- Reworked the tenant admin login page

- Updated the User model to implement Filament’s tenancy contracts
- Seeded a ready-to-use demo tenant (user, tenant, active package, purchase)
- Introduced a branded, translated 403 error page to replace the generic forbidden message for unauthorised admin hits
- Removed the public “Register” links from the marketing header
- hardened join event logic and improved error handling in the guest pwa.

docs/prp/07-guest-pwa.md

@@ -87,9 +87,9 @@ Technical Notes
 - Realtime model: periodic polling (no WebSockets). Home counters every 10s; gallery delta every 30s with exponential backoff when tab hidden or offline.
 
 API Touchpoints
-- GET `/api/v1/events/{slug}` — public event metadata (when open) + theme.
-- GET `/api/v1/events/{slug}/photos` — paginated gallery (approved only).
-- POST `/api/v1/events/{slug}/photos` — signed upload initiation; returns URL + fields.
+- GET `/api/v1/events/{token}` — public event metadata (when open) + theme.
+- GET `/api/v1/events/{token}/photos` — paginated gallery (approved only).
+- POST `/api/v1/events/{token}/photos` — signed upload initiation; returns URL + fields.
 - POST (S3) — direct upload to object storage; then backend finalize call.
 - POST `/api/v1/photos/{id}/like` — idempotent like with device token.