fix: count only confirmed participants in the event hero (issue #184)

[caviri]

#4 (Thibaut, issue #184) — the event header derived participantCount from hackathon.members.length, which includes waitlisted members. A waitlisted person hasn't joined yet, so the headline "N participants" over-counted for every viewer, admins included. Now filters is_waiting; the roster still lists waitlisted people — this is the count, not the list.

Verified: svelte-check 0 errors.

---

On the rest of this batch (reported honestly, not guessed)

• feat: add grpc backend with auth #7 View→404: searched every "View" literal, phase-detail links, and capability hrefs — none is a phase "View" that 404s. The only phase-conditional 404 is the phase-edit page (reached with a real phaseId). Needs a live repro to locate the exact control.
• feat: add pnpm to toolchain #6 propose-when-disabled 500: the backend does gate Propose on the capability + window; the 500 is in the write path with the capability allowed (UNGOVERNED reads as allowed — same coupling as Add frontend sveltekit setup #8). The team's own triager couldn't reproduce the 500 (feedback note [c]). Needs a repro to catch it.