Non-members can RSVP to public events (should require ring membership)

## Bug Authenticated users who are **not members of a ring** can currently RSVP to that ring's public events. Public visibility should mean the event is **discoverable** by non-members, not that non-members can attend without joining. ## Expected behavior `POST /v1/events/{event_id}/rsvp` should return **403 Forbidden** if the authenticated user is not a member of the ring that owns the event. The frontend should show a "Join this Ring to RSVP" prompt instead of the RSVP button for non-members. ## Current behavior Any authenticated user can RSVP to any public event regardless of ring membership. ## Suggested fix Add a membership check in the RSVP service layer (likely `rsvp_service.create_rsvp()` or the endpoint handler for `POST /v1/events/{event_id}/rsvp`): ```python membership = await group_member_repo.get(group_id=event.group_id, user_id=user.id) if not membership: raise ForbiddenError("You must be a member of this Ring to RSVP") ``` Frontend: conditionally render RSVP button vs "Join Ring" CTA based on user's membership status (already available from ring detail endpoint).