feat(events): block self-cancel of paid registrations, add refunds policy

Self-cancel endpoint now rejects paid registrations (public, series_pass,
or paid member tickets) with a 403 pointing to /policies/refunds. Free
and $0-member registrations still self-cancel as before. Adds the
refunds policy page referenced in the error message.

server/api/events/[id]/cancel-registration.post.js

@@ -42,6 +42,23 @@ export default defineEventHandler(async (event) => {
       });
     }
 
+    const existingRegistration = eventDoc.registrations[registrationIndex];
+    const ticketType = existingRegistration.ticketType;
+    const amountPaid = existingRegistration.amountPaid || 0;
+    // member tickets can be free (default) or paid via circle overrides — gate on amountPaid
+    const isPaidRegistration =
+      ticketType === "public" ||
+      ticketType === "series_pass" ||
+      (ticketType === "member" && amountPaid > 0);
+
+    if (isPaidRegistration) {
+      throw createError({
+        statusCode: 403,
+        statusMessage:
+          "Paid registrations can't be self-cancelled. Email us for a refund — see /policies/refunds.",
+      });
+    }
+
     // Store registration data before removing (convert to plain object)
     const registration = {
       name: eventDoc.registrations[registrationIndex].name,