feat(events): guest accounts for public event registration

Non-members who register for an event now get a persistent identity:
with consent, a status:"guest" Member is upserted and an auth cookie is
set so the "You're Registered" state survives a page refresh.

Tiered auto-login matches passwordless-auth norms — auto-login is only
safe when the account holds no privileges:
- New email → create guest + cookie
- Returning guest → cookie
- Existing non-guest (active/pending/etc.) → attach ticket only, no
  cookie, confirmation email includes a sign-in link

Guests are gated on status === "guest", so admin/middleware code that
keys on status === "active" naturally excludes them. Guests are also
treated as non-members for ticket pricing/validation to prevent picking
up member-only pricing on their second registration.

server/utils/resend.js

@@ -4,8 +4,11 @@ const resend = new Resend(process.env.RESEND_API_KEY);
 
 /**
  * Send event registration confirmation email
+ * @param {Object} options - { requiresSignIn?: boolean } — when true, appends a
+ *   "sign in to view your ticket" paragraph for existing non-guest members who
+ *   registered via the public form and did not receive an auto-login cookie.
  */
-export async function sendEventRegistrationEmail(registration, eventData) {
+export async function sendEventRegistrationEmail(registration, eventData, options = {}) {
   const formatDate = (dateString) => {
     const date = new Date(dateString);
     return new Intl.DateTimeFormat("en-US", {
@@ -31,6 +34,9 @@ export async function sendEventRegistrationEmail(registration, eventData) {
 
   const baseUrl = process.env.BASE_URL || "https://ghostguild.org";
   const eventUrl = `${baseUrl}/events/${eventData.slug || eventData._id}`;
+  const signInSection = options.requiresSignIn
+    ? `\nSign in to view your ticket: ${baseUrl}/login\n`
+    : "";
 
   let ticketSection = "";
   if (
@@ -63,7 +69,7 @@ You're registered for ${eventData.title}.
 Date: ${formatDate(eventData.startDate)}
 Time: ${formatTime(eventData.startDate, eventData.endDate)}
 Location: ${eventData.location}
-${eventData.description ? `\n${eventData.description}\n` : ""}${ticketSection}
+${eventData.description ? `\n${eventData.description}\n` : ""}${ticketSection}${signInSection}
 View event: ${eventUrl}
 
 To cancel, visit the event page and click "Cancel Registration."`,