feat(helm): mariadb-operator Database/User/Grant CRDs

When mariadb.enabled=true, references the in-cluster MariaDB this
chart deploys. When false, references an external CR via
mariadb.externalRef. Privileges scoped to the website's database
only — no global ALL PRIVILEGES.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/templates/mariadb-database.yaml

@@ -0,0 +1,16 @@
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Database
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-db
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+spec:
+  mariaDbRef:
+    {{- if .Values.mariadb.enabled }}
+    name: {{ include "ezscale-website.fullname" . }}-mariadb
+    {{- else }}
+    name: {{ .Values.mariadb.externalRef.name }}
+    namespace: {{ .Values.mariadb.externalRef.namespace }}
+    {{- end }}
+  characterSet: utf8mb4
+  collate: utf8mb4_unicode_ci
+  name: {{ .Values.mariadb.database }}