feat: events subsystem (admin + member submit + public)

[cdcore09]

Summary

Plan 2 of 5 from the events / announcements / forms brainstorm. Lands the events admin + member submit + public surfaces on top of the Plan 1 foundation (#1994).

Admin API

• POST/GET /admin/events — create draft + list with filters (status/type/scope/host/q + pagination)
• GET/PATCH /admin/events/:id — detail (with reviews/comments/audit) + patch gated by canEditArtifact
• POST /admin/events/:id/transitions — wraps applyTransition with per-action policy gates (submit_for_review/approve/reject/request_changes/cancel/archive)
• POST /admin/events/:id/comments — comment endpoint using sanitizeCommentBody

Public API

• GET /events — scope-aware list (anonymous: public only; signed-in: public + community)
• GET /events/:slug — published-event detail with host_group/host_org/author attribution
• POST /events/submit — auth-gated member submission, auto-transitions to in_review

Admin UI

• /admin/events list with status filter + search
• /admin/events/new compose form
• /admin/events/:id detail page with Identity / Content / Review / Audit tabs (Broadcast tab deferred to Plan 5; attached-form section deferred to Plan 4)
• Sidebar nav: the data-driven useNavSections already exposed an Events entry — wired it to the real page

Public UI

• UpcomingEventsPage now renders dynamic API-driven events between the featured (USRSE'26) and recurring-events sections, with magazine-style date block + matching purple/teal accents. Plus "Submit an event" CTA.
• New /events/submit form (auth-gated via useAuth; shows sign-in CTA for anonymous visitors)
• New /events/:slug detail page matching the site's design language (magazine date treatment, teal host attribution, purple register CTA)

Middleware

• optionalActor middleware got the same TEST_BYPASS_AUTH escape hatch that auth.ts and actorContext.ts got in Plan 1 — env-gated, inert in production, not in wrangler.jsonc.

Stats

• 13 commits, all atomic, conventional, zero AI attribution
• 216/216 vitest tests pass (193 from Plan 1 + 23 new)
• Full repo typecheck clean

Test plan

• CI green (Cloudflare Pages preview deploys; CircleCI legacy may error — expected on site-redesign-base PRs)
• Manual: super_admin creates an event in /admin/events/new, submits for review, second super_admin approves twice — event publishes
• Manual: member submits via /events/submit, event appears in /admin/queue as in_review
• Manual: anonymous viewer hits /events, sees only public published events; sign in, sees community events too
• Manual: published event with externalUrl set renders "Register at … →" CTA on /events/:slug

Plan + spec

• Spec: docs/superpowers/specs/2026-05-20-events-announcements-forms-design.md
• Plan: docs/superpowers/plans/2026-05-24-events-implementation.md
• Builds on: PR feat(api): artifact subsystem foundation (schema + lifecycle + queue) #1994 (Plan 1 foundation)

Deferred to subsequent plans (per scope decision)

• Thumbnail upload — needs ARTIFACT_THUMBNAILS R2 binding provisioning (own follow-up)
• Broadcast tab on event detail — Plan 5
• Attached-form section on event detail — Plan 4

[cloudflare-workers-and-pages]

Deploying usrse-github-io with    Cloudflare Pages

Latest commit:	c7158ff
Status:	✅  Deploy successful!
Preview URL:	https://880cd901.usrse-github-io.pages.dev
Branch Preview URL:	https://cdcore09-events-implementati.usrse-github-io.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying us-rse-admin with    Cloudflare Pages

Latest commit:	c7158ff
Status:	✅  Deploy successful!
Preview URL:	https://9eeeeb8e.us-rse-admin.pages.dev
Branch Preview URL:	https://cdcore09-events-implementati.us-rse-admin.pages.dev

View logs