feat(events): event owner and cross-club validation

Add Event.created_by (the owner, used later by the access service to let an
event's creator edit it).

Validate that an event's season/location/opponent — and an EventSeries'
location/opponent — belong to the event's club. The teams M2M cannot be checked
in clean() (M2M rows are written after save), so an m2m_changed pre_add receiver
rejects teams from another club.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

events/signals.py

@@ -8,17 +8,30 @@ Registered from ``EventsConfig.ready``. Two triggers:
   events.
 """
 
+from django.core.exceptions import ValidationError
 from django.db.models.signals import m2m_changed, post_delete, post_save
 from django.dispatch import receiver
 from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
 
-from events.models import Event
+from events.models import Event, EventSeries
 from events.services import sync_event_attendances
-from teams.models import TeamMembership
+from teams.models import Team, TeamMembership
 
 M2M_SYNC_ACTIONS = {"post_add", "post_remove", "post_clear"}
 
 
+@receiver(m2m_changed, sender=Event.teams.through)
+@receiver(m2m_changed, sender=EventSeries.teams.through)
+def validate_teams_same_club(sender, instance, action, reverse, pk_set, **kwargs):
+    # Reject teams from another club before they're attached (forward adds only;
+    # the reverse direction — team.scheduled_events.add(...) — is not a used path).
+    if action != "pre_add" or reverse:
+        return
+    if Team.objects.filter(pk__in=pk_set).exclude(club_id=instance.club_id).exists():
+        raise ValidationError(_("Teams must belong to the same club as the event."))
+
+
 @receiver(post_save, sender=Event)
 def sync_on_event_save(sender, instance, **kwargs):
     sync_event_attendances(instance)