Limit cross-user event lookups to System Manager

The `user` parameter of `get_events` now requires System Manager role; callers without it only see their own events.