diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000..3ba24ff
Binary files /dev/null and b/.DS_Store differ
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..54cdb12
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,13 @@
+.git
+.venv
+node_modules
+staticfiles
+media
+db.sqlite3
+.env
+*.pyc
+__pycache__
+.coverage
+.idea
+.ruff_cache
+ARCHITECTURE.pdf
diff --git a/.env.compose.example b/.env.compose.example
new file mode 100644
index 0000000..247d84c
--- /dev/null
+++ b/.env.compose.example
@@ -0,0 +1,10 @@
+# Copy to .env — read by docker compose itself (not by Django).
+ROSTERCHIEF_BASE_DOMAIN=rosterchief.app
+ACME_EMAIL=you@example.com
+
+# DNS-01 is the only way to get the *.rosterchief.app wildcard. Token needs DNS:Edit on the zone.
+CLOUDFLARE_API_TOKEN=
+
+POSTGRES_DB=rosterchief
+POSTGRES_USER=rosterchief
+POSTGRES_PASSWORD=
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..746e21e
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,37 @@
+# Copy to .env and fill in. Values below are development-friendly defaults.
+
+# Required. Generate one, e.g. `python -c "import secrets; print(secrets.token_urlsafe(50))"`.
+DJANGO_SECRET_KEY=change-me
+
+# Development toggles.
+DJANGO_DEBUG=True
+
+# Hosts Django will serve. `.localhost` matches localhost and any *.localhost
+# subdomain, which the tenant middleware needs for per-club subdomains.
+DJANGO_ALLOWED_HOSTS=.localhost,127.0.0.1,[::1]
+
+# Multi-tenancy: subdomains of this base domain resolve to a club by slug,
+# e.g. http://ajax-united.localhost:8000/ -> club with slug "ajax-united".
+# In production set this to your real base domain (e.g. rosterchief.app).
+ROSTERCHIEF_BASE_DOMAIN=localhost
+
+# Two-factor auth. ROSTERCHIEF_BASE_DOMAIN doubles as the WebAuthn Relying Party
+# ID, so ONE passkey works across every club subdomain. Change it and existing
+# passkeys stop validating -- they are cryptographically bound to that domain.
+# ROSTERCHIEF_RP_NAME is what the browser shows during a passkey prompt.
+# ROSTERCHIEF_RP_NAME=RosterChief
+
+# Sessions are shared across club subdomains (log in once, all clubs). Derived
+# from ROSTERCHIEF_BASE_DOMAIN in production; left host-only on localhost
+# because browsers reject a Domain attribute there. Override if needed.
+# DJANGO_SESSION_COOKIE_DOMAIN=.rosterchief.app
+# DJANGO_CSRF_COOKIE_DOMAIN=.rosterchief.app
+
+# Optional. Defaults to sqlite:///db.sqlite3 for dev; point at Postgres in prod.
+# DJANGO_DATABASE_URL=postgres://user:pass@localhost:5432/rosterchief
+
+# Optional. CSRF trusted origins (needed for subdomains in prod), comma-separated.
+# DJANGO_CSRF_TRUSTED_ORIGINS=https://*.rosterchief.app
+
+# Optional.
+# DJANGO_TIME_ZONE=Europe/Brussels
diff --git a/.env.production.example b/.env.production.example
new file mode 100644
index 0000000..5a86d9b
--- /dev/null
+++ b/.env.production.example
@@ -0,0 +1,38 @@
+# Copy to .env.production and fill in. Everything here is read by python-decouple.
+
+# --- Django ---
+DJANGO_SECRET_KEY=          # python -c "import secrets; print(secrets.token_urlsafe(64))"
+DJANGO_DEBUG=False
+# The leading dot matches every club subdomain.
+DJANGO_ALLOWED_HOSTS=.rosterchief.app
+DJANGO_CSRF_TRUSTED_ORIGINS=https://rosterchief.app,https://*.rosterchief.app
+DJANGO_TIME_ZONE=Europe/Brussels
+
+# --- Tenancy ---
+# Drives subdomain resolution, the shared session cookie, and the WebAuthn RP ID (one passkey
+# across every club).
+ROSTERCHIEF_BASE_DOMAIN=rosterchief.app
+ROSTERCHIEF_RP_NAME=RosterChief
+
+# --- Services ---
+DJANGO_DATABASE_URL=postgres://rosterchief:CHANGEME@db:5432/rosterchief
+DJANGO_REDIS_URL=redis://redis:6379/0
+
+# --- HTTPS (off by default in code; the deploy is what turns them on) ---
+DJANGO_SECURE_SSL_REDIRECT=True
+DJANGO_SESSION_COOKIE_SECURE=True
+DJANGO_CSRF_COOKIE_SECURE=True
+DJANGO_SECURE_HSTS_SECONDS=31536000
+DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS=True
+# Preload is a one-way door — turn it on only once the wildcard cert has proven itself.
+DJANGO_SECURE_HSTS_PRELOAD=False
+
+# --- Static ---
+DJANGO_STATICFILES_BACKEND=whitenoise.storage.CompressedManifestStaticFilesStorage
+
+# --- Uploads: set these and club logos move off local disk (required for >1 app server) ---
+# AWS_STORAGE_BUCKET_NAME=rosterchief-media
+# AWS_S3_ENDPOINT_URL=https://fsn1.your-objectstorage.com
+# AWS_S3_REGION_NAME=fsn1
+# AWS_ACCESS_KEY_ID=
+# AWS_SECRET_ACCESS_KEY=
diff --git a/.gitignore b/.gitignore
index d0fee72..b987436 100644
--- a/.gitignore
+++ b/.gitignore
@@ -376,6 +376,7 @@ poetry.toml
 # LSP config files
 pyrightconfig.json
 
+# End of https://www.toptal.com/developers/gitignore/api/python,pycharm,django%
+# Node
 node_modules/
-
-# End of https://www.toptal.com/developers/gitignore/api/python,pycharm,django%
\ No newline at end of file
+staticfiles/
diff --git a/.idea/dataSources.xml b/.idea/dataSources.xml
new file mode 100644
index 0000000..e3a051f
--- /dev/null
+++ b/.idea/dataSources.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DataSourceManagerImpl" format="xml" multifile-model="true">
+    <data-source source="LOCAL" name="clubmanager-dev" uuid="840b050e-fdb0-4cf8-a4e7-3edb02bfaacb">
+      <driver-ref>sqlite.xerial</driver-ref>
+      <synchronize>true</synchronize>
+      <jdbc-driver>org.sqlite.JDBC</jdbc-driver>
+      <jdbc-url>jdbc:sqlite:$PROJECT_DIR$/db.sqlite3</jdbc-url>
+      <working-dir>$ProjectFileDir$</working-dir>
+    </data-source>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/markdown.xml b/.idea/markdown.xml
new file mode 100644
index 0000000..00405d5
--- /dev/null
+++ b/.idea/markdown.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="MarkdownSettings">
+    <option name="fileGroupingEnabled" value="true" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
index d8e05c0..34d3806 100644
--- a/.idea/modules.xml
+++ b/.idea/modules.xml
@@ -2,7 +2,7 @@
 <project version="4">
   <component name="ProjectModuleManager">
     <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/clubmanager.iml" filepath="$PROJECT_DIR$/.idea/clubmanager.iml" />
+      <module fileurl="file://$PROJECT_DIR$/.idea/rosterchief.iml" filepath="$PROJECT_DIR$/.idea/rosterchief.iml" />
     </modules>
   </component>
 </project>
\ No newline at end of file
diff --git a/.idea/pyLspTools.xml b/.idea/pyLspTools.xml
index e746c6c..f39483f 100644
--- a/.idea/pyLspTools.xml
+++ b/.idea/pyLspTools.xml
@@ -13,4 +13,7 @@
       </map>
     </option>
   </component>
+  <component name="RuffConfiguration">
+    <option name="enabled" value="true" />
+  </component>
 </project>
\ No newline at end of file
diff --git a/.idea/pySourceRootDetection.xml b/.idea/pySourceRootDetection.xml
new file mode 100644
index 0000000..089a2ac
--- /dev/null
+++ b/.idea/pySourceRootDetection.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="PySourceRootDetectionService">
+    <option name="sourcePathsSet">
+      <set>
+        <option value="$PROJECT_DIR$" />
+      </set>
+    </option>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/ClubManager.iml b/.idea/rosterchief.iml
similarity index 73%
rename from .idea/ClubManager.iml
rename to .idea/rosterchief.iml
index 1c9d6d4..f20c0e6 100644
--- a/.idea/ClubManager.iml
+++ b/.idea/rosterchief.iml
@@ -4,7 +4,7 @@
     <facet type="django" name="Django">
       <configuration>
         <option name="rootFolder" value="$MODULE_DIR$" />
-        <option name="settingsModule" value="clubmanager/settings.py" />
+        <option name="settingsModule" value="rosterchief/settings.py" />
         <option name="manageScript" value="$MODULE_DIR$/manage.py" />
         <option name="environment" value="&lt;map/&gt;" />
         <option name="doNotUseTestRunner" value="false" />
@@ -14,6 +14,11 @@
   </component>
   <component name="NewModuleRootManager">
     <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$" isTestSource="false" />
+      <excludeFolder url="file://$MODULE_DIR$/.venv" />
+    </content>
+    <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$" isTestSource="false" />
       <excludeFolder url="file://$MODULE_DIR$/.venv" />
     </content>
     <orderEntry type="jdk" jdkName="uv (ClubManager) (3)" jdkType="Python SDK" />
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
new file mode 100644
index 0000000..c76be18
--- /dev/null
+++ b/ARCHITECTURE.md
@@ -0,0 +1,902 @@
+# RosterChief — Model & Domain Architecture
+
+Baseline reference for implementing the domain models. This describes the **intended
+shape** of the data model: what exists today, what is planned, and the conventions every
+app should follow. It is a living document — update it when the model changes.
