BuyupsAccountController

Subscriber-facing REST endpoints for buy-up listing, purchase, and cancellation. Ships in feature/membership-launch-cleanup. Uses cookie authentication. Exposes GET /shows/{id}/buyups, POST /shows/{id}/buyups/{buyup_id}/subscribe, and DELETE /shows/{id}/buyups/{buyup_id}/cancel. Capped buy-up purchases are serialized through BuyupCapLock to prevent concurrent race conditions; uncapped buy-ups bypass the lock entirely.