Add attendee cap with required login for capped events

Hosts can optionally cap total attendance (RSVPs + plus-ones) when
creating an event. Capped events require guests to log in via the
existing email code flow; RSVPs are tied to accounts and deduped per
user. The event page shows spots left and replaces the form with a
full notice when the cap is reached; the server rejects over-cap
RSVPs and edits with 409 as a race backstop.

Also threads a safeNext-validated ?next= param through the login and
name-setup flow so guests land back on the event after signing in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

migrate.go

@@ -33,6 +33,9 @@ func runMigrations(database *sql.DB) {
 			user_agent TEXT    NOT NULL DEFAULT '',
 			created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 		)`,
+		// Attendee cap (0 = uncapped); capped events require login to RSVP.
+		`ALTER TABLE events ADD COLUMN attendee_cap INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE rsvps ADD COLUMN user_id INTEGER REFERENCES users(id)`,
 	}
 	for _, m := range migrations {
 		_, err := database.Exec(m)