+
+> **Tenancy: multi-tenant (row-based / shared-schema).** RosterChief is designed as a
+> **multi-tenant platform** — one deployment serves many clubs, with **`Club` as the tenant
+> root**. Isolation is **row-based**: a shared database and schema where every club-owned
+> row carries a `club` FK (via `ClubScopedModel`), and *all* access is scoped to the
+> current tenant. The mechanics — tenant resolution, scoping manager, per-club uniqueness —
+> are specified in **§2.4**.
+>
+> ⚠️ **This supersedes `CLAUDE.md`**, which currently states the app is "deliberately *not*
+> multi-tenant … there is no `club_id` tenancy." That guidance and the project memory are
+> now **out of date** and must be updated to match this document — see the **banner at the
+> foot of this file**. Where the two disagree, this architecture is the intended direction.
+
+---
+
+## 1. App decomposition
+
+The `isort` `known-first-party` roadmap lists nine apps. The build split the original
+`accounts` app into `authentication` + `club`. Per the decisions in §7, the people models
+(`Member`, `Family`) **move out of `authentication` into a dedicated `members` app**, and
+two apps (`formbuilder`, `shop`) are added **beyond the original roadmap** — add all new
+labels to `known-first-party` in `pyproject.toml` when they land. The target decomposition:
+
+| App              | Status       | Responsibility                                            | Models |
+|------------------|--------------|-----------------------------------------------------------|--------|
+| `authentication` | **built**    | Login identity + tenancy/role services (global, cross-club) | `User` |
+| `members`        | **planned**  | People: person records, families (extract from `authentication`) | `Member`, `Family`, `FamilyMembership` |
+| `club`           | **built**    | Tenant root, **season**, season-scoped affiliation, club roles | `Club`, `Season` *(planned)*, `ClubMembership`, `ClubRole` *(planned)* |
+| `teams`          | planned      | Teams and season rosters                                  | `Team`, `TeamMembership`, `StaffAssignment` |
+| `events`         | planned      | Training / matches / social events + attendance           | `Event`, `Attendance` |
+| `news`           | **built**    | Club news: coach_manager-authored, editor-released         | `News`, `NewsPhoto` |
+| `pages`          | planned      | Flat CMS pages for the public site                        | `Page` |
+| `home`           | planned      | Homepage composition / featured content                   | `HomeConfig` (per-club) or config-only |
+| `formbuilder`    | planned      | Admin-defined dynamic forms + submissions + reporting     | `Form`, `Field`, `Submission`, `Answer` |
+| `shop`           | planned      | Cart-like shop, orders, payments, PDF invoices            | `Product`, `Cart`, `CartItem`, `Order`, `OrderLine`, `Payment`, `Invoice` |
+| `search`         | planned      | Site search (likely no models; index/config only)         | — |
+
+**`User` stays global** (one login identity across the whole platform); everything else
+that belongs to a club is tenant-scoped (§2.4). This is why `Member` — a *person within a
+club* — lives in its own app and carries a `club` FK, while `User` does not.
+
+**Open decision (§7):** whether to migrate `Member`/`Family` out of `authentication` into
+a dedicated `members` app. Recommendation: keep them in `authentication` for now; revisit
+only if the app grows unwieldy. The roadmap `members` name is reserved either way.
+
+---
+
+## 2. Shared conventions
+
+These are already established in code — every new model follows them.
+
+- **UUID primary keys.** Inherit `rosterchief.base.UUIDModel` (`id = UUIDField(default=uuid4)`).
+  Never expose sequential integer PKs.
+- **`ClubScopedModel`** (`rosterchief.base`) adds the tenant `club` FK
+  (`related_name="%(class)ss"`) and, under multi-tenancy, a tenant-aware manager + auto
+  club-stamping `save()` (§2.4). **Every aggregate-root model inherits it**; leaf rows
+  reachable only via a scoped parent (e.g. `Attendance` via `Event`) may inherit scope from
+  the parent, though denormalising `club` onto them is recommended (§2.4).
+- **i18n everywhere.** Every field gets a `gettext_lazy` verbose name; every model sets
+  `verbose_name` / `verbose_name_plural` and a sensible `Meta.ordering`. `TextChoices`
+  labels are translated too.
+- **`__str__` on every model**, human-readable.
+- **Enumerations** use nested `models.TextChoices` (see `FamilyMembership.FamilyRole`).
+- **Phone numbers** use `PhoneNumberField` (from `django-phonenumber-field`), nullable.
+- **Through models** for many-to-many relationships that carry data (role, jersey number,
+  attendance status) — never a bare `ManyToManyField` when the link has attributes.
+- **Business logic in `services/`**, not fat models or views (see
+  `authentication/services/member_csv_importer.py`). Management commands are thin wrappers
+  over services (see `import_members_csv`).
+- **Migrations are generated, not hand-edited** (ruff-excluded).
+
+### Naming & relations
+- `related_name` is explicit and plural on the "many" side, chosen to read naturally from
+  the parent (`club.members`, `family.memberships`, `member.family_memberships`).
+- Deletion policy is deliberate per FK: `CASCADE` for owned children,
+  `SET_NULL`(+`null=True`) where the child should survive its parent (e.g.
+  `Member.user`), `PROTECT` for references that must not silently disappear (planned:
+  `Season` on rosters/events — see §5).
+
+### 2.4 Multi-tenancy (row-based, shared schema)
+
+`Club` is the **tenant root**. One deployment, one database, one schema; tenants are
+separated by a `club` FK on every owned row and by disciplined scoping of every query.
+This is the lightest multi-tenancy model and matches the existing `ClubScopedModel`
+scaffolding — no Postgres schemas, no per-tenant databases, no `django-tenants`.
+
+**What gets a `club` FK.** Every *aggregate root* inherits `ClubScopedModel` and so carries
+`club` (`Member`, `Family`, `Season`, `Team`, `Event`, `ClubRole`, `Article`, `Category`,
+`Page`, `Form`, `Product`, `Cart`, `Order`, `Invoice`, …). Leaf rows reachable only through
+a scoped parent (`Answer`→`Submission`, `OrderLine`/`Payment`→`Order`, `CartItem`→`Cart`,
+`Attendance`→`Event`, `TeamMembership`/`StaffAssignment`→`Team`) may inherit scope via the
+parent — but **denormalising `club` onto them too is recommended** for leak-proof filtering
+and DB-level constraints. `User` is the **only** global identity model; it has no `club`.
+
+**People vs. logins under tenancy.** A `User` is one platform-wide login that may belong to
+several clubs; a `Member` is that person *within one club*. So:
+- `Member.user` becomes a **`ForeignKey`** (not `OneToOneField`) — one user → many members
+  (at most one per club): `unique_together (club, user)`.
+- `User.get_full_name()` can no longer assume a single member; resolve the member **for the
+  current club** (via the tenant context below), falling back to email.
+
+**Tenant resolution → `request.club`.** A `ClubTenantMiddleware` resolves the active club
+per request (recommended: **subdomain**, `ajax-united.rosterchief.app`; path-prefix
+`/c/<slug>/` is the alternative) and stores it on `request.club` *and* in a context
+variable so non-request code (services, management commands) can read it:
+
+```
+# rosterchief/tenancy.py
+from contextvars import ContextVar
+_current_club: ContextVar = ContextVar("current_club", default=None)
+
+def set_current_club(club):  _current_club.set(club)
+def get_current_club():      return _current_club.get()
+def require_current_club():                        # raises if unset — use in write paths
+    club = _current_club.get()
+    if club is None: raise RuntimeError("No active club in context")
+    return club
+
+class ClubTenantMiddleware:                        # resolves subdomain -> Club, sets both
+    ...  # request.club = club; set_current_club(club)
+```
+
+**Considered — `django.contrib.sites` for resolution (rejected as the mechanism).**
+Django's Sites framework is the obvious "does the batteries-included answer fit?" candidate,
+so it was evaluated explicitly:
+
+*What it offers.* A `Site(domain, name)` model, `get_current_site(request)` (Host-header →
+`Site`, with a per-process `SITE_CACHE`), `CurrentSiteMiddleware` (sets `request.site`), and
+`CurrentSiteManager` (auto-filters models that hold an FK to `Site`). Ecosystem code
+(`flatpages`, `redirects`, `sitemaps`, `allauth`) is Site-aware for free.
+
+*Why it does **not** fit as our tenancy mechanism:*
+- **Wrong scoping key.** `CurrentSiteManager` filters on a `site` FK; our tenant key is the
+  `club` FK on `ClubScopedModel`. Adopting Sites' manager would mean putting a *second* FK on
+  every model, or ignoring the manager — either way it buys us nothing over `.for_club()`.
+- **A parallel identity table.** `Site` duplicates identity that already lives on `Club`
+  (`slug`, domain, name). Two tables to keep in sync, two sources of truth for "which tenant".
+- **`SITE_ID` is a single global.** The framework's happy path is *one process = one site*
+  (`SITE_ID`). Multi-tenant host resolution requires leaving `SITE_ID` unset and relying on
+  `get_current_site`'s exact-domain match — workable, but the setting is a standing foot-gun
+  (any library that reads `SITE_ID` silently binds to the wrong tenant), and shells, tasks,
+  and tests have no Host header, so they still need our contextvar (`require_current_club()`).
