fix: bound public concert queries

[chubes4]

Summary

• enforce shared 1..100 history and attendee bounds in the canonical Users service while preserving shipped defaults (20 history, 10 attendees)
• expose the same minimum/default/maximum contract through registered ability schemas and native ability REST validation
• document attendee item fields, normalize response scalar types, and verify newest-first created_at ordering
• cover malformed, zero, negative, oversized, boundary, prepared-SQL, pagination, public past-only, and realistic 105-record histories/attendee lists

Companion transport PR

Extra-Chill/extrachill-api#119 mirrors these contracts in the shipped /extrachill/v1 routes and removes coercive absint sanitization. Merge this canonical Users PR first, then merge API #119.

Verification

• PHP syntax passed for all changed PHP files
• git diff --check origin/main...HEAD passed
• scoped Homeboy lint/PHPCS passed (c27a8034-8fa6-47b7-ac3f-f02bc49812b8); two pre-existing alignment warnings remain outside changed hunks
• focused PHPUnit attempted, but WP Codebox failed during multisite install before loading tests (7700c630-0970-47cd-8aa6-ae1f08f318dd)
• runner defects tracked in fix: make WP Codebox PHPUnit multisite bootstrap reliable homeboy-extensions#2305

Closes #219

[chubes4]

Review blocker addressed in both layers. This PR now asserts newest-first attendee ordering and the documented attendee object shape. Companion transport PR: Extra-Chill/extrachill-api#119. Merge order: Users #226 first, then API #119. Focused PHPUnit remains blocked before test loading by Extra-Chill/homeboy-extensions#2305; scoped PHPCS, syntax, and diff checks pass.