Add attendee cap with required login for capped events

Hosts can optionally cap total attendance (RSVPs + plus-ones) when
creating an event. Capped events require guests to log in via the
existing email code flow; RSVPs are tied to accounts and deduped per
user. The event page shows spots left and replaces the form with a
full notice when the cap is reached; the server rejects over-cap
RSVPs and edits with 409 as a race backstop.

Also threads a safeNext-validated ?next= param through the login and
name-setup flow so guests land back on the event after signing in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

db/models.go

@@ -26,6 +26,7 @@ type Event struct {
 	Location    string
 	AdminToken  string
 	Description string
+	AttendeeCap int64
 	UserID      sql.NullInt64
 	CreatedAt   time.Time
 }
@@ -36,6 +37,7 @@ type Rsvp struct {
 	Name      string
 	Note      string
 	PlusOne   int64
+	UserID    sql.NullInt64
 	CreatedAt time.Time
 }