Add unlisted event status: hidden from listings but accessible by URL

- Backend: add 'unlisted' to schema enum and Zod validation; allow booking for unlisted events
- Frontend: Event type and guards updated; unlisted events bookable, excluded from public listing/sitemap
- Admin: badge, status dropdown, Make Unlisted / Make Public / Unpublish actions; scanner/emails/tickets include unlisted

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/(public)/book/[eventId]/page.tsx

@@ -145,7 +145,7 @@ export default function BookingPage() {
         paymentOptionsApi.getForEvent(params.eventId as string),
       ])
         .then(([eventRes, paymentRes]) => {
-          if (!eventRes.event || eventRes.event.status !== 'published') {
+          if (!eventRes.event || !['published', 'unlisted'].includes(eventRes.event.status)) {
             toast.error('Event is not available for booking');
             router.push('/events');
             return;