Exempt public event registration POST from ladill-link CSRF checks.

Registration forms post to ladl.link first; Events-issued CSRF tokens cannot
validate against the Link app session and caused token mismatch errors.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Feature/LinkRedirectTest.php

@@ -202,4 +202,35 @@ class LinkRedirectTest extends TestCase
                 && $request->hasHeader('X-Ladill-Internal', '1');
         });
     }
+
+    public function test_event_registration_post_does_not_require_link_app_csrf_token(): void
+    {
+        $user = $this->user();
+        ShortLink::create([
+            'user_id' => $user->id,
+            'slug' => 'sales-webinar',
+            'source_app' => 'events',
+            'source_kind' => 'qr',
+            'is_managed_here' => false,
+            'destination_url' => 'https://ladl.link/sales-webinar',
+            'is_active' => true,
+        ]);
+
+        Http::fake([
+            'https://events.ladill.com/q/sales-webinar/register' => Http::response(json_encode([
+                'paid' => false,
+                'success_url' => 'https://ladl.link/sales-webinar/registered/QRE-TESTREF123456',
+                'badge_code' => 'BADGE123',
+            ]), 200, ['Content-Type' => 'application/json']),
+        ]);
+
+        $this->postJson('https://ladl.link/sales-webinar/register', [
+            'tier' => 'General Admission',
+            'attendee_name' => 'Jane Doe',
+            'attendee_email' => 'jane@example.com',
+            'attendee_phone' => '+233200000000',
+        ])
+            ->assertOk()
+            ->assertJsonPath('badge_code', 'BADGE123');
+    }
 }