Reject bot-probe paths on the event alias route before hitting the DB

The public [redirectUrl] catch-all route (and its backend counterpart,
GET /api/events/by-alias/:redirectUrl) matched any unmatched top-level
path, so routine bot/scanner traffic (/wp-login.php, /.env, etc.) was
firing a live database query on every hit. That traffic pattern looks
like the cause of the P1017 "server has closed the connection" storms
and OOM crashes seen from v1.7 onward. Both now reject anything that
isn't a plausible alias (letters/numbers/hyphens/underscores) before
touching Prisma.

Also adds a max_memory_restart safety net to PM2 for both processes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ecosystem.config.js

@@ -5,6 +5,7 @@ module.exports = {
       cwd: __dirname + '/backend',
       script: 'src/index.js',
       env: { NODE_ENV: 'production' },
+      max_memory_restart: '500M',
     },
     {
       name: 'hope-events-frontend',
@@ -12,6 +13,7 @@ module.exports = {
       script: 'npm',
       args: 'start -- -p 3000',
       env: { NODE_ENV: 'production' },
+      max_memory_restart: '500M',
     },
   ],
 };