feat: add draw.io Cloudron package (Documentation-Tools)

draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.

- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy

Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

Package-Workspace/Documentation-Tools/docker-drawio/Dockerfile

@@ -0,0 +1,26 @@
+# draw.io Cloudron Package
+#
+# draw.io (diagrams.net) is a client-side JavaScript diagramming application
+# served by Tomcat. It is stateless: diagrams are stored in the browser
+# (localStorage) or exported / synced to cloud storage (Google Drive, OneDrive,
+# GitHub, etc.). There is no database and no server-side persistence.
+#
+# Authentication: draw.io has no user model, so this package uses Cloudron's
+# authentication proxy (httpAuth.type=proxy in CloudronManifest.json). The
+# Cloudron admin restricts which platform users may reach the app; the browser
+# then challenges for Cloudron credentials before access is granted.
+FROM jgraph/drawio:24.7.17
+
+# The upstream Tomcat image may not ship curl; install it for the health check.
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+    CMD curl -f http://localhost:8080/ || exit 1
+
+# Upstream CMD (ENTRYPOINT /docker-entrypoint.sh + "catalina.sh run") is
+# inherited unchanged; Tomcat serves draw.war as the root webapp on 8080.