+- **Host-only.** Sites cannot express the path-prefix option (`/c/<slug>/`); resolution is
+  purely `domain`-based, foreclosing that alternative.
+
+*Verdict.* Keep **`Club` (with `slug` + optional `domain`) as the single tenant root** and
+resolve it in `ClubTenantMiddleware` — the resolution logic (Host → `Club`) is a few lines and
+avoids the sync/`SITE_ID` hazards. **Optional bridge:** if a Site-aware third party is later
+adopted (e.g. `allauth`, `sitemaps`), add a thin `Club.site = OneToOneField(Site)` kept in sync
+from `Club.save()`, so the ecosystem gets its `Site` while `Club` stays authoritative — do
+this only when such a dependency actually lands, not preemptively.
+
+**Scoping manager.** `ClubScopedModel` gets a tenant-aware manager so day-to-day queries
+can't accidentally cross tenants:
+
+```
+class TenantQuerySet(models.QuerySet):
+    def for_club(self, club): return self.filter(club=club)
+    def current(self):        return self.filter(club=require_current_club())
+
+class ClubScopedModel(UUIDModel):
+    club = models.ForeignKey("club.Club", on_delete=models.CASCADE, related_name="%(class)ss")
+    objects = TenantQuerySet.as_manager()
+    def save(self, *args, **kwargs):               # auto-stamp club from context if unset
+        if self.club_id is None: self.club = require_current_club()
+        super().save(*args, **kwargs)
+    class Meta: abstract = True
+```
+
+Prefer **explicit** `.for_club(club)` / `.current()` in views and services over a fully
+automatic global filter — auto-filtering via context state is convenient but hides tenant
+boundaries and bites hard in shells, tasks, and tests. Keep scoping visible.
+
+**Per-club uniqueness.** Every constraint that was globally unique becomes **unique per
+club**. Concretely: `Season.name`, all public `slug`s (`Article`, `Page`, `Form`,
+`Product`), `Team (season, name)`, jersey numbers `(team, jersey_number)`, and the
+human-readable counters `Order.number` / `Invoice.number` are scoped by / allocated per
+club. A bare `unique=True` on a tenant model is almost always a bug — use
+`UniqueConstraint(fields=["club", …])`.
+
+**Cross-cutting consequences (checklist for every feature):**
+- Admin: register a `club` list-filter and scope `get_queryset` for non-superusers.
+- Roles are **per-club** — see §3 (global Django Groups don't fit; use `ClubRole`).
+- Sequential numbers (invoices) allocate per club inside a transaction — never `count()+1`.
+- Tests must set a current club (a `with_club(club)` context-manager helper).
+- Config: wildcard host + CSRF for subdomains; see §8.
+
+---
+
+## 3. Roles & access control (RBAC)
+
+Authorization is **service-layer, and per-club** (§2.4). Because roles differ per tenant —
+a user can be a treasurer at club A and merely a member at club B — global Django `Group`s
+(which are platform-wide) **do not fit**. Roles are stored as tenant-scoped `ClubRole` rows
+and *all* permission decisions go through a single service module; no `django-guardian`,
+no per-club Group hacks. Django's own permission framework is retained **only** for the
+platform-operator layer (`is_staff` / `is_superuser` in Django admin).
+
+### 3.1 Two layers
+
+1. **Platform operators** — `User.is_superuser` / `is_staff`. Global, cross-club; run the
+   Django admin, manage the tenant list. Not a club role.
+2. **Club roles** — a member's standing *within one club*, stored per tenant. Two kinds:
+   - **Club-wide roles** → `ClubRole` rows (below).
+   - **Object-scoped roles** → derived from the domain graph, no extra rows:
+     - Coach / manager **of a specific team** → `StaffAssignment(team, member, role)`.
+     - Parent / guardian **of a specific member** → `FamilyMembership` + the family graph.
+     - Purchaser vs. beneficiary → `Order`/`OrderLine` + `ClubMembership`.
+
+### 3.2 `ClubRole` — club-wide role assignments  *(app: `club`)*
+
+```
+ClubRole(ClubScopedModel)              # ClubScopedModel -> carries `club` (§2.4)
+  member  FK Member (CASCADE, related_name="roles")
+  role    CharField (TextChoices: MEMBER | EDITOR | TREASURER | BOARD)
+  Meta: unique_together (club, member, role)
+```
+
+| Role        | Grants (representative)                                                       |
+|-------------|------------------------------------------------------------------------------|
+| *Public*    | Anonymous — no row; read-only public site of that club.                      |
+| `MEMBER`    | View own + family data, own rosters/attendance, own orders/invoices, submit member-only forms. |
+| `EDITOR`    | Manage that club's `news`, `pages`, `formbuilder` content.                    |
+| `TREASURER` | Manage that club's `shop`: products, orders, payments, issue/void invoices.   |
+| `BOARD`     | Full management of that club: members, roles, all of the above.              |
+
+`news` is the one place a `ClubRole` and a derived role (`COACH_MANAGER`, see below)
+share a single workflow rather than each owning a separate permission: drafting is
+open to EDITOR/ADMIN *or* any coach_manager, but only EDITOR/ADMIN may publish —
+see §5.4.
+
+`COACH` / `TEAM_MANAGER` are deliberately **not** `ClubRole`s — being a coach is always
+*of a team*, so it lives on `StaffAssignment` (§5.3). "Is this user a coach at this club?"
+= "do they have any `StaffAssignment` on a team in this club?".
+
+### 3.3 The permission service
+
+One module — `club/services/access.py` (or `authentication/services/access.py`) — answers
+every authorization question, always taking the club/object as an argument:
+
+```
+has_club_role(user, club, role)      -> bool      # ClubRole lookup
+roles_in_club(user, club)            -> set[str]  # incl. derived COACH/MANAGER
+teams_managed_by(user, club)         -> QuerySet[Team]
+members_visible_to(user, club)       -> QuerySet[Member]   # self + family + managed teams
+can_edit_event(user, event)          -> bool
+can_manage_shop(user, club)          -> bool      # TREASURER or BOARD
+```
+
+Views, admin, and templates call these — never re-derive access inline. Each helper scopes
+to the given club (§2.4), so a user's powers in club A never leak into club B.
+
+### 3.4 Keeping roles in sync with domain state
+
+`ClubRole` membership is **reconciled from domain facts**, not hand-assigned:
+
+- An **active** `ClubMembership` for the club's current season → grant the `MEMBER` role;
+  a lapsed one → revoke. (Season-scoped membership: §5.1.)
+- A `StaffAssignment` needs no `ClubRole` — coach status is derived (§3.2).
+
+Implement as `club/services/access.py::reconcile_roles(user, club)`, invoked on the state
+changes that matter (membership activation/lapse), so authorization never drifts from data.
+
+---
+
+## 4. Built models (as-is, + planned tenancy changes)
+
+### `authentication`
+
+**`User`** — custom auth model, email is the login (`USERNAME_FIELD = "email"`, no
+username). UUID PK. `objects = UserManager()` (email-based `create_user` /
+`create_superuser`). **Stays global — the one model with no `club` FK** (§2.4). Because a
+user may belong to several clubs, `get_full_name` / `get_short_name` resolve the `Member`
+**for the current club** (via tenant context), falling back to email — they can no longer
+assume a single member.
+
+### `members` *(planned — extract from `authentication`)*
+
+`Member`, `Family`, `FamilyMembership` **move here** and become tenant-scoped
+(`ClubScopedModel`).
+
+**`Member`** — a *person within one club*. `user` becomes a **`ForeignKey`** (was
+`OneToOneField`), still nullable (`on_delete=SET_NULL`), so one login maps to one member
+*per club* (`unique_together (club, user)`) and members can exist without logins (children,
+imports). Holds name, DOB, contact `email`/`phone`/`emergency_phone`. `contact_email`
+prefers the member's own email, else the login email. `guardians` returns parent/guardian
+members reachable through shared families (all within the same club).
+
+**`Family`** + **`FamilyMembership`** — households, tenant-scoped. `FamilyMembership` carries
+a `FamilyRole` (`parent` / `child` / `guardian` / `other`), `unique_together (family,
+member)`; `Family.guardians` / `Family.children` are role-derived querysets. Powers the
+"parents see their children's data" object-scope (§3.1).
+
+### `club`
+
+**`Club`** — **the tenant root** (§2.4). Currently just `name`; extend with `slug` (unique,
+drives subdomain/path resolution), contact, and branding. Provide `Club.objects.current()`
+and resolve it in middleware — never hardcode a PK.
+
+**`ClubMembership`** — links a `Member` to the `Club` with a `license` string. **Being made
+season-scoped** (§5.1): it gains a `season` FK and sign-up / fee-status fields, so each row
+is one member's affiliation for one season (`unique_together (club, member, season)`). This
+is the record the `MEMBER` role and shop fulfilment key off of (§3.4, §5.7).
+
+---
+
+## 5. Planned models (design)
+
+Field lists below are **sketches** to implement against, not final migrations.
+
+All sketches below are tenant-scoped: aggregate roots inherit **`ClubScopedModel`** (the
+`club` FK is shown implicitly and every listed `unique_together` is *within a club*, §2.4).
