feat: add security hardening for reservation APIs

- Add rate limiting (5/hr public, 100/min admin endpoints)
- Add honeypot bot protection on public POST
- Add audit logging for status changes and deletions
- Add input validation (email, phone, date, length limits)
- Fix missing auth on private event GET endpoints
- Add audit_log table to schema
- Fix failing tests (auth.test, rooms-route.test)

tests/auth.test.ts

@@ -31,13 +31,17 @@ describe('auth helpers', () => {
   it('authenticates a user with the stored password hash', async () => {
     const passwordHash = await hashPassword('secret-password');
     query.mockResolvedValueOnce({
-      rows: [{ id: 2, username: 'bob', password_hash: passwordHash, role: 'admin' }],
+      rows: [{ id: 2, username: 'bob', password_hash: passwordHash, role: 'admin', first_name: null, last_name: null, preferred_language: 'es', terms_accepted_at: null }],
     });
 
     await expect(authenticateUser('bob', 'secret-password')).resolves.toEqual({
       id: 2,
       username: 'bob',
       role: 'admin',
+      first_name: null,
+      last_name: null,
+      preferred_language: 'es',
+      terms_accepted_at: null,
     });
   });