fix: check balance before recording a purchase, reject dotted event names, return 0 points for new users

[hassan1brahim]

What was done

• attend-event: checks the attendance limit and the balance first, and only saves anything after both pass.
• attend-event: points get saved in one step that also creates the points record if it's not there yet (upsert), so there's no separate insert anymore.
• attend-event: event names with a . or starting with $ get a 400.
• points: auth_email is optional again and falls back to email.
• points: if someone has no points record yet, it returns 0 instead of a 404.
• update: check-in start time has a timezone now (10:30 AM Eastern), and the error messages show Eastern time.

Why

• When a shop purchase got refused for not enough points, it was still saving the visit, because the visit got written before the balance check. Every time you hit force attendance it added another fake purchase to User Info.
• Mongo reads a dot in a key as a nested path and a $ at the start as an operator, so a name like that gets saved in the wrong spot and the limit never gets checked.
• The live frontend doesn't send auth_email, so making it required would break points for every hacker until the new frontend is out.
• Most hackers don't have a points record at the start of the event, so User Info was showing "Error Getting Points" for basically everyone.
• Lambda runs in UTC, so without a timezone check-in would've opened at 6:30 AM Eastern instead of 10:30.

Merge this after or with the frontend PR (HackRU/frontendv2#368), since the old frontend still sends sponsor names with dots in them.