+
+### 5.1 `Season` — the central organizing concept  *(app: `club`)*
+
+Everything time-bound hangs off a season. Rosters, events, and attendance are
+**season-scoped via FK** — never global state. Seasons are **per club** — each club runs
+its own.
+
+```
+Season(ClubScopedModel)              # -> carries `club`
+  name        CharField           # e.g. "2025–2026"
+  start_date  DateField
+  end_date    DateField
+  is_current  BooleanField        # exactly one true PER CLUB; enforce in save()/service
+  Meta: unique_together (club, name); ordering = ["-start_date"]; get_latest_by = "start_date"
+```
+
+- Provide `Season.objects.current()` (scoped to the current club, §2.4) rather than
+  scattering `is_current=True` filters.
+- Referenced by `Team`, `Event`, and `ClubMembership`. Use `on_delete=PROTECT` on those
+  FKs — deleting a season with data should be blocked.
+
+**Season-scoped `ClubMembership`** (evolution of the built model, §4):
+
+```
+ClubMembership(ClubScopedModel)      # -> carries `club`
+  member       FK Member (CASCADE, related_name="club_memberships")
+  season       FK Season (PROTECT, related_name="memberships")
+  license      CharField (blank)        # federation license for that season
+  status       CharField (TextChoices: pending | active | lapsed | cancelled)
+  fee_status   CharField (TextChoices: unpaid | partial | paid | waived)
+  signed_up_at DateTimeField (null)     # when the member registered for the season
+  activated_at DateTimeField (null)     # when membership became active (usually on payment)
+  Meta: unique_together (club, member, season); ordering = ["-season__start_date", ...]
+```
+
+- One row per member **per season** — sign-up and fee payment are tracked independently
+  each season. `unique_together` moves from `(club, member)` → `(club, member, season)`
+  (a data migration must backfill existing rows with the current season).
+- `fee_status` is the **source of truth for whether dues are paid**; it is driven by the
+  shop (§5.7) — a paid membership `Order` flips `fee_status → paid` and `status → active`.
+  Keep it denormalized here (fast to query "who hasn't paid") but only mutate it through a
+  service that reconciles against `Payment`s, never by hand.
+- `status = active` (for the club's current season) is the fact that grants the member's
+  user the `MEMBER` `ClubRole` (§3.4).
+
+### 5.2 `teams`
+
+```
+Team(ClubScopedModel)              # -> carries `club`
+  season      FK Season (PROTECT, related_name="teams")
+  name        CharField           # "U12 A"
+  age_group   CharField (choices, optional)
+  Meta: unique_together (season, name); ordering = ["season", "name"]
+
+TeamMembership(UUIDModel)          # roster entry — through model, club/season implied by team
+  team        FK Team (CASCADE, related_name="roster")
+  member      FK Member (CASCADE, related_name="team_memberships")
+  position    CharField (TextChoices, optional)
+  jersey_number PositiveSmallIntegerField (null=True)
+  Meta: unique_together (team, member);
+        UniqueConstraint(team, jersey_number) WHERE jersey_number IS NOT NULL
+
+StaffAssignment(UUIDModel)         # coach / manager on a team, per season
+  team        FK Team (CASCADE, related_name="staff")
+  member      FK Member (CASCADE, related_name="staff_assignments")
+  role        CharField (TextChoices: coach | assistant | manager)
+  Meta: unique_together (team, member, role)
+```
+
+A `Member` plays on one *or more* `Team`s per season, each with its own position + jersey
+number — modeled by `TeamMembership`, exactly matching the domain note.
+
+- **Jersey numbers are unique within a team** (decision §7 #4): a partial
+  `UniqueConstraint(fields=["team", "jersey_number"], condition=~Q(jersey_number=None))`.
+  Nullable so a roster spot can exist before a number is assigned; `NULL`s are exempted so
+  several unnumbered entries don't collide. `team` already implies club + season, so no
+  extra tenancy field is needed on the constraint.
+- `StaffAssignment` drives the coach/manager object-scope (§3.1–3.2) — it *is* the "is a
+  coach of this team" fact; no `ClubRole` mirrors it.
+
+### 5.3 `events`
+
+```
+Event(ClubScopedModel)             # -> carries `club`
+  season      FK Season (PROTECT, related_name="events")
+  team        FK Team (SET_NULL, null=True, related_name="events")   # null = club-wide
+  kind        CharField (TextChoices: training | match | tournament | social | meeting)
+  title       CharField
+  location    CharField (blank)
+  starts_at   DateTimeField
+  ends_at     DateTimeField (null=True)
+  opponent    CharField (blank)    # for matches
+  Meta: ordering = ["starts_at"]
+
+Attendance(UUIDModel)              # through model Event <-> Member
+  event       FK Event (CASCADE, related_name="attendances")
+  member      FK Member (CASCADE, related_name="attendances")
+  status      CharField (TextChoices: present | absent | excused | maybe)
+  note        CharField (blank)
+  Meta: unique_together (event, member)
+```
+
+`Event.season` is redundant with `team.season` when a team is set, but events can be
+club-wide (`team=None`), so `season` stays a first-class FK. Keep it consistent in a
+service/clean().
+
+**As built, `Attendance` also carries `showed_up`** (nullable bool, default `None`) —
+deliberately separate from `status`: `status` is the RSVP, `showed_up` is whether they
+actually turned up, set by a check-in. `None` means "never checked in" (true for every
+row today — there's no check-in UI yet, only Django admin); a "no-show" is
+`status in (present, selected)` and `showed_up is False`, and is *never* inferred from
+a missing check-in. See `events/services/attendance.py::record_check_in` and
+`management/views.py::TeamDetailView`'s attendance panel.
+
+### 5.4 `news`, `pages`, `home` (public site / editorial)
+
+**`news` is built** (as of the coach_manager-authoring / editor-release-flow work) —
+team-tagged instead of categorised, with a two-step release flow rather than a bare
+`is_published` flag:
+
+```
+news.News(ClubScopedModel)         # -> carries `club`
+  title, slug (SlugField, auto from title), body (TextField)
+  teams       M2M teams.Team (blank -- empty means club-wide)
+  visibility  CharField (TextChoices: internal | external | both)
+  status      CharField (TextChoices: draft | published)
+  published_at DateTimeField (null) -- may be in the future: a *scheduled* release,
+                                       not a cron-flipped field (see below)
+  created_by  FK members.Member (SET_NULL, null, related_name="news_items")
+  Meta: unique_together (club, slug); ordering = ["-created"]
+
+news.NewsPhoto(UUIDModel)          # club reached via news_item, not directly scoped
+  news_item   FK news.News (CASCADE, related_name="photos")
+  image       ImageField
+  is_main     BooleanField
+  ordering    PositiveSmallIntegerField
+  Meta: UniqueConstraint(fields=["news_item"], condition=Q(is_main=True))
+        -- a partial unique index enforcing "at most one main photo per item"
+        at the DB level, the same trick teams.Position uses for
+        management_position_implies_staff_position.
+
+pages.Page(ClubScopedModel)        # flat CMS pages: "About", "Contact", ...
+  title, slug, body (TextField)
+  is_published BooleanField; menu_order (int)
+  Meta: unique_together (club, slug)
+  # If nested navigation is needed, add: parent = FK self (SET_NULL, null)
+
+home.HomeConfig(ClubScopedModel)   # one row PER CLUB: featured articles/teams, hero content
+                                   # (unique_together (club,) — one per tenant). May be config-only.
+```
+
+- **Authoring vs. releasing are deliberately separate authorities**
+  (`club/services/access.py::can_add_news`/`can_publish_news`/`can_edit_news`): any
+  current-season coach_manager (management-position `StaffAssignment`), EDITOR, or
+  ADMIN can draft a `News` item and edit it while it's a draft; only EDITOR/ADMIN can
+  move it to `published` (or edit it once it is) — a physio or plain staff member can't
+  post news, and a coach_manager can't push their own draft live.
+- **Scheduling needs no cron job.** `published_at` can be set in the future; `status`
+  already reads `PUBLISHED` (it passed the editor's release gate) but `News.is_scheduled`
+  is true until that moment passes. A later public/member-facing consumer just filters
+  `status=PUBLISHED, published_at__lte=now()` — nothing has to flip a row at the
+  scheduled instant.
+- **`created_by` links to `members.Member`** (decision §7 #5) — attribution is to a
+  club person, not a raw login; `SET_NULL` so deleting a member doesn't erase their posts.
+- `slug`s back clean public URLs and feed `search`; they are **unique per club** (§2.4), so
+  two clubs can both have `/news/season-kickoff`. Resolve within the request's club.
+- `visibility` (internal/external/both) is stored and enforced nowhere yet — no
+  member-facing reading page or public API exists. Both are later work; the field is
+  there so they don't need a backfill when they land.
+- `NewsPhoto.image` / hero images use `ImageField` → **media storage must be configured**
+  (§8). If page/news trees grow, consider a tree library later — start flat.
+
+### 5.5 `search`
+
+Likely **no models** — a search view over `Article`, `Page`, `Team`, `Event`. If moving to
+Postgres full-text or an external index, add config here, not domain tables.
+
+### 5.6 `formbuilder` — dynamic forms  *(new app)*
+
+Admins/editors define forms with a **variable number of fields** at runtime; submissions
+are stored so they can be **reported on** later. This uses the classic EAV (entity-
+attribute-value) shape with **normalized `Answer` rows as the single source of truth**
+(decision §7 #9) — one row per answered field, with a JSON `value` to stay flexible across
+field types. No parallel JSON blob on the submission — reporting reads `Answer`s directly.
