feat: member portal Sprint 4 — Events + RSVP

- Event + EventRsvp models + migration (RsvpStatus enum: GOING/MAYBE/NOT_GOING)
- EventsModule: admin CRUD (create/update/delete/publish) + RSVP list
- GET /my/events + POST /my/events/:id/rsvp in MyController/MyService
- Admin BFF routes: GET/POST /api/admin/events, PATCH/DELETE /api/admin/events/[id]
- Member BFF routes: GET /api/my/events, POST /api/my/events/[id]/rsvp
- /my/events page: upcoming/past split, RSVP button (client component, optimistic)
- Register DigestModule, OrgModule, ThreadsModule, EventsModule in AppModule
- Add EVENT_CREATED/DELETED/UPDATED and DIGEST_SENT to AuditAction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/api/admin/events/[id]/route.ts

@@ -0,0 +1,28 @@
+import { apiFetch, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const body = await request.json();
+  const res = await apiFetch(`/admin/events/${id}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}
+
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const res = await apiFetch(`/admin/events/${id}`, { method: 'DELETE' });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}

apps/web/app/api/admin/events/route.ts

@@ -0,0 +1,20 @@
+import { apiFetch, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const res = await apiFetch('/admin/events');
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const body = await request.json();
+  const res = await apiFetch('/admin/events', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}

apps/web/app/api/my/events/[id]/rsvp/route.ts

@@ -0,0 +1,18 @@
+import { jsonResponse, memberApiFetch } from '../../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const body = await request.json();
+  const res = await memberApiFetch(`/my/events/${id}/rsvp`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}

apps/web/app/api/my/events/route.ts

@@ -0,0 +1,9 @@
+import { jsonResponse, memberApiFetch } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const res = await memberApiFetch('/my/events');
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}