feat(tier2): editable RSVPs — Block A

Guests can revisit their invitation link and change their response
or plus-ones up to 5 times. Each prior state is snapshotted into
`rsvp_revisions` and surfaced to the host via a per-guest history
modal on the event detail page.

- Migration 0007 adds rsvp_revisions + rsvps.edit_count (with down)
- RSVPRepo.Update wraps snapshot+update+counter in one transaction,
  FOR UPDATE-locking the row so concurrent edits can't bypass the cap
- PATCH /rsvp/{token} re-runs the fraud check on every edit attempt
  (different device on an edit is itself a signal)
- POST /rsvp no longer marks the token used — the link stays valid
  so the guest can come back to edit
- GET /access/{token} now embeds the existing RSVP so the frontend
  renders an edit form instead of a blank submit form on revisit
- New host endpoint GET /events/{id}/guests/{guest_id}/rsvp/history
- Frontend: rsvp/[token].vue toggles between summary + edit form,
  surfaces edits-remaining; dashboard adds a "History" action on
  responded guests opening a revision-trail modal

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/server.go

@@ -161,6 +161,7 @@ func NewServer(deps ServerDeps) (*Server, error) {
 			events:        eventRepo,
 			users:         userRepo,
 			accessLogs:    accessRepo,
+			rsvps:         rsvpRepo,
 			gen:           auth.NewGenerator(),
 			ttl:           deps.TokenTTL,
 			pub:           deps.AccessPublisher,
@@ -306,6 +307,16 @@ func (s *Server) Handler() http.Handler {
 		rl("access", 60, time.Hour, pathKey("token"), http.HandlerFunc(s.tokens.access)))
 	mux.Handle("POST /rsvp/{token}",
 		rl("rsvp", 10, time.Hour, pathKey("token"), http.HandlerFunc(s.rsvps.submit)))
+	// Block A: edits are bounded by MaxRSVPEdits server-side. The redis
+	// limiter is a coarser guard that also throttles attempts that hit the
+	// edit-cap 429 path, so a hostile actor can't burn through fraud-engine
+	// calls on the same token.
+	mux.Handle("PATCH /rsvp/{token}",
+		rl("rsvp_edit", 10, time.Hour, pathKey("token"), http.HandlerFunc(s.rsvps.edit)))
+
+	// Host view of the edit trail for a single guest.
+	mux.Handle("GET /events/{id}/guests/{guest_id}/rsvp/history",
+		authed(http.HandlerFunc(s.rsvps.history)))
 
 	// WebSocket endpoint authenticates via single-use ticket on the query
 	// string (see POST /auth/ws-ticket).