feat: add Windmill Cloudron package (Automation)

Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.

- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
  single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
  waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
  returned /api/version => "CE v1.514.1", HTTP 200

Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

JOURNAL.md

@@ -723,6 +723,55 @@ Dockerfile
 
 ---
 
+### 9. Windmill (Automation) ✅
+**Date**: 2026-07-30
+**Application**: Windmill — open-source workflow automation / internal-apps platform
+**Package Size**: ~2GB (bundles Python, Go, Rust runtimes for user scripts)
+**Port**: 8000
+**Addons**: localstorage, postgresql
+
+**Key Learnings**:
+- Official-image wrapper around `ghcr.io/windmill-labs/windmill:1.514.1`
+- **PostgreSQL-only**: Windmill uses Postgres `LISTEN/NOTIFY` for job queuing,
+  so **no Redis is required** (unlike NetBox). This makes it a clean Cloudron fit.
+- Single-container **server mode** embeds a default worker (no separate worker
+  container needed)
+- `DATABASE_URL` is composed at runtime in `start.sh` from the Cloudron
+  PostgreSQL addon env vars — Windmill has no per-var DB config, just the URI
+- **OIDC/SAML are configured in the in-app Admin Settings UI** (persisted to
+  the DB), not via environment variables — so the package supports OIDC but
+  the admin enables it post-install
+
+**Build Process**:
+- Base: `ghcr.io/windmill-labs/windmill:1.514.1` (pinned, verified)
+- Image config inspected (no full pull) via `docker buildx imagetools inspect`
+  to confirm WorkingDir `/usr/src/app`, binary `windmill` on PATH, port 8000
+- `start.sh` waits for Postgres (bash `/dev/tcp`, no `pg_isready` dependency),
+  then `exec windmill`
+- Logo extracted from inside the image (`/static_frontend/logo.svg`) and
+  converted to PNG with ImageMagick
+
+**Validation (full integration test)**:
+- `docker build` → success
+- Ran a throwaway `postgres:14-alpine` + the windmill image on a shared network
+- Migrations completed (`v2 finalization step successfully applied`)
+- `GET /api/version` → `CE v1.514.1`, HTTP 200 ✅
+- Non-fatal: logs an embeddings-DB error when no AI API key is set (expected;
+  Windmill runs fine without AI embeddings)
+
+**Files Created**:
+- Dockerfile (official-image wrapper)
+- CloudronManifest.json (port 8000, postgresql + localstorage, healthCheckPath /api/version, 2GB memory)
+- start.sh (DB wait + DATABASE_URL composition) — committed executable
+- README.md (OIDC post-install setup, features, addons)
+- CHANGELOG.md
+- .env.example
+- logo.png (brand icon from upstream image, SVG→PNG)
+
+**Commit**: `feat: add Windmill Cloudron package (Automation)`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use