Feat/add created at and updated at fields( issues 570 574)

[CHEF-SAVY]

---

Summary

• Expose created_at and updated_at in the Event JSON response — fixes a serializer field-count hint and adds a test confirming both timestamps appear in every event payload.
• Guarantee X-Request-ID on all error responses — adds an explicit propagate_request_id middleware that copies the header from the incoming request to the outgoing response, covering cases where
  AppError::into_response() produces a fresh Response with no request-ID header.
• Enforce page_size upper bound in SearchParams — values of 0 or > 100 now return HTTP 400 with a validation error instead of being silently clamped.
• Add location to the event keyword search — the q parameter now matches against e.location ILIKE in addition to title and description, so searches like "Lagos" or "Madison Square Garden" return results.

Test plan

• GET /api/v1/events and GET /api/v1/events/:id — verify created_at and updated_at fields appear in the JSON body.
• Any error response (e.g. GET /api/v1/events/nonexistent-id) — verify X-Request-ID is present in the response headers.
• GET /api/v1/events/search?q=test&page_size=0 → expect 400 VALIDATION_ERROR.
• GET /api/v1/events/search?q=test&page_size=101 → expect 400 VALIDATION_ERROR.
• GET /api/v1/events/search?q=Lagos → verify events whose location contains "Lagos" are returned.
• cargo test -p agora-server passes with no new warnings.

Closes #570, closes #572, closes #573, closes #574

---

[vercel]

@CHEF-SAVY is attempting to deploy a commit to the oseh-svg's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@CHEF-SAVY Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Yunusabdul38]

LGTM