+
+```
+Form(ClubScopedModel)                 # -> carries `club`
+  title, slug, description (blank)
+  is_active      BooleanField
+  login_required BooleanField        # members-only vs public submission
+  opens_at / closes_at  DateTimeField (null)   # optional submission window
+  max_submissions_per_user  PositiveInteger (null)   # null = unlimited
+  Meta: unique_together (club, slug); ordering = ["title"]
+
+Field(UUIDModel)                      # a form's field definition (club implied by form)
+  form       FK Form (CASCADE, related_name="fields")
+  key        SlugField               # stable machine name, unique per form (for reporting)
+  label      CharField
+  field_type CharField (TextChoices: text | textarea | number | email | date |
+                                     choice | multichoice | checkbox | file)
+  required   BooleanField
+  help_text  CharField (blank)
+  order      PositiveSmallIntegerField
+  is_active  BooleanField (default=True)   # soft-retire instead of deleting (see below)
+  options    JSONField (default=list) # choices for choice/multichoice: [{value,label}]
+  Meta: unique_together (form, key); ordering = ["form", "order"]
+
+Submission(UUIDModel)                 # container only — no answer data on it
+  form         FK Form (CASCADE, related_name="submissions")
+  member       FK Member (SET_NULL, null)   # set when submitter is logged in
+  submitted_at DateTimeField
+  Meta: ordering = ["-submitted_at"]
+
+Answer(UUIDModel)                     # CANONICAL store — one per answered field
+  submission FK Submission (CASCADE, related_name="answers")
+  field      FK Field (PROTECT, related_name="answers")
+  value      JSONField                # scalar, list (multichoice), or file ref
+  Meta: unique_together (submission, field)
+```
+
+Design notes:
+- **`Answer` is canonical; there is no denormalized JSON snapshot.** A submission's values
+  are always read/aggregated from its `Answer` rows. The submit service
+  (`formbuilder/services/submit.py`) validates the dynamic form and writes the `Submission`
+  + its `Answer`s in one transaction. (If a flat per-submission view ever becomes a
+  hotspot, add a *derived, rebuildable* cache later — but the model stays the source.)
+- **`Field.key` is immutable once submissions exist** — reporting joins on it. Deleting a
+  field with answers is blocked (`PROTECT`); **retire via `is_active=False`** instead.
+- **Reporting** = a service/view producing per-field aggregates (counts per choice,
+  numeric averages, response rate) plus a wide CSV/Excel export (one column per field,
+  one row per submission). No extra model needed; add a saved-report model later only if
+  users need to persist report definitions.
+- Rendering a `Form` to a Django form (and validating a submission) is a service concern —
+  build the form class dynamically from `Field` rows; don't hand-write form classes.
+
+### 5.7 `shop` — cart, orders, payments & PDF invoices  *(new app)*
+
+A cart-like shop where a member (or parent) "buys" products — chiefly a **season
+membership** — with payment-status tracking and generated invoices. Fulfilment of a
+membership product writes back to the season-scoped `ClubMembership` (§5.1).
+
+```
+Product(ClubScopedModel)              # -> carries `club`
+  name, slug, description (blank)
+  kind        CharField (TextChoices: membership | event_fee | merchandise | donation)
+  price       DecimalField(max_digits=8, decimal_places=2)   # list price
+  season      FK Season (PROTECT, null)   # set for membership/event products
+  is_active   BooleanField
+  # early-bird / prompt-payment discount (§5.7.1) — per-product toggle + deadline
+  early_bird_enabled    BooleanField (default=False)
+  early_bird_deadline   DateField (null)                  # discount valid through this date (inclusive)
+  early_bird_disc_type  CharField (TextChoices DiscountType: PERCENT | AMOUNT, blank)
+  early_bird_disc_value DecimalField(max_digits=8, decimal_places=2, null)  # 0–100 if PERCENT, else € off unit
+  Meta: unique_together (club, slug)
+        CheckConstraint: early_bird_enabled ⇒ deadline, disc_type, disc_value all set
+  # membership products fulfil into a ClubMembership for the chosen season + beneficiary
+
+Cart(ClubScopedModel)                 # -> carries `club`; one open cart per (club, user)
+  user        FK User (CASCADE, related_name="carts")
+  status      CharField (TextChoices: open | checked_out | abandoned)
+  Meta: UniqueConstraint(club, user) WHERE status = open
+
+CartItem(UUIDModel)                   # club implied by cart
+  cart        FK Cart (CASCADE, related_name="items")
+  product     FK Product (PROTECT)
+  beneficiary FK Member (PROTECT, null)   # who this membership is FOR (parent buys for child)
+  quantity    PositiveSmallIntegerField (default=1)
+  unit_price  DecimalField               # snapshot of price at add-to-cart time
+  Meta: unique_together (cart, product, beneficiary)
+
+Order(ClubScopedModel)                # -> carries `club`; created `pending` at checkout,
+                                      # frozen at finalize() (§5.7.1 lifecycle)
+  number      CharField                  # human ref, allocated PER CLUB, e.g. "ORD-2026-00042"
+  purchaser   FK Member (PROTECT, related_name="orders")
+  status      CharField (TextChoices: pending | finalized | paid | partially_paid | cancelled | refunded)
+  subtotal    DecimalField               # Σ OrderLine.line_total (after per-line early-bird)
+  # order-level discounts are SELECTED from a club catalogue, not typed — see AppliedDiscount
+  # below + OrderDiscountType (§5.7.1); applied by a treasurer while status=pending.
+  total       DecimalField               # subtotal - Σ applied discounts; the amount invoiced
+  created_at  DateTimeField
+  finalized_at DateTimeField (null)
+  Meta: unique_together (club, number); ordering = ["-created_at"]
+
+OrderLine(UUIDModel)                  # club implied by order
+  order       FK Order (CASCADE, related_name="lines")
+  product     FK Product (PROTECT)
+  beneficiary FK Member (PROTECT, null)
+  quantity    PositiveSmallIntegerField
+  list_price  DecimalField               # catalogue unit price at checkout (snapshot)
+  unit_price  DecimalField               # price actually charged after per-line early-bird (snapshot)
+  discount_label CharField (blank)        # e.g. "Early bird (−15%)" — shown on invoice; blank = none
+  line_total  DecimalField               # unit_price * quantity
+  fulfilled_at DateTimeField (null)       # when this line's ClubMembership was activated
+
+Payment(UUIDModel)                    # club implied by order; an order may have several (partial)
+  order       FK Order (CASCADE, related_name="payments")
+  amount      DecimalField
+  method      CharField (TextChoices: bank_transfer | cash | card | online)
+  status      CharField (TextChoices: pending | confirmed | failed | refunded)
+  reference   CharField (blank)          # bank/gateway reference
+  paid_at     DateTimeField (null)
+
+OrderDiscountType(ClubScopedModel)    # -> carries `club`; club-defined catalogue of presets
+  name        CharField                  # "Sibling discount", "Volunteer", "Hardship"
+  slug        SlugField
+  disc_type   CharField (TextChoices DiscountType: PERCENT | AMOUNT)
+  value       DecimalField(max_digits=8, decimal_places=2)   # 0–100 if PERCENT, else € off subtotal
+  description CharField (blank)          # optional note shown to the treasurer
+  is_active   BooleanField (default=True)   # soft-retire; keeps historical AppliedDiscounts valid
+  Meta: unique_together (club, slug); ordering = ["name"]
+
+AppliedDiscount(UUIDModel)            # through: Order <-> OrderDiscountType; club implied by order
+  order         FK Order (CASCADE, related_name="discounts")
+  discount_type FK OrderDiscountType (PROTECT, related_name="applications")
+  # snapshot at apply time — the preset may be edited/retired later without altering past orders
+  label       CharField                  # snapshot of name (shown on invoice)
+  disc_type   CharField (PERCENT | AMOUNT)   # snapshot
+  value       DecimalField               # snapshot (or a treasurer override, if allowed)
+  applied_by  FK User (SET_NULL, null, related_name="+")
+  applied_at  DateTimeField
+  Meta: unique_together (order, discount_type)   # a preset toggles on/off once per order
+
+Invoice(ClubScopedModel)              # -> carries `club`
+  number      CharField                  # sequential PER CLUB per year, e.g. "INV-2026-00042"
+  order       OneToOneField Order (PROTECT, related_name="invoice")
+  issued_at   DateTimeField
+  due_date    DateField (null)
+  billing_snapshot JSONField             # name/address frozen at issue time
+  pdf         FileField (null)           # rendered HTML->PDF, cached in PRIVATE storage (§8)
+  Meta: unique_together (club, number)
+```
+
+Flow & design notes:
+- **Cart → checkout → order.** Checkout converts the open `Cart` into an immutable `Order`
+  + `OrderLine`s, snapshotting prices (products may reprice later). The cart is marked
+  `checked_out`. All in one transactional service (`shop/services/checkout.py`).
+- **Payment status is derived, not typed by hand.** A service sums `confirmed` `Payment`s
+  and sets `Order.status` (`pending` → `partially_paid` → `paid`). Online payments arrive
+  via a gateway webhook that creates/confirms a `Payment`; manual methods
+  (bank transfer/cash) are confirmed by a `TREASURER` (§3.2).
+- **Fulfilment writes back to membership.** When an order (or a membership line) reaches
+  `paid`, a service creates/activates the `ClubMembership(member=beneficiary, season=…)`,
+  flips its `fee_status → paid` / `status → active`, stamps `OrderLine.fulfilled_at`, and
+  triggers role reconciliation (§3.4). This is the seam that ties the shop to the domain.
