feat: add admin-controlled event service

Summary

Adds an admin-controlled event service that lets admins define named events with filters (language, media type, categories), a page context, and an active date range. Extends the service so admins can wire up which event a page sees via a PageEventLink table — clients send an X-Page-Route header and get back the linked event's filters, with no query-param changes needed on the client side.

Changes

Original

• Event model with JSONB filters, page_context, start_date/end_date, and is_active flag
• 6 CRUD endpoints under /api/v1/events/ — all admin-only except GET /active
• GET /records/next-for-review gains optional event_id param — applies the event's predefined filters when no explicit filter is passed by the client
• Alembic migration b4e2a1f9c3d5 creates the event table

New in this update

• PageEventLink model (pageeventlink table) — maps a page route string to an event; one link per route, admin-controlled
• GET /events/active updated — drops ?page= query param, now reads the X-Page-Route request header and looks up the linked event; returns null if no link exists or the event is inactive / outside its schedule window
• POST /events/page-links — create or update a page-route → event link (upsert if route already exists); admin only
• GET /events/page-links — list all links; admin only
• DELETE /events/page-links/{link_id} — remove a link; admin only
• Migration a3b4c5d6e7f8 creates the pageeventlink table
• Merge migrations and stubs added to resolve multi-branch alembic heads

Test plan

• POST /events — create an event as admin
• GET /events — list all events as admin
• GET /events/{id} — get single event
• PUT /events/{id} — update as admin
• DELETE /events/{id} — deactivate as admin
• POST /events/page-links — link a page route to an event (upsert)
• GET /events/page-links — list all links as admin
• DELETE /events/page-links/{link_id} — remove a link
• GET /events/active with X-Page-Route header — returns linked event
• GET /events/active with inactive/missing link — returns null
• Non-admin blocked from page-link endpoints — 403

Closes #128 (closed)