Add yes/no RSVP answers with required login

RSVPs now carry a status ('yes'/'no'). When auth is enabled, answering
requires login for all events, not just capped ones. Answers are deduped
one per user and re-answering updates in place. A 'no' zeroes plus_one,
is excluded from Going counts and cap math, frees the person's slot
claims, and shows in a separate "Can't make it" list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

migrate.go

@@ -36,6 +36,8 @@ func runMigrations(database *sql.DB) {
 		// Attendee cap (0 = uncapped); capped events require login to RSVP.
 		`ALTER TABLE events ADD COLUMN attendee_cap INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE rsvps ADD COLUMN user_id INTEGER REFERENCES users(id)`,
+		// RSVPs can now be a yes or a no.
+		`ALTER TABLE rsvps ADD COLUMN status TEXT NOT NULL DEFAULT 'yes'`,
 	}
 	for _, m := range migrations {
 		_, err := database.Exec(m)