+- **Beneficiary vs. purchaser** is first-class: a parent (`purchaser`) buys memberships for
+  several children (`beneficiary`) in one order. Both are `Member`s of the same club.
+- **Invoice = HTML → PDF.** Render a Django template to HTML, convert with **WeasyPrint**
+  (see §8 for the exact dependency + native-library setup). Generate on order confirmation,
+  store the file on `Invoice.pdf` in **private** storage, and serve it only through a
+  permission-checked view (never a public media URL — invoices are tenant-private, §8).
+  `Invoice.number` uses a gap-free counter **per club per year** — allocate it in a
+  transaction/service (e.g. a `select_for_update` sequence row), not from `count()`.
+- **Money = `DecimalField`**, never float. Snapshot prices onto cart items / order lines /
+  invoices so historical records stay correct when `Product.price` changes.
+
+#### 5.7.1 Discounts
+
+Two independent discount mechanisms, applied at different layers and computed by a single
+**pricing service** (`shop/services/pricing.py`) so the rules live in one place and never
+in views/templates. A shared `DiscountType` enum (`PERCENT` / `AMOUNT`) is reused by both.
+
+**A. Early-bird / prompt-payment discount — per `Product`, automatic.**
+A club toggles `early_bird_enabled` on a product, sets an `early_bird_deadline`, and a
+`PERCENT` or `AMOUNT` value (§5.7 `Product`). Semantics: *buy in time and the unit price
+drops.*
+- **Anchor = checkout date (recommended).** The discount is evaluated **once, at checkout**,
+  comparing the order's `created_at` date against the deadline, and the result is frozen into
+  `OrderLine.unit_price` (+ a human `discount_label`, with `list_price` preserved for
+  transparency). This keeps the order/invoice total firm — an invoice can't have a
+  conditional amount. To still reward *paying* early, set the membership `Invoice.due_date`
+  to the deadline; late non-payment is a dunning concern, not a repricing one.
+- **Alternative (payment-date anchor)** — the discount only sticks if a confirmed `Payment`
+  lands by the deadline, else the line reprices to `list_price`. This makes the total mutable
+  until the deadline and complicates invoicing; it's the literal reading of "paid before
+  date" but is deferred unless a club needs it (see open question, §7).
+- Only applies when `today <= early_bird_deadline`; otherwise the line charges `list_price`.
+  A `CheckConstraint` guarantees an enabled product has a deadline + type + value.
+
+**B. Order-level discount — selected from a club catalogue of presets.**
+Rather than typing a type + value + reason per order, each club **defines named presets once**
+as `OrderDiscountType` rows (e.g. *Sibling discount −15%*, *Volunteer −€25*, *Hardship*),
+managed under the club's shop settings. On a `pending` order a `TREASURER`/`BOARD` (§3.2)
+simply **toggles the applicable presets on** — each toggle creates an `AppliedDiscount` row.
+No arithmetic is entered at order time; the treasurer picks from a list.
+- **Snapshot, like prices.** `AppliedDiscount` copies the preset's `label` / `disc_type` /
+  `value` at apply time. Editing or retiring (`is_active=False`) an `OrderDiscountType` later
+  never rewrites past orders — historical totals stay correct. `PROTECT` on the FK means a
+  used preset can't be hard-deleted; retire it instead.
+- **Multiple discounts stack** — several presets can apply to one order (a preset toggles on
+  at most once, via `unique_together (order, discount_type)`). See stacking rule below.
+- **Optional override.** The default flow enters *zero* numbers. If a club needs a one-off
+  amount (e.g. a bespoke hardship figure), allow the treasurer to override the snapshot
+  `value` on that `AppliedDiscount` — an opt-in escape hatch, not the primary path. A pure
+  ad-hoc discount is then just a generic "Custom" preset with an overridden value.
+- **Lifecycle refinement.** Discounts force the order to be *editable before it freezes*:
+  checkout creates the order as **`pending`**; a treasurer toggles presets on/off while
+  `pending`; `finalize()` then locks the order + its `AppliedDiscount`s, computes the final
+  `total`, allocates the `Invoice.number`, and issues the PDF. **After `finalize` everything
+  is immutable** — a correction means a credit/refund, not an edit. Gated by
+  `can_manage_shop(user, club)`.
+
+**Computation & rounding (both kinds).**
+`total = subtotal − Σ applied_discounts`, where `subtotal = Σ line_total` and each
+`line_total` already reflects the early-bird price. Order of application: **line-level
+early-bird first, then all order-level presets**, each computed against the **same
+`subtotal` base** (percentages don't compound on each other — predictable and order-
+independent) and summed. Percentages compute on their base, round **`ROUND_HALF_UP` to 2
+decimals**; the **summed** order discount is **clamped to `[0, subtotal]`** so an order can
+never go negative. Every discounted document (order summary, invoice) itemises each applied
+discount by `label` plus the net so members see how the number was reached.
+
+**Extension point.** `OrderDiscountType` is the reusable catalogue for the two required cases.
+Coupon *codes* (member-entered), auto-applied promotions (rule-based, e.g. "3+ siblings"), or
+per-member entitlements would extend this — add an eligibility rule / code field or an
+auto-apply service on top of the same model when that need is real, rather than a parallel
+mechanism.
+
+---
+
+## 6. Entity-relationship overview
+
+```
+Club  (TENANT ROOT — every model below except User carries `club`; §2.4)
+  └─< Season, Member, Family, Team, Event, ClubRole, Article, Page, Form, Product, Order, Invoice, …
+
+User 1───<  Member  (FK, unique per club)      # User is GLOBAL — no club FK
+              │  └───< FamilyMembership >─── Family
+              │  └───< ClubRole            (MEMBER | EDITOR | TREASURER | BOARD)
+              │
+              ├───< ClubMembership ──> Season        (unique: club, member, season)
+              │
+              ├───< TeamMembership >─── Team ───> Season
+              ├───< StaffAssignment >─── Team          (= "coach of this team", §3.2)
+              │
+              ├───< Attendance >─── Event ───> Season
+              │                      └───> Team (nullable)
+              │
+              ├───< Submission >─── Form ───< Field    (Submission ──< Answer >── Field)
+              │
+              └── (purchaser) ──< Order ───< OrderLine >── Product ──> Season
+                                  │            └──> Member (beneficiary)
+                                  ├──< Payment
+                                  ├──< AppliedDiscount >── OrderDiscountType (club preset)
+                                  └─1:1─ Invoice   (Cart ──< CartItem >── Product)
+
+Season ──< Team, Event, ClubMembership, (membership/event) Product   # all within one club
+
+news.Article ──> news.Category,  (author) members.Member
+pages.Page  (self-parent, optional)
+```
+
+Legend: `───<` one-to-many, `>───<` many-to-many via a through model. Everything under
+`Club` is one tenant's data; joins never cross clubs (§2.4).
+
+---
+
+## 7. Decisions (resolved) & remaining questions
+
+**Resolved** (this revision):
+
+1. ✅ **`members` app split** — Member/Family/FamilyMembership **move to a dedicated
+   `members` app** (§1, §4). Migration reshuffles app labels + tables.
+2. ✅ **Season-scoped `ClubMembership`** — yes (§5.1). Data migration backfills existing
+   rows with the current season and re-scopes `unique_together`.
+3. ✅ **Full multi-tenancy** — adopt **row-based multi-tenancy**, `Club` as tenant root
+   (§2.4). Requires: `ClubScopedModel` on every aggregate root, `Member.user` →
+   `ForeignKey` (+`unique(club, user)`), tenant middleware + `rosterchief/tenancy.py`
+   context, tenant-aware manager, per-club uniqueness, per-club roles (§3). **Supersedes
+   `CLAUDE.md`.**
+4. ✅ **Jersey uniqueness** — unique **within a team** via a partial `UniqueConstraint`
+   (`NULL`s exempt) (§5.2).
+5. ✅ **`Article.author`** — links to `members.Member` (§5.4).
+6. ✅ **RBAC mechanism** — **service layer**, no `django-guardian`; per-club `ClubRole`
+   rows + a single access service (§3). Django's own perms only for platform admin.
+7. ✅ **`formbuilder` storage** — **normalized `Answer` is canonical**; no denormalized JSON
+   snapshot (§5.6).
+8. ✅ **Tenant resolution ≠ `django.contrib.sites`** — Sites evaluated and rejected as the
+   mechanism; `Club` stays the single tenant root, resolution in `ClubTenantMiddleware`
+   (§2.4). Sites optional only as a later bridge for Site-aware third parties.
+9. ✅ **Shop discounts** — two mechanisms (§5.7.1): a per-`Product` early-bird discount
+   (toggle + deadline + PERCENT/AMOUNT, frozen at checkout) and **order-level discounts
+   selected from a club catalogue of `OrderDiscountType` presets** — a treasurer toggles
+   presets on a `pending` order (each = a snapshotting `AppliedDiscount` row) before
+   `finalize()`, rather than typing values. Presets stack against the same subtotal base;
+   optional per-row value override for one-offs. Adds an `Order.pending → finalized` step.
+
+Infrastructure/config for the above (media storage, dependencies + exact setup) is
+specified in **§8**.
+
+**Still open:**
+
+- **Tenant resolution mechanism** — subdomain (recommended) vs. path-prefix `/c/<slug>/`.
