feat: add draw.io Cloudron package (Documentation-Tools)

draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.

- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy

Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

JOURNAL.md

@@ -678,6 +678,51 @@ Dockerfile
 
 ---
 
+### 8. draw.io (Documentation-Tools) ✅
+**Date**: 2026-07-30
+**Application**: draw.io (diagrams.net) — client-side diagramming tool
+**Package Size**: ~600MB (Tomcat base)
+**Port**: 8080
+**Addons**: none (stateless; no database, no persistent storage)
+
+**Key Learnings**:
+- First package to use the **Cloudron authentication proxy** pattern
+  (`httpAuth.type = proxy`) for a user-less utility app
+- Stateless: diagrams live in browser localStorage or cloud storage (Google
+  Drive, OneDrive, GitHub) — no server-side state at all
+- Verified image tag before pinning via `docker manifest inspect` to avoid a
+  build failure on a non-existent tag
+- Confirmed base image (Tomcat/Debian-slim) lacks curl → installed it in the
+  wrapper for the Docker HEALTHCHECK
+
+**Build Process**:
+- Base: `jgraph/drawio:24.7.17` (pinned, verified tag)
+- `apt-get install curl` for the health check
+- Inherits upstream ENTRYPOINT (`/docker-entrypoint.sh`) + CMD (`catalina.sh run`)
+- No build stage, no runtime setup script needed
+
+**Auth Pattern (NEW)**:
+- draw.io has no user model → use Cloudron `httpAuth.type = proxy`
+- Cloudron admin restricts which platform users reach the app; the browser
+  challenges for Cloudron credentials before the editor loads
+- This is the template for all future stateless / no-user apps
+
+**Validation**:
+- `docker build` → success
+- `docker run` + `curl http://localhost:8080/` → HTTP 200, container healthy
+
+**Files Created**:
+- Dockerfile (official-image wrapper + curl)
+- CloudronManifest.json (port 8080, httpAuth proxy, healthCheckPath /)
+- README.md (auth-proxy usage, features, optional env vars)
+- CHANGELOG.md
+- .env.example (optional DRAWIO_* knobs)
+- logo.png (draw.io brand icon from upstream repo)
+
+**Commit**: `feat: add draw.io Cloudron package (Documentation-Tools)`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use