Remove OnboardingRequirement.order; restrict checklist actions to admin/MEMBER_ADMIN

Every active requirement blocks equally and there's no set order to complete
them in, so the configurable "order" field (and its ordering-by-number) is
gone -- requirements list alphabetically now, both in the admin UI and the
Onboarding requirements settings page.

Also closes a real permission gap found while checking this: marking a
checklist item complete, bypassing it, or reopening it (management/views.py's
MemberRequirementCompleteView/BypassView/IncompleteView) was open to *any*
staff member with page access, not just admin/MEMBER_ADMIN, despite the
member detail page's own Documents card implying otherwise. Switched all
three to MemberAdminRequiredMixin and hid the corresponding buttons/dialog
from anyone who can't use them. The Sign-up page's Bypass action was already
admin-only end to end (the whole page is ClubAdminRequiredMixin-gated), so
no change in practice there.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ECGMEwrc2k4D8VQuwjstj9

club/admin.py

@@ -67,10 +67,10 @@ class ClubRoleAdmin(admin.ModelAdmin):
 
 @admin.register(OnboardingRequirement)
 class OnboardingRequirementAdmin(admin.ModelAdmin):
-    list_display = ["name", "club", "requires_document", "is_active", "order"]
+    list_display = ["name", "club", "requires_document", "is_active"]
     list_filter = ["club", "is_active", "requires_document"]
     search_fields = ["name", "club__name"]
-    ordering = ["club", "order", "name"]
+    ordering = ["club", "name"]
 
 
 @admin.register(MemberRequirementStatus)