fix(pretix): increase memory limit to 6Gi; eventyay nginx sidecar; crowdsec middleware

pretix/standalone runs gunicorn + celery + celery-beat in one container
and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi.

eventyay: add nginx sidecar to serve static files, update health probes
to check a static asset at port 8080, add create-superuser script,
register script in manifest.

crowdsec: middleware fix (previously uncommitted).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

eventyay/versions/1/deployment.yaml

@@ -122,26 +122,48 @@ spec:
               mountPath: /home/app/.gunicorn
           livenessProbe:
             httpGet:
-              path: /
-              port: 8000
-              httpHeaders:
-                - name: Host
-                  value: "{{ .domain }}"
+              path: /static/pretixbase/img/eventyay-icon.svg
+              port: 8080
             initialDelaySeconds: 120
             timeoutSeconds: 10
             periodSeconds: 30
             failureThreshold: 6
           readinessProbe:
             httpGet:
-              path: /
-              port: 8000
-              httpHeaders:
-                - name: Host
-                  value: "{{ .domain }}"
+              path: /static/pretixbase/img/eventyay-icon.svg
+              port: 8080
             initialDelaySeconds: 60
             timeoutSeconds: 5
             periodSeconds: 15
             failureThreshold: 3
+        - name: nginx
+          image: nginxinc/nginx-unprivileged:1.27-alpine
+          ports:
+            - name: nginx-http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: eventyay-static
+              mountPath: /static
+              readOnly: true
+            - name: nginx-config
+              mountPath: /etc/nginx/conf.d
+              readOnly: true
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_BIND_SERVICE
+            readOnlyRootFilesystem: false
       volumes:
         - name: eventyay-data
           persistentVolumeClaim:
@@ -150,6 +172,9 @@ spec:
           emptyDir: {}
         - name: eventyay-gunicorn
           emptyDir: {}
+        - name: nginx-config
+          configMap:
+            name: eventyay-nginx
       restartPolicy: Always
 ---
 apiVersion: apps/v1
@@ -237,9 +262,9 @@ spec:
             limits:
               cpu: "2"
               ephemeral-storage: 1Gi
-              memory: 1Gi
+              memory: 4Gi
             requests:
               cpu: 50m
               ephemeral-storage: 50Mi
-              memory: 512Mi
+              memory: 2Gi
       restartPolicy: Always