Allow token-only admin access for events with no owner

Skip the user ownership check when event.user_id is NULL so
existing events created before auth still work with their
admin links.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

handlers.go

@@ -468,9 +468,9 @@ func (s *Server) authorizeAdmin(w http.ResponseWriter, r *http.Request, isPage b
 		return nil
 	}
 
-	if s.features.Auth {
+	if s.features.Auth && event.UserID.Valid {
 		user := s.currentUser(r)
-		if user == nil || !event.UserID.Valid || user.ID != event.UserID.Int64 {
+		if user == nil || user.ID != event.UserID.Int64 {
 			if isPage {
 				http.Redirect(w, r, "/e/"+slug, http.StatusSeeOther)
 			} else {