refactor(api): centralize caller ability creation in AbilityFactory

[MehrshadFb]

Summary

Removes the createAbilityForCaller / isUserOnboarded private-helper duplication from EventsService and GalleriesService by moving the logic into AbilityFactory as a new createForCaller(callerId) method. Every domain service that authorizes with CASL now calls one shared implementation — motivated by the upcoming photos domain, which would otherwise have added a third copy.

What's included

• AbilityFactory.createForCaller(callerId) — fetches the caller's onboarding state and builds the ability in one place. AbilityFactory now injects PrismaService (PrismaModule is global, so no module wiring changes)
• createForUser(user) kept unchanged for callers that already know the onboarding state (and for tests)
• EventsService / GalleriesService — dropped both private helpers; all 9 call sites now use abilityFactory.createForCaller
• EventsService.findAllForUser — the early return [] for non-onboarded callers now checks ability.can(READ, Event) against the subject type, which is false exactly when the caller has no rules (not onboarded). Same behavior, no extra query shape change
• 3 new unit tests for createForCaller (onboarded, not onboarded, missing user)

Behavior

No API or behavior changes — pure refactor. Each authorized call still performs the same single user lookup; it just lives in one place now.

Test plan

• npm test — 218 passed (3 new)
• npm run test:e2e — 75 passed
• format:check, eslint, openapi:check (spec unchanged), npm run build