Stored XSS: event ACF fields + seat-map JSON unescaped into front templates

Event fields and seat-map data render unescaped into front-end templates, allowing stored cross-site scripting.

checkout/events/web.php:30, steps/seater.php:19