Make event creation atomic and reconcile event data contracts

[moirakk]

Summary

Make organizer event creation transactional, preserve authenticated identity through PostgreSQL, and align event reads with the canonical Supabase schema.

What Changed

• Added the create_event_atomic database RPC.
• Create the event, owner collaborator, finance setup, optional payment-code version, and audit record in one transaction.
• Replaced multi-step service-role writes with an authenticated Supabase RPC call.
• Added an idempotent migration for older clean-dev databases missing organizer invitation lifecycle fields.
• Removed reads of the intentionally absent events.registered_count column.
• Added get_public_event_registration_counts, a narrow aggregate RPC that exposes capacity usage without participant rows.
• Added migration contracts, API adapter contracts, real clean-dev assertions, and updated validation documentation.

Why

The previous route could leave partial records when a later write failed. Read adapters also depended on a denormalized column outside the canonical schema. This PR gives creation one success-or-rollback boundary and derives capacity usage from active registrations.

Risk Level

• High

This changes a core write path and adds database functions. The migrations are applied to the approved clean-dev project and the real integration suite passes. The PR remains Draft only for the final organizer browser smoke test.

Product / Workflow Area

• Organizer workspace
• Public and participant event reads
• Supabase schema / RLS / Storage
• Documentation / repository operations

Verification

• npm run verify — 125/125 tests
• npm run build — production build clean, 39 routes generated
• git diff --check
• Applied migrations to clean-dev Supabase oxbrxkllftyevlzmiydt
• Full RPC/concurrency/Storage RLS suite — 25/25
• Manual organizer event-creation browser smoke test

Live Validation Coverage

• Anonymous callers cannot create events.
• Event, owner collaborator, finance settings, optional collection-code version, and audit log are created atomically.
• Duplicate public codes and invalid inputs roll back without partial records.
• Concurrent payment review, check-in, and seat locking allow exactly one winner.
• Registration capacity, duplicate registration, refunds, and distributed rate limiting pass against clean-dev.
• Payment and refund proof Storage policies enforce ownership, role separation, malformed-path rejection, replacement blocking, and immutability.
• Anonymous registration-count reads return only event IDs and active quantities.

Data, Permission, And Security Notes

• Event creation requires an authenticated caller and resolves ownership from auth.uid().
• The user-initiated workflow does not use the service-role client.
• Event creation writes its audit record inside the same transaction.
• The registration-count RPC is security-definer but returns only public/unlisted event IDs and aggregate quantities.