fix(hackathons): issue 4275 follow-ups for submission and team UX

[navillanueva]

Follow-up fixes from #4275 (everything except the staged-hackathon items, which went into #4243). The country lock is intentionally kept as requested.

Changelog

• Tech stack tags allow non-listed options — MultiSelect gains an allowCreate prop (taken verbatim from the feat/events-stages branch so the two PRs merge cleanly): typing a value that isn't in the list shows a Create "…" row, and Enter adds it as a free-form tag. Enabled on the tech_stack_tags field in the submission form, mirroring how the skills picker allows custom entries. The Zod schemas already accept free strings, so no server change.
• Translations via i18n — the hardcoded es/en ternaries in GeneralSecure (closed-submissions banner) and TeamFormation (all copy) now go through the existing t() dictionary in lib/events/i18n.ts, with new submission.status.closed* and reg.team.* keys in both languages.
• Teammate emails reuse EmailListInput — TeamFormation drops its per-slot email inputs for the shared tag-style EmailListInput component (added in feat(events): enhanced event creation  #4241 but never wired up). Emails are validated/deduped on entry, team size auto-bumps as emails are added, and the count stays capped at team_size_max − 1.
• Invitation email banner validation — SendInvitationProjectMember no longer embeds whatever is in hackathon.banner: only absolute http(s) URLs are used. Base64 data-URIs (which most clients block and which push the HTML past Gmail's ~102KB clipping limit, causing "[Message clipped]" + an empty black box), relative paths, or missing banners fall back to the generic hosted hackathon banner already used by the event page. The banner URL is parsed with new URL() and attribute-escaped, and the title/inviter/project-name interpolations into the email HTML are now escaped too (security review).

Test plan

1. Custom tech tags — open a hackathon submission → step 2 → Tech Stack Tags: type a value not in the list → Create "…" row appears, Enter adds the tag; saving persists it.
2. i18n — view a Spanish-language event: closed-submissions banner and the whole Team section render in Spanish (no English leakage), English events unchanged.
3. Team emails — registration form with team size > 1: emails are entered as tags in a single input (Enter/Space/Tab adds, ✕ removes); invalid emails are rejected; adding a 3rd email auto-selects team size 4 (capped at max); submit still validates count/duplicates/self-invite as before.
4. Invitation email — invite a teammate on a hackathon whose banner is a base64 data-URI → the email arrives un-clipped with the generic hosted banner; a hackathon with a hosted banner URL still shows its own banner.

Refs #4275

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
builder-hub	Ready	Preview, Comment	Jun 12, 2026 7:02pm