fix(events): read allowIndividualEventTickets from series.tickets

The series-pass gate in register.post.js was checking
`series.allowIndividualEventTickets` at the top level, but the field
lives under `series.tickets.allowIndividualEventTickets` per the
Series schema. Top-level access was always undefined, so `!undefined`
always fired the pass check — blocking drop-in registration even when
an admin enabled `(requiresSeriesTicket=true, allowIndividualEventTickets=true)`.

The bug failed closed (overprotective), so no bypass was possible.
The existing test mirrored the bug by mocking the field at the top
level; updated the three mocks to nest it under `tickets` so the test
shape matches the real schema.

server/api/events/[id]/register.post.js

@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
           statusMessage: "Series referenced by this event could not be found",
         });
       }
-      if (!series.allowIndividualEventTickets) {
+      if (!series.tickets?.allowIndividualEventTickets) {
         const { hasPass } = checkUserSeriesPass(series, body.email);
         if (!hasPass) {
           throw createError({