Add yes/no RSVP answers with required login

RSVPs now carry a status ('yes'/'no'). When auth is enabled, answering
requires login for all events, not just capped ones. Answers are deduped
one per user and re-answering updates in place. A 'no' zeroes plus_one,
is excluded from Going counts and cap math, frees the person's slot
claims, and shows in a separate "Can't make it" list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

db/models.go

@@ -37,6 +37,7 @@ type Rsvp struct {
 	Name      string
 	Note      string
 	PlusOne   int64
+	Status    string
 	UserID    sql.NullInt64
 	CreatedAt time.Time
 }