+  Affects DNS/TLS, `ALLOWED_HOSTS`, cookies, and local dev (§8). Pick before building
+  `ClubTenantMiddleware`. **`django.contrib.sites` was evaluated and rejected as the
+  mechanism** (§2.4) — `Club` stays the single tenant root; Sites is optional only as a
+  bridge for Site-aware third parties.
+- **Auto-scoping vs. explicit scoping** — should the tenant manager filter *automatically*
+  from context, or stay explicit (`.for_club()` / `.current()`)? Doc currently recommends
+  **explicit** (§2.4).
+- **Cross-club users** — can one person be a `BOARD` member of several clubs, switching
+  context in one session? The model allows it; confirm the UX (club switcher) is in scope.
+- **Payment gateway** — which provider (Mollie / Stripe / none-yet)? Only needed when online
+  payments go live (§8).
+- **Early-bird anchor** — is the discount earned by *ordering* before the deadline
+  (checkout-date anchor, recommended, frozen total) or by *paying* before it (payment-date
+  anchor, mutable total)? Doc implements checkout-date; confirm no club needs the literal
+  "paid before date" semantics (§5.7.1).
+
+---
+
+## 8. Infrastructure & configuration notes
+
+Config required by the models above — settings + dependencies to add as each app lands.
+
+### 8.1 Media & file storage (needed for `news`, `home`, `shop`, form file fields)
+
+Two classes of files with **different exposure**:
+
+- **Public media** — `Article.cover_image`, home hero images. Served from the normal media
+  URL is fine.
+- **Private, tenant-scoped files** — `Invoice.pdf` and `formbuilder` file uploads. These
+  **must not** be publicly reachable. Serve them only through a permission-checked Django
+  view (`X-Accel-Redirect`/`X-Sendfile` in prod), never a guessable public URL, and scope
+  access to the file's club (§2.4).
+
+Setup:
+- **Dev:** `MEDIA_ROOT`/`MEDIA_URL` on local disk; private files under a non-served path.
+- **Prod:** object storage (S3-compatible) via **`django-storages`** (add to deps) with
+  **separate public and private buckets/backends** (Django 5.1+ `STORAGES` setting). Keep
+  the private backend non-public and generate signed/short-lived URLs or stream via the view.
+- Organise keys by club (e.g. `club/<club_id>/invoices/…`) so tenant data is easy to
+  isolate, audit, and delete.
+
+### 8.2 HTML → PDF invoices — WeasyPrint
+
+- Add the dependency: `uv add weasyprint`.
+- **Native libraries required** (WeasyPrint wraps Pango/Cairo) — install at the OS/image
+  level, not via pip:
+  - macOS (dev): `brew install pango gdk-pixbuf libffi` (Cairo/GLib come along).
+  - Debian/Ubuntu (CI + prod image): `apt-get install libpango-1.0-0 libpangocairo-1.0-0
+    libcairo2 libgdk-pixbuf-2.0-0 libffi-dev` (exact names per distro/WeasyPrint version).
+  - Document these in the Dockerfile/CI so PDF rendering isn't a "works on my machine" trap.
+- Render a Django template → HTML string → `weasyprint.HTML(string=…).write_pdf()`; store
+  onto `Invoice.pdf` (private storage, §8.1). Generation is a service, ideally async/queued
+  if volume grows.
+
+### 8.3 Tenancy runtime config (needed once `ClubTenantMiddleware` lands)
+
+- **Hosts:** wildcard `ALLOWED_HOSTS` for the chosen base domain (e.g. `.rosterchief.app`)
+  if using subdomain resolution; add `DJANGO_ALLOWED_HOSTS` accordingly.
+- **CSRF:** `CSRF_TRUSTED_ORIGINS` must cover the wildcard scheme+host set
+  (`https://*.rosterchief.app`).
+- **Cookies:** to share login across club subdomains, set `SESSION_COOKIE_DOMAIN` /
+  `CSRF_COOKIE_DOMAIN` to the base domain; otherwise keep per-subdomain sessions
+  (decide with the "cross-club users" question in §7).
+- **Local dev:** map a wildcard to localhost (e.g. `*.localhost` resolves on most systems,
+  or use `dnsmasq`) so subdomain resolution works without editing `/etc/hosts` per club.
+- **Middleware order:** place `ClubTenantMiddleware` after `AuthenticationMiddleware`
+  (needs `request.user` to fall back to a user's default club when no subdomain is present).
+
+### 8.4 Optional dependencies
+
+- **Payment gateway** (only if online payments): provider SDK (e.g. `mollie-api-python` or
+  `stripe`) + webhook endpoint that creates/confirms `Payment`s (§5.7).
+- **Excel export** for form reporting beyond CSV: `openpyxl`.
+
+---
+
+*Conventions cross-reference:* `rosterchief/base.py` (`UUIDModel`, `ClubScopedModel`),
+`rosterchief/tenancy.py` (*to add* — tenant context/middleware, §2.4),
+`authentication/managers.py` (`UserManager`), `authentication/services/` (service-layer
+pattern).
+
+---
+
+> ### ⚠️ Banner: supersedes `CLAUDE.md`
+>
+> This architecture adopts **full multi-tenancy** (§2.4), which **directly contradicts**
+> the current `CLAUDE.md` ("RosterChief is a **single-club** app … deliberately *not*
+> multi-tenant — there is no `club_id` tenancy") and the project memory
+> (`project_overview` — "Single-club (NOT multi-tenant)").
+>
+> **Action required** before/alongside implementation: update `CLAUDE.md` and the memory
+> to describe RosterChief as a **multi-tenant platform (row-based, `Club` = tenant root)**.
+> Until that is done, where the two disagree **this document is authoritative**.
diff --git a/ARCHITECTURE.pdf b/ARCHITECTURE.pdf
new file mode 100644
index 0000000..c9c9ae1
Binary files /dev/null and b/ARCHITECTURE.pdf differ
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..f63f0b4
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,59 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+RosterChief is a sport club management app + public website, built on **Django 6.0** (Python 3.14+). As of **2026-07-11 it is designed as a multi-tenant platform** (row-based / shared-schema): one deployment serves many clubs, with `Club` as the tenant root. Every club-owned model carries a `club` FK (via `ClubScopedModel`); `User` is the only global model. This **reverses** the project's earlier single-club stance — treat older "single-club / no `club_id` tenancy" notes (in git history or memory) as obsolete.
+
+**`ARCHITECTURE.md` at the repo root is the authoritative model & domain design** — the tenancy mechanics, the RBAC design, and per-app model sketches all live there. Consult and update it when adding domain models.
+
+The repo is an early build: `authentication` and `club` apps exist (`User`, `Member`, `Family`, `FamilyMembership`, `Club`, `ClubMembership`); the remaining domain apps and the tenancy plumbing (`rosterchief/tenancy.py`, tenant middleware, `ClubScopedModel` upgrade) are **planned, not yet on disk**. Verify against the actual tree before assuming a module exists.
+
+## Commands
+
+Dependencies and the virtualenv are managed with **uv** (`pyproject.toml` at repo root, `uv.lock` committed). Run Django/tools through `uv run` so the project venv is used.
+
+```bash
+uv sync                              # install deps (incl. dev group) into .venv
+uv run python manage.py runserver    # dev server
+uv run python manage.py migrate      # apply migrations
+uv run python manage.py makemigrations
+uv run python manage.py createsuperuser
+uv run python manage.py shell
+
+uv run python manage.py test                     # run all tests (Django test runner)
+uv run python manage.py test <app>               # one app
+uv run python manage.py test <app>.tests.<Case>  # one TestCase
+uv run python manage.py test <app>.tests.<Case>.<method>  # one test
+
+uv run ruff check .                  # lint
+uv run ruff check --fix .            # lint + autofix
+uv run ruff format .                 # format
+```
+
+## Configuration
+
+Settings live in a single `rosterchief/settings.py` and read from the environment via **python-decouple** (`config(...)`), with a local `.env` file for dev. Key vars: `DJANGO_SECRET_KEY` (required), `DJANGO_DEBUG`, `DJANGO_ALLOWED_HOSTS`, `DJANGO_CSRF_TRUSTED_ORIGINS`, `DJANGO_DATABASE_URL`, `DJANGO_TIME_ZONE`.
+
+The database is configured through a single `DJANGO_DATABASE_URL` (parsed by **dj-database-url**), defaulting to `sqlite:///db.sqlite3` for dev; production is intended to point at PostgreSQL via that URL. Don't hardcode DB settings — go through the env var.
+
+## Planned architecture
+
+**`ARCHITECTURE.md` is the source of truth for the model design; this is a summary.** The app decomposition (`authentication`, `members`, `club`, `teams`, `events`, `news`, `pages`, `home`, `formbuilder`, `shop`, `search`) has grown past the original `pyproject.toml` isort `known-first-party` list — add new labels there as apps land. Note the `accounts` app was split into `authentication` (global login) + `club`, and people models (`Member`, `Family`) are being moved into a dedicated `members` app.
+
+Domain notes (drive modeling decisions):
+- **Multi-tenancy is the cross-cutting rule.** `Club` is the tenant root; club-owned models inherit `ClubScopedModel` (a `club` FK). Scope every query to the current tenant (`.for_club()` / `.current()`); previously-global uniqueness (slugs, season names, invoice numbers) becomes **unique per club**. Only `User` is global. See `ARCHITECTURE.md` §2.4.
+- **Season** is the central organizing concept, **per club**. Team rosters, events, and attendance are season-scoped — model them with a FK to a season, not as global state.
