fix: use private helcimApiToken for all server-side Helcim API calls

app/pages/admin/events/index.vue

@@ -162,6 +162,25 @@
         No events found matching your criteria
       </div>
     </div>
+    <!-- Confirm Delete Modal -->
+    <div v-if="confirmDelete.show" class="modal-overlay" @click.self="confirmDelete.show = false">
+      <div class="modal">
+        <div class="modal-header">
+          <h2>Delete Event</h2>
+          <button class="modal-close" @click="confirmDelete.show = false">&times;</button>
+        </div>
+        <div class="modal-body">
+          <p>Are you sure you want to delete <strong>"{{ confirmDelete.title }}"</strong>?</p>
+          <p class="help-text" style="margin-top: 8px;">This action cannot be undone.</p>
+        </div>
+        <div class="modal-actions">
+          <button class="btn" @click="confirmDelete.show = false">Cancel</button>
+          <button class="btn btn-danger" :disabled="confirmDelete.deleting" @click="executeDelete">
+            {{ confirmDelete.deleting ? 'Deleting...' : 'Delete' }}
+          </button>
+        </div>
+      </div>
+    </div>
   </div>
 </template>
 
@@ -255,16 +274,25 @@ const duplicateEvent = (event) => {
   navigateTo('/admin/events/create?duplicate=true')
 }
 
-const deleteEvent = async (event) => {
-  if (confirm(`Are you sure you want to delete "${event.title}"?`)) {
-    try {
-      await $fetch(`/api/admin/events/${String(event._id)}`, {
-        method: 'DELETE',
-      })
-      await refresh()
-    } catch (error) {
-      console.error('Failed to delete event:', error)
-    }
+const confirmDelete = reactive({ show: false, id: null, title: '', deleting: false })
+
+const deleteEvent = (event) => {
+  confirmDelete.id = String(event._id)
+  confirmDelete.title = event.title
+  confirmDelete.deleting = false
+  confirmDelete.show = true
+}
+
+const executeDelete = async () => {
+  confirmDelete.deleting = true
+  try {
+    await $fetch(`/api/admin/events/${confirmDelete.id}`, { method: 'DELETE' })
+    confirmDelete.show = false
+    await refresh()
+  } catch (error) {
+    console.error('Failed to delete event:', error)
+  } finally {
+    confirmDelete.deleting = false
   }
 }
 
@@ -588,6 +616,77 @@ tbody td {
   to { transform: rotate(360deg); }
 }
 
+/* ---- MODALS ---- */
+.modal-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.4);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 50;
+}
+
+.modal {
+  background: var(--bg);
+  border: 1px dashed var(--border);
+  max-width: 440px;
+  width: 100%;
+  margin: 16px;
+}
+
+.modal-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 20px 24px 16px;
+  border-bottom: 1px dashed var(--border);
+}
+
+.modal-header h2 {
+  font-family: 'Brygada 1918', serif;
+  font-size: 18px;
+  font-weight: 500;
+  color: var(--text-bright);
+}
+
+.modal-close {
+  background: none;
+  border: none;
+  color: var(--text-faint);
+  font-size: 20px;
+  cursor: pointer;
+  padding: 0 4px;
+  line-height: 1;
+}
+
+.modal-close:hover {
+  color: var(--text);
+}
+
+.modal-body {
+  padding: 20px 24px;
+}
+
+.modal-body p {
+  font-size: 13px;
+  color: var(--text);
+  line-height: 1.5;
+}
+
+.modal-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  padding: 16px 24px;
+  border-top: 1px dashed var(--border);
+}
+
+.help-text {
+  font-size: 11px;
+  color: var(--text-dim);
+}
+
 /* ---- RESPONSIVE ---- */
 @media (max-width: 768px) {
   .page-header {