feat: add TicketOrder model and ticket-orders API for user/organizer transparency

[Jayrodri088]

Summary

Adds a Ticket Order model and read-only API so organizers and users can see ticket orders and payments, giving transparency between both sides.

Changes

Model: TicketOrder (src/models/ticket-order.ts)

• id – MongoDB _id (returned as id in API)
• ticketType – string (e.g. "free", "paid", "vip")
• eventName – string (denormalized from event for display)
• status – number: 0 = pending, 1 = completed, 3 = failed
• quantity – number
• amount – number (decimal)
• zkIdMatch – boolean
• privacyLevel – string (e.g. "anonymous", "wallet-required", "verified-access")
• hasReceipt – boolean
• datePurchased – Date
• user – ref to User (buyer)
• eventTicket – ref to EventTicket
• transactionId – optional (for payment gateway)

API (protected, requires auth)

• GET /ticket-orders/me?page=1&limit=20 – Current user’s ticket orders (buyer view). Paginated; returns { page, limit, total, orders }.
• GET /ticket-orders/organizer?page=1&limit=20 – Ticket orders for events the current user organizes. Same response shape.

Role-based access

• Users see only their own purchases (/me).
• Organizers see only orders for events they organize (/organizer).

Other

• Auth: Fixed validateAndGetUser to use User.findById(decoded.id) so JWT auth works for protected routes.
• Service: TicketOrderService.createOrder() is implemented for use when a payment/checkout flow exists (creates order and fills eventName / privacyLevel from the event).

#47

[DioChuks]

Attend to these

[DioChuks]

Wasn't requested for, remove this.

[DioChuks]

wasnt part of issue description.

[DioChuks]

did not request for this.

[DioChuks]

not needed too.

[DioChuks]

@Jayrodri088 no changes so far, will be unassigning & closing PR