feat: add protected public transport for event vendor applications

[chubes4]

Need

Extra-Chill/extrachill-events#527 owns an event-scoped vendor application domain and hidden extrachill-events/apply-to-vendor-request ability. Public callers need an API-owned facade to invoke that ability without exposing it through generic Abilities REST.

Owning boundary

Extra Chill API already owns the equivalent booking-inquiry transport primitives:

• route affinity to the Events site;
• Cloudflare Turnstile verification;
• public-write rate limiting;
• canonical cookie/bearer identity context without caller-supplied identity;
• stable public error projection and retry headers;
• hidden-ability invocation.

Events must not add a parallel REST route or duplicate these controls.

Contract

• Add POST /extrachill/v1/events/<event>/vendor-applications routed to the Events site.
• Verify Turnstile and apply a bounded vendor-application rate limit before execution.
• Reject caller-supplied user/coordinator/applicant identity fields.
• Invoke only the hidden extrachill-events/apply-to-vendor-request ability and fail closed if it is absent or REST-visible.
• Forward the event ID, idempotency key, configured application fields, explicit contact-sharing consent, and optional authenticated context only through WordPress's current user.
• Return only the Events-owned public receipt (public_id, submitted_at, and safe status), never request IDs, coordinator identity/contact, applicant directories, private notes, activity, or correspondence.
• Map closed/stale/idempotency/validation failures to fixed non-enumerating public errors.
• Preserve exact retries and route-affinity signatures.

Tests

Cover anonymous and authenticated calls, Turnstile, rate limits, spoofed identity, affinity, exact retries, close race/error projection, hidden ability enforcement, and absence of coordinator/applicant/private-field leakage.

Refs Extra-Chill/extrachill-events#527

[chubes4]

The Events-owned contract also exposes hidden extrachill-events/withdraw-vendor-application for consent revocation. The API facade should add a non-enumerating withdrawal action accepting only public_id, opaque access_token, expected_version, and idempotency_key; it must return no private applicant or coordinator fields. Exact application retries return the same opaque token so a caller can recover after a lost response.