fix(top-events): remove token gate, add event_status filter and event_type_name

TopEventsAPI had AllowAny permission but still called
validate_token_and_get_user(), blocking unauthenticated carousel fetches.
Also added event_status='published' filter and event_type_name resolution
(model_to_dict only returns the FK integer, not the string name).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mobile_api/views/events.py

@@ -607,14 +607,11 @@ class TopEventsAPI(APIView):
 
     def post(self, request):
         try:
-            user, token, data, error_response = validate_token_and_get_user(request)
-            if error_response:
-                return error_response
-
-            events = Event.objects.filter(is_top_event=True).order_by('-created_date')
+            events = Event.objects.filter(is_top_event=True, event_status='published').order_by('-created_date')
             event_list = []
             for e in events:
                 data_dict = model_to_dict(e)
+                data_dict['event_type_name'] = e.event_type.event_type if e.event_type else ''
                 try:
                     thumb = EventImages.objects.get(event=e.id, is_primary=True)
                     data_dict['thumb_img'] = thumb.event_image.url