Add examples/demo: one of every CRD, plus a script to fire alerts at it

A self-contained demo kit: a TerdutServer against a throwaway, bare
Postgres (bring-your-own DSN -- simplest path to stand up from nothing,
ROADMAP.md Stage 1's own note), two TerdutTeams, and each team's own
TerdutEscalationRule/TerdutDeadmanSwitch/TerdutAlertSource, so every CRD
this operator manages is exercised together rather than in isolation the
way config/samples' one-of-each already does.

fire-alerts.sh sends terdut-server's own amPayload/amAlert shape (read
from internal/api/alertmanager.go in that repo, not guessed from its
docs) at whichever TerdutAlertSource's generated webhook Secret it reads
the key out of -- high-cpu/disk-full/pod-crash scenarios to open and
resolve incidents, and a heartbeat scenario matching each team's dead
man's switch matcher, so stopping it demonstrates the switch noticing
silence on its own.

Verified server-side (kubectl apply --dry-run=server -k examples/demo)
against this operator's own dev cluster, which already has these CRDs
installed: every object validates. The one warning that cluster's
"restricted" PodSecurity raises (postgres:17-alpine's entrypoint needs to
start as root before it drops privileges itself) is noted inline in
00-postgres.yaml rather than worked around -- not a real production
pattern, and this Postgres exists only to be thrown away with the rest of
the demo namespace.

README.md walks through: applying, watching status, why a few early
CrashLoopBackOff restarts on terdut-demo itself are expected (this
operator's Deployment template has no wait-for-postgres init container
yet, unlike charts/terdut-server's chart as of v0.33.2), reaching the web
UI (port-forward -- spec.networking.hostname is accepted but nothing
creates an HTTPRoute for it yet), turning on open signup with the
operator's own generated admin token since the bootstrap-created account
has no password, firing alerts, and tearing down.

examples/demo/01-server.yaml

@@ -0,0 +1,32 @@
+# The one TerdutServer this whole demo runs against. Everything else in
+# this directory (teams, escalation rules, dead man's switches, alert
+# sources) references it by name.
+#
+# networking.hostname is accepted but not yet acted on: creating the
+# HTTPRoute for it isn't implemented yet (api/v1alpha1/terdutserver_types.go,
+# NetworkingSpec's own doc comment) -- this TerdutServer is reachable from
+# outside the cluster only by port-forwarding its Service, same name as
+# this object (see README.md).
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutServer
+metadata:
+  name: terdut-demo
+spec:
+  image:
+    repository: git.ryuvia.com/niklas/terdut-server
+    tag: v0.33.2
+  replicas: 1
+  networking:
+    hostname: terdut-demo.example
+    servicePort: 8080
+  database:
+    dsn: "postgres://terdut@terdut-demo-postgres:5432/terdut?sslmode=disable"
+    passwordSecretRef:
+      name: terdut-demo-postgres
+      key: password
+  sweeper:
+    staleAfter: 6h
+    archiveAfter: 168h
+  # No oidc block: password login only, so there's nothing external to
+  # register a redirect URI with before this demo can sign in.
+  passwordLogin: true