fix(tickets): don't expose hidden event achievements

[wescopeland]

For the new tickets page, it's possible to uncloak upcoming/masked event achievements by hard navigating to the tickets URL for the achievement ID.

[greptile-apps]

Greptile Summary

Prevents direct ticket-list access for hub and event achievements.

• Adds a controller-level 404 guard.
• Covers both system types with feature tests.

Confidence Score: 5/5

Safe to merge; the guard matches existing ticket behavior.

Event tickets already use source achievements, and tests cover both blocked systems.

_{Reviews (1): Last reviewed commit: "fix(tickets): don't expose hidden event ..." | Re-trigger Greptile}