feat: auto-update sitemap when events are added/updated/removed

- Use tag-based cache for sitemap event list (events-sitemap)
- Add POST /api/revalidate endpoint (secret-protected) to trigger revalidation
- Backend calls revalidation after event create/update/delete
- Add REVALIDATE_SECRET to .env.example (frontend + backend)

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/.env.example

@@ -21,6 +21,10 @@ PORT=3001
 API_URL=http://localhost:3001
 FRONTEND_URL=http://localhost:3002
 
+# Revalidation secret (shared with frontend for on-demand cache revalidation)
+# Must match the REVALIDATE_SECRET in frontend/.env
+REVALIDATE_SECRET=change-me-to-a-random-secret
+
 # Payment Providers (optional)
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=