Cancel an event, single-calendar or appointment-type-bound, with a booking code

Consume FIRST, then delete, matching the GraphQL original.

The event FK on the token has on_delete=CASCADE, so deleting the event would cascade-delete the token -- making a post-delete consume impossible. Consuming first (via SELECT FOR UPDATE) keeps the row alive long enough to lock it; the cascade then removes the already-consumed token row when the event is deleted. Both statements share the one outer transaction.atomic() block below, so if the delete step raises unexpectedly, the whole block -- including the consume -- rolls back, leaving the code available for retry.