feat: add draw.io Cloudron package (Documentation-Tools)

draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.

- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy

Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -3,17 +3,16 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — gardening protocol established;
-> inventory counts reconciled to 7 packaged / 57 upstream apps.
+> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — draw.io packaged (auth-proxy
+> pattern); mandatory auth policy established.
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 7 of ~57 upstream applications are
-packaged, committed, and pushed. Packaging templates exist for the four core
-patterns. The gardening protocol (this file + AGENTS.md) was just established
-to keep docs in sync going forward.
+Cloudron packaging pipeline is operational. 8 of ~57 upstream applications are
+packaged, committed, and pushed. Packaging templates exist for the core
+patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 
-## Completed Packages (7)
+## Completed Packages (8)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -24,6 +23,7 @@ to keep docs in sync going forward.
 | 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
 | 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
 | 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
+| 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
 
 Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
 `Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -46,7 +46,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 |----------|------|----------|-------|
 | **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete |
 | Development | 4 | 2/4 | reviewboard, puter done |
-| Documentation-Tools | 3 | 1/3 | wireviz-web done |
+| Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
 | Low-Code | 3 | 1/3 | corteza done |
 | Monitoring | 6 | 1/6 | healthchecks done |
 | Automation | 4 | 0/4 | |
@@ -92,10 +92,11 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
 | Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
 
-**Immediate queue:** docker-drawio (proxy auth), Windmill (OIDC).
+**Immediate queue:** Windmill (OIDC).
 **Deferred:** NetBox (bundle Valkey+supervisor — significant), Gophish
 (blocked-on-auth).
-**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web; revisit Puter auth.
+**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
+revise Puter auth. draw.io ✅ packaged with auth proxy.
 
 ## Known Issues