Fix tenant event form package selector so it no longer renders empty-value options, handles loading/empty

states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
    (resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
  - Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
    routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
    resources/js/admin/router.tsx, routes/web.php)

app/Models/Photo.php

@@ -20,6 +20,12 @@ class Photo extends Model
     protected $casts = [
         'is_featured' => 'boolean',
         'metadata' => 'array',
+        'security_meta' => 'array',
+        'security_scanned_at' => 'datetime',
+    ];
+
+    protected $attributes = [
+        'security_scan_status' => 'pending',
     ];
 
     public function mediaAsset(): BelongsTo