refactor(api): extract shared artifact-admin helpers (list query, scope defaults, slugify)

[cdcore09]

Summary

The admin routes for events and announcements are 80%+ identical: zod validation schemas, list-query where builder, scope-by-author-class defaulting, pagination shape, audit-row writing on PATCH. Plans 4 (forms) and 5 (broadcast) will add more parallel surfaces; extract before that hardens.

Requirements

• Extract buildArtifactListWhere(table, query, allowedStatuses, allowedScopes) to a shared module
• Extract inferDefaultScope(actor) helper
• Extract slugify(name) to packages/api/src/lib/slug.ts (currently duplicated in admin/events/index.ts and eventsSubmit.ts)
• Refactor admin/events/index.ts, admin/events/byId.ts, admin/announcements/index.ts, admin/announcements/byId.ts, and eventsSubmit.ts to use the shared helpers
• All existing tests still pass

Context

Flagged in both the Plan 2 and Plan 3 final reviews. Parallel artifact types are intentionally separated at the table level, but the route-construction code wants to be shared.

Implementation Notes

Keep the per-artifact-type sub-app structure (one folder per artifact under routes/admin/) — only the helpers move out. Don't introduce a polymorphic router; that fights Drizzle's type narrowing.