feat: consolidate frontend API layer, add query-client, and harden backend Fase 1

Frontend:
- Consolidate duplicate API layers into single src/lib/axios.ts per app
- Remove src/lib/api-client.ts and src/utils/api.ts (admin)
- Add src/lib/query-client.ts with TanStack Query config per app
- Update all imports and auto-import config

Backend:
- Fix organisations.billing_status default to 'trial'
- Fix user_invitations.invited_by_user_id to nullOnDelete
- Add MeResource with separated app_roles and pivot-based org roles
- Add cross-org check to EventPolicy view() and update()
- Restrict EventPolicy create/update to org_admin/event_manager (not org_member)
- Attach creator as org_admin on organisation store
- Add query scopes to Event and UserInvitation models
- Improve factories with Dutch test data
- Expand test suite from 29 to 41 tests (90 assertions)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/admin/src/utils/api.ts

@@ -1,40 +0,0 @@
-import type { AxiosRequestConfig } from 'axios'
-import { apiClient } from '@/lib/api-client'
-
-type ApiOptions = {
-  method?: string
-  body?: unknown
-  query?: Record<string, string | number | boolean | undefined>
-  onResponseError?: (ctx: { response: { status: number; _data?: { errors?: Record<string, string[]>; message?: string } } }) => void
-}
-
-/**
- * Thin ofetch-style wrapper around the single axios client (lib/axios).
- * Use apiClient from @/lib/axios directly in new code; $api remains for Vuexy template compatibility.
- */
-export async function $api<T = unknown>(url: string, options: ApiOptions = {}): Promise<T> {
-  const { method = 'GET', body, query, onResponseError } = options
-
-  const config: AxiosRequestConfig = {
-    method: method.toLowerCase() as AxiosRequestConfig['method'],
-    url,
-    params: query,
-    data: body,
-  }
-
-  try {
-    const response = await apiClient.request<T>(config)
-    return response.data
-  }
-  catch (error: any) {
-    if (onResponseError && error.response) {
-      onResponseError({
-        response: {
-          status: error.response.status,
-          _data: error.response.data,
-        },
-      })
-    }
-    throw error
-  }
-}