Events had no Roles mechanism, so IAM Authorize middleware denied every
/events/* request (no role granted events_available:read etc).

- EventsAdminRole: full CRUD on available, listeners, agent-commands
- EventsUserRole: read-only on available and own-account listeners
- Register AuthorizationScope/LimitScope in config/events.php so the
  role apply() filters actually run on Events models

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>