fix(security): require authentication on public events endpoint

[0xcucumbersalad]

Summary

• Add auth check to POST /api/:org/events/:type — the events handler had no authentication check. Since resolveOrgFromPath intentionally allows unauthenticated callers through (needed for MCP OAuth discovery), anyone with a valid org slug could publish arbitrary events — including scheduled (deliverAt) and recurring (cron) events — to any org's event bus without credentials. Adds the same auth pattern used by the adjacent watchHandler.

Test plan

• bun run check — passes
• bun run fmt — passes
• bun run lint — passes (0 errors)
• Verify unauthenticated POST /api/:org/events/:type returns 401
• Verify authenticated calls still publish successfully
• Verify the legacy route at POST /org/:organizationId/events/:type also requires auth (shares the same handler)

🤖 Generated with Claude Code

---

Summary by cubic

Require authentication for event publishing endpoints to prevent unauthorized event injection. Unauthenticated requests to POST /api/:org/events/:type (and legacy POST /org/:organizationId/events/:type) now return 401; authenticated behavior is unchanged.

• Bug Fixes
  • Added user/API key auth check in the events handler, matching the watchHandler pattern.
  • Prevents publishing arbitrary, scheduled (deliverAt), and recurring (cron) events using only an org slug.

^{Written for commit 4ef64ca. Summary will update on new commits.}

[pedrofrxncx]

i remember this decision was intentional at the time, i think we might delete this route, ill come back to this PR tho