fix(events): enforce visibility on private event endpoints (closes #300)

Public events remain fully accessible without authentication.
Private events now require the caller to be the organizer or a
confirmed attendee; unauthenticated callers receive 401 and
authenticated non-members receive 403.

Changes:
- add getRequestUserId() soft-auth helper (returns null gracefully,
  never throws, used only on read endpoints)
- add canAccessEvent() returns 'allowed' | 'unauthenticated' |
  'forbidden' so callers can issue semantically correct 401 vs 403
- GET /api/events/:slug — visibility enforced after DB fetch;
  isPublic field intentionally excluded from response body
- GET /api/events/:slug/attendees — visibility enforced before
  returning any attendee data
- Routes registered with /api/events prefix in app.ts (removes the
  double-prefix issue from the prior implementation)
- 46 tests added covering public access, private 401/403, organizer
  access, attendee access, no-sensitive-field leakage, and unchanged
  pagination/sorting behaviour

Author: Ridanshi