persisted, optional first-admin basic auth. grind-stack verified:
full migration chain, serving, origin canonicalization correct.
18th package; category table reconciled to the 46-app set.

Package-Workspace/Monitoring/goalert/Dockerfile

@@ -0,0 +1,35 @@
+# GoAlert Cloudron Package
+#
+# GoAlert is Target's open-source on-call alerting system: escalation
+# chains, schedules/rotations, notification rules (SMS/phone via
+# Twilio/VictorOps etc., Slack), heartbeat checks, status dashboards —
+# a single Go binary serving web UI + REST API on :8081 with
+# PostgreSQL as the only backing store.
+#
+# Upstream: https://github.com/target/goalert (Apache-2.0), v0.34.1.
+#   - Official image goalert/goalert (alpine, /usr/bin/goalert, runs a
+#     build-time self-test). DB schema migrations run automatically at
+#     startup; no separate worker/scheduler processes.
+#   - Configuration is envconfig-style: GOALERT_<SECTION>_<FIELD>
+#     (GOALERT_DB_URL, GOALERT_PUBLIC_URL, GOALERT_OIDC_*, ...).
+#
+# Authentication: NATIVE OIDC (preferred). Generic OpenID Connect in
+# core (config/config.go OIDC struct; go-oidc against any issuer):
+# start.sh wires GOALERT_OIDC_ENABLE/ISSUER_URL/CLIENT_ID/CLIENT_SECRET
+# from the Cloudron platform provider (CLOUDRON_OIDC_*), with
+# new-user creation enabled. GitHub OAuth and basic-auth also exist.
+#
+# Pattern: official-image wrapper. Image pinned by tag AND digest
+# (amd64 manifest digest of v0.34.1 from docker manifest inspect).
+FROM goalert/goalert:v0.34.1@sha256:36b3962e3171de7ba6b964bcba21a9fee3fe331dc01d9716ee8bbd7bc01ba935
+
+# bash for start.sh (alpine's ash lacks /dev/tcp used by the addon wait)
+USER root
+RUN apk add --no-cache bash
+
+COPY start.sh /app/start.sh
+
+# web UI + REST API; notifications are all outbound (no extra listeners)
+EXPOSE 8081
+
+ENTRYPOINT ["/bin/bash", "/app/start.sh"]