feat: add GoAlert Cloudron package (Monitoring) [#633]

Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned),
single Go binary + postgresql only. Native generic OIDC wired from
the platform provider (GOALERT_OIDC_*), data-encryption key
persisted, optional first-admin basic auth. grind-stack verified:
full migration chain, serving, origin canonicalization correct.
18th package; category table reconciled to the 46-app set.

Package-Workspace/Monitoring/goalert/README.md

@@ -0,0 +1,44 @@
+# GoAlert — Cloudron Package
+
+[GoAlert](https://github.com/target/goalert) v0.34.1 — Target's open-source
+on-call alerting: escalation chains, schedules and rotations, notification
+rules (Slack, Twilio SMS/voice, VictorOps, ...), heartbeats, status
+dashboards. A **single Go binary** with PostgreSQL as its only store —
+packaged as an official-image wrapper around `goalert/goalert`
+(digest-pinned), the cleanest Cloudron shape in this workspace.
+
+## Authentication (auth gate: ✅ OIDC preferred)
+
+Generic OpenID Connect is first-class in core (`config/config.go` OIDC
+struct on go-oidc — any compliant issuer). `start.sh` wires it from the
+Cloudron platform provider:
+
+| GoAlert env | Source |
+|-------------|--------|
+| `GOALERT_OIDC_ENABLE=true` | fixed |
+| `GOALERT_OIDC_ISSUER_URL` | `CLOUDRON_OIDC_ISSUER` |
+| `GOALERT_OIDC_CLIENT_ID` | `CLOUDRON_OIDC_CLIENT_ID` |
+| `GOALERT_OIDC_CLIENT_SECRET` | `CLOUDRON_OIDC_CLIENT_SECRET` |
+| `GOALERT_OIDC_NEWUSERS=true` | overridable (`GOALERT_OIDC_NEWUSERS`) |
+
+- SSO redirect: `https://<app-domain>/api/v2/identity/providers/oidc/callback`
+- OIDC-registered users are created **without** privileges. First admin:
+  set `GOALERT_ADMIN_USER` + `GOALERT_ADMIN_PASS` app env vars once —
+  start.sh exposes them as basic auth — log in, promote your SSO account,
+  then unset them (README + `.env.example`).
+
+## Runtime layout
+
+| Concern | How |
+|---------|-----|
+| Database | Cloudron `postgresql` addon; migrations run automatically at startup |
+| Encryption key | `GOALERT_DATA_ENCRYPTION_KEY` generated once, persisted in `/app/data` (rotating loses provider credentials) |
+| Public URL | `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN` |
+| Notifications | All outbound (Slack/Twilio/webhooks) — no inbound ports beyond 8081 |
+| Storage | `/app/data` (localstorage) — key + future runtime files |
+
+## Notes
+
+- Version upgrades: bump tag+digest in the Dockerfile, rebuild —
+  migrations run on first boot.
+- Package pattern + verification: repo `JOURNAL.md`, GoAlert section.