Add examples/demo: one of every CRD, plus a script to fire alerts at it

A self-contained demo kit: a TerdutServer against a throwaway, bare
Postgres (bring-your-own DSN -- simplest path to stand up from nothing,
ROADMAP.md Stage 1's own note), two TerdutTeams, and each team's own
TerdutEscalationRule/TerdutDeadmanSwitch/TerdutAlertSource, so every CRD
this operator manages is exercised together rather than in isolation the
way config/samples' one-of-each already does.

fire-alerts.sh sends terdut-server's own amPayload/amAlert shape (read
from internal/api/alertmanager.go in that repo, not guessed from its
docs) at whichever TerdutAlertSource's generated webhook Secret it reads
the key out of -- high-cpu/disk-full/pod-crash scenarios to open and
resolve incidents, and a heartbeat scenario matching each team's dead
man's switch matcher, so stopping it demonstrates the switch noticing
silence on its own.

Verified server-side (kubectl apply --dry-run=server -k examples/demo)
against this operator's own dev cluster, which already has these CRDs
installed: every object validates. The one warning that cluster's
"restricted" PodSecurity raises (postgres:17-alpine's entrypoint needs to
start as root before it drops privileges itself) is noted inline in
00-postgres.yaml rather than worked around -- not a real production
pattern, and this Postgres exists only to be thrown away with the rest of
the demo namespace.

README.md walks through: applying, watching status, why a few early
CrashLoopBackOff restarts on terdut-demo itself are expected (this
operator's Deployment template has no wait-for-postgres init container
yet, unlike charts/terdut-server's chart as of v0.33.2), reaching the web
UI (port-forward -- spec.networking.hostname is accepted but nothing
creates an HTTPRoute for it yet), turning on open signup with the
operator's own generated admin token since the bootstrap-created account
has no password, firing alerts, and tearing down.

examples/demo/00-postgres.yaml

@@ -0,0 +1,91 @@
+# Demo-only Postgres: a bare Deployment+Service+Secret, not the Zalando
+# postgres-operator path (DatabaseSpec.postgresClusterRef, DESIGN.md §8).
+# Bring-your-own DSN is the simpler of the two paths to stand up from
+# nothing (ROADMAP.md Stage 1's own note), which is all this needs to be.
+#
+# emptyDir, one replica, a password sitting in a plaintext Secret below --
+# none of that is how you'd run Postgres for real. It exists only so
+# 01-server.yaml has something to talk to. Throw the whole demo namespace
+# away when you're done; nothing here is meant to survive that.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: terdut-demo-postgres
+type: Opaque
+stringData:
+  password: demo-not-a-real-password
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: terdut-demo-postgres
+  labels:
+    app: terdut-demo-postgres
+spec:
+  replicas: 1
+  # Recreate, not RollingUpdate: emptyDir means a new pod starts with an
+  # empty database anyway, and two Postgres pods would never agree on one
+  # emptyDir each.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: terdut-demo-postgres
+  template:
+    metadata:
+      labels:
+        app: terdut-demo-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:17-alpine
+          # Partial, deliberately: the official image's entrypoint needs to
+          # start as root to chown the data directory before it drops
+          # privileges itself (gosu, to the postgres user) -- forcing
+          # runAsNonRoot here would just refuse to start the container. A
+          # "restricted" PodSecurity namespace warns on that gap rather
+          # than blocking (confirmed server-side against this operator's
+          # own dev cluster), which is an acceptable tradeoff for Postgres
+          # that exists only to be thrown away with the rest of this demo.
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: terdut
+            - name: POSTGRES_DB
+              value: terdut
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: terdut-demo-postgres
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+              subPath: pgdata
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "terdut"]
+            initialDelaySeconds: 5
+      volumes:
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: terdut-demo-postgres
+spec:
+  selector:
+    app: terdut-demo-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres