Fix reported security advisories

[daveearley]

• Webhook SSRF: the URL guard only ran at create time, so redirect-following and DNS rebinding both reached internal and cloud-metadata hosts, with the response body readable via the webhook logs API. Dispatch now revalidates, pins the validated IP via CURLOPT_RESOLVE, validates every redirect hop, and decodes IPv6 transition addresses (NAT64, 6to4, Teredo, IPv4-compatible) which previously bypassed the filter entirely — thanks @tonghuaroot, @de3erve, @JaimeRamirez-coder, @senti-man, @angelystor, @1amplant, @tikket1, @Fewword, @dizconnectz
• Spreadsheet formula injection: unauthenticated attendee names and question answers were written into organizer-facing exports as live formulas. All exports now bind string cells explicitly and the CSV report escapes formula triggers — thanks @senti-man
• Order completion race: concurrent completions of the same order each created attendees and inflated quantity_sold and used_capacity, exhausting capacity and blocking real buyers. Completion now takes an advisory lock before reading the order — thanks @tonghuaroot
• Product sale window is now enforced at checkout, at both product and price-tier level, so tickets can no longer be bought before they go on sale, after sales close, or at an expired lower-price tier — thanks @angelystor
• max_per_order is now aggregated per product across repeated order entries instead of per entry, so the limit can no longer be multiplied by repeating the same product_id — thanks @angelystor
• Product ownership is now validated on questions, capacity assignments and check-in lists, so products from another organizer's event can no longer be attached, and cross-event updates and deletes return 404 instead of silently detaching the victim's products — thanks @Fewword
• Public promo code lookup now has a dedicated throttle:10,1, matching its sibling public routes, to stop code enumeration
• Cross-event question tampering: editing or deleting a question via another event scoped the row update but not the pivot, letting an attacker rewrite a victim question's product associations and delete its answers. Both paths now verify ownership first
• Order, attendee, product and check-in webhook dispatch jobs now implement ShouldQueue. They were running inline in the request despite the listener assigning them a queue

[railway-app]

🚅 Deployed to the Hi.Events-pr-1311 environment in Hi.Events

Service	Status	Web	Updated (UTC)
Hi.Events Scheduler	✅ Success (View Logs)		Aug 11, 2026 at 8:19 pm
Hi.Events Queue Worker	✅ Success (View Logs)		Aug 11, 2026 at 8:18 pm
Hi.Events Frontend	✅ Success (View Logs)	Web	Aug 11, 2026 at 8:18 pm
Hi.Events API	✅ Success (View Logs)	Web	Aug 11, 2026 at 8:17 pm

1 service not affected by this PR

• Maildev