TopEventsAPI had AllowAny permission but still called validate_token_and_get_user(), blocking unauthenticated carousel fetches. Also added event_status='published' filter and event_type_name resolution (model_to_dict only returns the FK integer, not the string name).