fix(pretix): increase memory limit to 6Gi; eventyay nginx sidecar; crowdsec middleware

pretix/standalone runs gunicorn + celery + celery-beat in one container
and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi.

eventyay: add nginx sidecar to serve static files, update health probes
to check a static asset at port 8080, add create-superuser script,
register script in manifest.

crowdsec: middleware fix (previously uncommitted).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

eventyay/versions/1/scripts/create-superuser.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Create an Eventyay superuser (organizer admin account).
+#
+# Required for first-time setup — the web UI cannot be accessed until
+# at least one superuser exists.
+#
+# Runs on the worker pod because the web pod's memory limit is too tight
+# to run an additional Django process alongside gunicorn workers.
+set -e
+set -o pipefail
+
+if [ -z "${KUBECONFIG}" ] || [ -z "${WILD_INSTANCE}" ] || [ -z "${WILD_API_DATA_DIR}" ]; then
+    echo "ERROR: KUBECONFIG, WILD_INSTANCE, and WILD_API_DATA_DIR must be set"
+    exit 1
+fi
+
+if [ -z "${EMAIL}" ]; then
+    echo "ERROR: EMAIL is required"
+    exit 1
+fi
+
+CONFIG_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/config.yaml"
+
+NAMESPACE="$(yq '.apps.eventyay.namespace' "${CONFIG_FILE}" | tr -d '"')"
+NAMESPACE="${NAMESPACE:-eventyay}"
+
+# Run on the worker pod — same image as web, but with a higher memory limit
+# which is needed to run manage.py alongside the existing gunicorn workers.
+POD="$(kubectl get pods -n "${NAMESPACE}" -l component=worker --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)"
+if [ -z "${POD}" ]; then
+    echo "ERROR: No running Eventyay worker pod found in namespace ${NAMESPACE}"
+    exit 1
+fi
+
+if [ -z "${PASSWORD}" ]; then
+    PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)"
+fi
+
+echo "Creating superuser '${EMAIL}'..."
+
+kubectl exec -n "${NAMESPACE}" "${POD}" -- \
+    python manage.py shell -c "
+from django.contrib.auth import get_user_model
+User = get_user_model()
+if User.objects.filter(email='${EMAIL}').exists():
+    raise SystemExit('ERROR: User ${EMAIL} already exists')
+User.objects.create_superuser(email='${EMAIL}', password='${PASSWORD}')
+"
+
+echo ""
+echo "=== Superuser created ==="
+echo "Email:    ${EMAIL}"
+echo "Password: ${PASSWORD}"
+echo ""
+echo "Log in at /orga/login/ with these credentials."
+echo "Save this password — it will not be shown again."