Returns the whole stored event, including the before/after values of
every changed field. This is the only place those values are served;
a change the producer withheld reads masked: true with ***.
data carries whatever else the producer sent, null when nothing
else was.

createdAt (when the event was recorded) and recordedAt (when it
was archived, null until then) are shown alongside occurredAt.
Another organisation's event and an unknown id both return 404,
deliberately indistinguishable.