Add unlisted event status: hidden from listings but accessible by URL

- Backend: add 'unlisted' to schema enum and Zod validation; allow booking for unlisted events
- Frontend: Event type and guards updated; unlisted events bookable, excluded from public listing/sitemap
- Admin: badge, status dropdown, Make Unlisted / Make Public / Unpublish actions; scanner/emails/tickets include unlisted

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/admin/tickets/page.tsx

@@ -168,7 +168,7 @@ export default function AdminTicketsPage() {
                   onChange={(e) => setCreateForm({ ...createForm, eventId: e.target.value })}
                   className="w-full px-4 py-3 rounded-btn border border-secondary-light-gray min-h-[44px]" required>
                   <option value="">Select an event</option>
-                  {events.filter(e => e.status === 'published').map((event) => (
+                  {events.filter(e => e.status === 'published' || e.status === 'unlisted').map((event) => (
                     <option key={event.id} value={event.id}>{event.title} ({event.availableSeats} spots left)</option>
                   ))}
                 </select>