Add attendee cap with required login for capped events

Hosts can optionally cap total attendance (RSVPs + plus-ones) when
creating an event. Capped events require guests to log in via the
existing email code flow; RSVPs are tied to accounts and deduped per
user. The event page shows spots left and replaces the form with a
full notice when the cap is reached; the server rejects over-cap
RSVPs and edits with 409 as a race backstop.

Also threads a safeNext-validated ?next= param through the login and
name-setup flow so guests land back on the event after signing in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

schema.sql

@@ -7,6 +7,7 @@ CREATE TABLE IF NOT EXISTS events (
     location   TEXT    NOT NULL,
     admin_token TEXT   NOT NULL UNIQUE,
     description TEXT    NOT NULL DEFAULT '',
+    attendee_cap INTEGER NOT NULL DEFAULT 0, -- 0 = uncapped; capped events require login to RSVP
     user_id    INTEGER REFERENCES users(id),
     created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
@@ -34,6 +35,7 @@ CREATE TABLE IF NOT EXISTS rsvps (
     name       TEXT    NOT NULL,
     note       TEXT    NOT NULL DEFAULT '',
     plus_one   INTEGER NOT NULL DEFAULT 0,
+    user_id    INTEGER REFERENCES users(id),
     created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );