feat(events): render canonical evergreen catalog

[nicoechaniz]

Outcome

Replace date-specific virtual-event cards on /eventos/ with a fail-closed renderer backed by the public, versioned commerce catalog. The stable page URL can roll from one weekend to the next without inheriting stale dates, prices or registration links.

Closes the implementation slice of AlterMundi/harmonic-beacon-webapp#123 once publication and the remaining FREE/COUPON contract are accepted.

Current scope

• Reads only public-commerce-catalog.response.v1 from https://bot.harmonicbeacon.com/v1/commerce/catalog.
• Uses no credentials and requests no-store.
• Validates the contract's exact allowed keys plus schema, identifiers, modality, currency, amount, availability, timezone and timestamp ordering before rendering. Unknown or unversioned fields fail closed.
• Renders canonical session, locale, price, schedule and exactly one registration action for each currently OPEN session.
• Keeps PENDING, CLOSED, SOLD_OUT, CANCELLED, ENDED, empty, invalid and unavailable catalogs free of active checkout links.
• Escapes every producer-controlled string.
• Preserves Annie's approved bilingual editorial refinements from landing PR Refine English copy on the events page #39/Align Spanish Eventos copy with Annie's English refinements #43 in the dynamic template and field notes.
• Keeps the in-person event and historical field notes static.

Verification

• npm test: 76/76.
• npm run build: green.
• Live catalog contract probe: exact schema accepted, two canonical sessions (es-0830-cr, en-1600-cr), two open CTAs, USD 20 / USD 50, correct ES 2026-08-08 and EN 2026-08-11 registration links.
• CORS probe from Origin: https://harmonicbeacon.com: 200 with Access-Control-Allow-Origin: https://harmonicbeacon.com.
• Diff check: green.

Deliberate limits / risks

• The deployed v1 catalog represents positive-price online sessions only. It does not provide a typed FREE or COUPON access kind, so those states are not inferred from price or hardcoded. They remain fail-closed pending a versioned producer contract.
• A catalog/network/CORS failure intentionally removes all registration actions rather than displaying stale commerce facts.
• This PR changes the GitHub Pages source when merged. It remains draft and must not be merged/published without explicit publication approval.

Rollback

Revert these two commits. The previous static event cards return; no backend, data or credential change is involved.

[nicoechaniz]

Coordination note: this draft overlaps eventos/index.html with Annie's open PR #39. Work stops here until #39 is reviewed/merged. After that, #40 must rebase and preserve all of Annie's surviving English-copy edits; only the old hardcoded virtual-room paragraph is intentionally replaced by the canonical dynamic catalog. No merge or Pages publication should occur before that sequence.