Add Apple and Google Wallet passes for attendee tickets

[zigman79]

What changes I've made

• Two public endpoints for active attendees: GET /public/events/{event_id}/attendees/{attendee_short_id}/wallet/apple returns a signed .pkpass, .../wallet/google redirects to a signed Google Wallet save link. Both are rate limited and return a translated 404 for unknown, cancelled or unpaid attendees.
• AttendeeResourcePublic exposes wallet_passes.apple / wallet_passes.google flags derived from configuration. The attendee ticket page shows "Add to Apple Wallet" / "Add to Google Wallet" buttons for non-void tickets when the provider is configured.
• Credentials are supplied as base64 env values (APPLE_WALLET_*, GOOGLE_WALLET_*) so they work with Docker Compose secrets and single-line env files. Wired through config/services.php, .env.example, the all-in-one compose file and README.
• New dependencies pkpass/pkpass and firebase/php-jwt; ext-zip added to all PHP images because pkpass needs ZipArchive.
• Backend and frontend translations for all supported locales.

The feature is opt-in: without credentials nothing changes in the UI or API responses beyond the two false flags.

Why I've made these changes

Attendees expect to add tickets to their phone wallet. A wallet pass keeps the QR code available offline and surfaces it on the lock screen around event time, without a separate app. Closes #189.

How I've tested these changes

• Unit tests for both services in tests/Unit/Services/Domain/Wallet; full unit suite, Pint, scramble:analyze and the OpenAPI generation test pass.
• Smoke tested against the dev stack: unconfigured providers return 404 with a translated message (also verified via Accept-Language: de); with test credentials the Apple endpoint returns a .pkpass whose manifest hashes and PKCS7 signature verify, and the Google endpoint redirects to pay.google.com with an RS256 JWT whose signature and payload (class, object, barcode, valid time interval, ticket link) verify.
• Not yet verified with production Apple / Google credentials. A reviewer with a Pass Type ID certificate or a Google Wallet issuer account should confirm the pass renders on device.

Checklist

• I have read the contributing guidelines.
• My code follows the coding standards of the project.
• I have tested my changes, and they work as expected.
• I understand that this PR will be closed if I do not follow the contributor guidelines and if this PR template is left unedited.

🤖 Generated with Claude Code

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[zigman79]

I have read the CLA Document and I hereby sign the CLA

[zigman79]

recheck