Add slug-based URLs for event registrations

[maebeale]

What is the goal of this PR and why is this important?

• Replace ID-based user-facing URLs (/event_registrations/123) with secure, unguessable slug tokens (/registration/abc123...) for event registrations
• Slugs prevent enumeration attacks — users can only access registrations if they have the slug (from email or direct link)
• Enables guest access to registration tickets without requiring login, improving UX for confirmation emails

How did you approach the change?

• Added slug column with unique index to event_registrations, generated via SecureRandom.urlsafe_base64(16) (128-bit entropy) on create
• Added /registration/:slug routes for show, resend confirmation, cancel, and reactivate actions
• Slug itself serves as authorization — no login required to view ticket, resend email, cancel, or reactivate
• Secured public registration form show with ?reg=slug param instead of guessable person_id
• Event show page detects ?reg=slug param to display "View your registration" link and calendar links for guests
• Replaced De-register button on event show with cancel/reactivate flow on the registration ticket page
• Extracted shared _ticket.html.erb partial for both admin and public registration views
• Updated all mailer templates and profile page links to use slug-based URLs
• Locked down existing /event_registrations/:id show to admin-only
• Includes backfill rake task: bundle exec rake event_registrations:backfill_slugs

UI Testing Checklist

• Visit /registration/:slug as guest — should show ticket
• Click "Back to Event" from ticket — event page should show "View your registration" link
• Click "Cancel registration" — should show "Registration cancelled" badge and "Register again" button
• Click "Register again" — should reactivate and show active registration
• Click "Resend confirmation email" — should send email with slug-based links
• Confirmation email links go to slug-based URLs (not ID-based)
• Profile page registration links use slug-based URLs
• /event_registrations/:id redirects non-admins (admin-only)
• Public registration form show requires valid ?reg=slug param

Anything else to add?

• Migration must be run before deploy: ai/db-migrate
• Backfill existing registrations after deploy: bundle exec rake event_registrations:backfill_slugs

🤖 Generated with Claude Code