feat: add Rathole Cloudron package (Infrastructure) [#650]

Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary
(sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port
tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict
(no user concept). Verified end-to-end with a live client tunnel.
Docs gardened (STATUS/README/JOURNAL to 11 packages).

Ticket: https://projects.knownelement.com/issues/650

Package-Workspace/Infrastructure/rathole/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog — Rathole Cloudron Package
+
+## 1.0.0 (2026-09-01)
+
+Initial Cloudron package for Rathole 0.5.0 (server mode).
+
+- Pre-compiled-binaries pattern: upstream `x86_64-unknown-linux-gnu`
+  release zip downloaded at build time behind a sha256 pin (musl release
+  builds were dropped upstream in v0.5.0).
+- Runtime `cloudron/base:4.0.0` (Ubuntu 22.04): the gnu binary requires
+  glibc >= 2.35, too new for the 3.x (20.04) base used by earlier
+  packages.
+- `start.sh` seeds `/app/data/server.toml` on first run with a random
+  `default_token` (openssl) and a placeholder `[server.services.example]`
+  binding :5200 — upstream rejects a server config with zero services —
+  then execs `rathole --server`; the config hot-reloads on save.
+- Verified end-to-end at build time: a client container tunneled its own
+  HTTP server through the packaged server (token auth, lazy service bind,
+  hot-reload of added services).
+- TCP surface: control channel on 2333 + a 100-port tunnel exit range
+  (5200-5299) declared via `tcpPorts` with `containerPort`/`portCount`.
+- No user concept → `httpAuth.type = proxy` gates a small static status
+  page served on the HTTP port (also serves as the platform health
+  check); tunnel access itself is controlled by rathole's mandatory
+  per-service tokens.
+- Addons: `localstorage` only (config persistence; no database).
+- Logo padded from the upstream wordmark to a 256x256 PNG.