Decoupling audit: remove events API, update shared submodule

- Delete events_api.py (dead internal API endpoint)
- Remove registration from app.py
- Update shared submodule

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app.py

@@ -128,10 +128,6 @@ def create_app() -> "Quart":
     from bp.ticket_admin.routes import register as register_ticket_admin
     app.register_blueprint(register_ticket_admin())
 
-    # Internal API (server-to-server, CSRF-exempt)
-    from events_api import register as register_events_api
-    app.register_blueprint(register_events_api())
-
     return app