+- A **Member** (a person *within one club*) can play on one or more **Teams**, each with a position + jersey number (unique within a team), always tied to a specific season.
+- **RBAC is per-club and service-layer** (not `django-guardian`, not global Django groups): `ClubRole` rows (`MEMBER` / `EDITOR` / `TREASURER` / `BOARD`) plus object-scoped roles (coach via `StaffAssignment`, parent via `FamilyMembership`), all decisions routed through an access service. Django's own permissions are used only for the platform-admin layer.
+- Later modules: `formbuilder` (admin-defined dynamic forms → normalized answers → reporting) and `shop` (cart → order → payment → HTML→PDF invoices via WeasyPrint), with season-scoped `ClubMembership` tracking sign-up + fee status per season.
+
+## Conventions
+
+- Ruff config anticipates a Wagtail-style codebase (`DJ` Django rules; `RUF012`/`RUF005` ignored for framework idioms; `line-length = 250`). Migrations are excluded from linting — don't hand-edit them to satisfy ruff.
+- Settings files are exempt from `F403/F405/E501` (star imports allowed) under `rosterchief/settings/*` — note the config expects a settings *package*, though the current code is a single `settings.py`. If you split settings, match that path.
+- **Every user-facing string must be translatable** (`USE_I18N = True`; no `.po` files exist yet, but the codebase is kept translation-ready as it's written, not audited later). This applies to templates, models, forms, and views alike:
+  - Templates: `{% load i18n %}`, then `{% trans "..." %}` for literal text and `{% blocktrans %}...{% endblocktrans %}` for text containing a variable (bind filter chains to a plain name first via `{% blocktrans with x=some.filtered|value %}`, or `{% blocktrans count counter=n %}...{% plural %}...{% endblocktrans %}` for pluralized counts — never hand-roll pluralization with `|pluralize`, real languages have more than two plural forms). Covers headings, buttons, table headers, empty-state text, `placeholder=`/`aria-label=` attributes — not URL names, CSS classes, icon names, `dom_id` arguments, or raw data interpolated on its own.
+  - Python (models, forms, views, services): `from django.utils.translation import gettext_lazy as _`, wrapping `verbose_name`, `help_text`, `Meta.verbose_name(_plural)`, form field `label`/`help_text`, `TextChoices`/`IntegerChoices` labels (never the choice *value*), and any user-facing string built in a method/view (`notify()` messages, raised `ValidationError`/`ValueError` text, dict labels rendered directly in a template).
+  - Never bake an interpolated value directly into a translatable string (an f-string with `{variable}` *inside* the translated text) — word order isn't guaranteed to survive translation. Use `%(name)s` placeholders instead: `_("“%(name)s” updated.") % {"name": obj}`. This matters most for `controlpanel.messages.notify(request, spec)`, whose `"<level>|<title>|<body>"` spec is assembled via f-string — translate the title and body as separate `_()`/`%()` expressions, then drop the already-resolved strings into the f-string skeleton.
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
new file mode 100644
index 0000000..e9526ae
--- /dev/null
+++ b/DEPLOYMENT.md
@@ -0,0 +1,615 @@
+# Deploying RosterChief
+
+One server today, several later, with no code changes in between — only environment
+variables. This document is the runbook and, more usefully, the list of things that are
+specific to *this* app and will bite you if you treat it as a generic Django deploy.
+
+## The five things that make this deployment unusual
+
+**1. You need a wildcard TLS certificate, and that forces DNS-01.**
+Tenancy is subdomain-based (`ajax.rosterchief.app`), so the certificate must cover
+`*.rosterchief.app`. Let's Encrypt **will not issue a wildcard over HTTP-01** — only over
+DNS-01, which means the TLS terminator needs API access to your DNS zone. That is why
+`deploy/caddy/Dockerfile` builds Caddy *with* a DNS provider plugin, and why
+`CLOUDFLARE_API_TOKEN` is a required variable rather than a nicety. Swap the plugin
+(`caddy-dns/route53`, `caddy-dns/digitalocean`, …) if your DNS lives elsewhere.
+
+DNS needs two records, both pointing at the server:
+
+```
+A   rosterchief.app    -> <server ip>
+A   *.rosterchief.app  -> <server ip>
+```
+
+**2. Redis is not optional, even on one server.**
+`waffle` caches each feature flag's targeting in the Django cache, and `LocMemCache` is
+private to a single process. Under several gunicorn workers, toggling a feature in the
+control panel flushes **one** worker's cache while the others keep serving the stale flag —
+a feature that "sometimes doesn't turn on". A shared cache is the fix.
+
+**3. `SECURE_PROXY_SSL_HEADER` must be set, and Caddy must send the header.**
+Caddy terminates TLS, so without it Django believes every request is plain HTTP:
+`request.is_secure()` goes false, WebAuthn disagrees with the browser about the origin, and
+`SECURE_SSL_REDIRECT` becomes a redirect loop. Both halves are already wired (settings +
+`header_up X-Forwarded-Proto`); don't remove either.
+
+**4. Uploads must move to object storage before the second app server.**
+Club logos go to `MEDIA_ROOT` on local disk by default. `compose.yaml` mounts a `media_data`
+volume, shared read-write with `web` and read-only with `caddy`, so uploads both survive a
+rebuild and get served by Caddy directly (`handle_path /media/*` in the Caddyfile) rather than
+round-tripping through a gunicorn worker. `rosterchief/urls.py` still serves `/media/*` itself
+as a fallback whenever `AWS_STORAGE_BUCKET_NAME` is unset — needed for `compose.behind-proxy.yaml`
+(no bundled Caddy there) and for `runserver`. On two boxes local disk stops working regardless
+of any of this: a logo uploaded to node A is still a 404 on node B, since nothing shares the
+volume between them. Setting `AWS_STORAGE_BUCKET_NAME` switches the default storage to S3 — do
+it *before* you scale, not during.
+
+**5. PDF invoices need native libraries.**
+WeasyPrint binds to pango/cairo. The image installs them; a bare-metal deploy would need
+them too, and a Mac needs Homebrew. This is the main reason to run the container even in
+development if you touch invoicing.
+
+## First deploy
+
+```bash
+# 1. Configure
+cp .env.compose.example .env                 # read by docker compose
+cp .env.production.example .env.production   # read by Django
+python -c "import secrets; print(secrets.token_urlsafe(64))"   # -> DJANGO_SECRET_KEY
+
+# 2. Build and start
+docker compose build
+docker compose up -d db redis
+docker compose run --rm web python manage.py migrate
+docker compose run --rm web python manage.py createsuperuser
+docker compose up -d
+
+# 3. Verify
+curl -fsS https://rosterchief.app/healthz          # {"status": "ok", ...}
+docker compose run --rm web python manage.py check --deploy
+```
+
+`check --deploy` is what catches an env file that forgot the HTTPS flags: they default to
+**off** in code, because defaulting them to `not DEBUG` would redirect every test request to
+https and break the suite anywhere `DEBUG` is unset.
+
+### Keep DJANGO_DEBUG=False, even on the test server
+
+A test box is still a deployment: it is behind TLS, on a real domain, with real passkeys.
+`DEBUG=True` there leaks tracebacks and settings to anyone who can reach a 500, and turns off
+several of the protections in this document. Use it locally, not on a server.
+
+The app no longer *crashes* if you set it — `django_browser_reload` is a dev dependency that
+the image installs with `--no-dev`, so settings guard on the module being importable rather
+than assuming DEBUG implies it is there — but the reason to keep it off is not the crash.
+
+### One dependency comes from git
+
+`django-lucide` is our fork (`[tool.uv.sources]` in `pyproject.toml`, pinned by `uv.lock` to a
+commit), so **uv shells out to `git`** to fetch it. `python:*-slim` has no git, which is why
+the image builds the virtualenv in a **separate stage** that installs git, and copies the
+finished `.venv` into a runtime stage that does not have it — a build tool has no business in
+a production image.
+
+Two consequences worth knowing:
+
+- The build needs **network access to GitHub**, and the fork must stay reachable. If that ever
+  becomes awkward (a private runner, an air-gapped build), publish the fork to a private index
+  or vendor the wheel, and the git stage disappears.
+- `uv.lock` pins the exact commit, so the build is reproducible even though the source is a
+  branch. Don't build with `--no-frozen`.
+
+The first `docker compose up` will take a minute or two: Caddy is provisioning the wildcard
+certificate over DNS-01, and DNS propagation is not instant. Watch it with
+`docker compose logs -f caddy`.
+
+## Migrations
+
+Deliberately **not** run by the container's entrypoint. With more than one web container they
+would race, and a starting gunicorn worker is a bad place to discover a failed migration.
+Run them once, explicitly, as part of the deploy:
+
+```bash
+docker compose build
+docker compose run --rm web python manage.py migrate
+docker compose up -d --no-deps web
+```
+
+## Scheduled jobs
+
+Three commands need to run on a schedule. Put them on the **host**, not in a container, and on
+**exactly one node** when you have several — three nodes archiving the same club is three
+emails to the same club.
+
+```cron
+# Bill: archive clubs unpaid past their grace period.
+# Run it WITHOUT --commit for the first week and read the output. The flag exists because
+# this switches off paying customers: a bad clock or a bad cron should cost you an email,
+# not a morning of angry clubs.
+0 6 * * *  cd /srv/rosterchief && docker compose run --rm web python manage.py archive_overdue_clubs --commit
+
+# Events: extend recurring series so the calendar never runs dry.
+0 3 * * *  cd /srv/rosterchief && docker compose run --rm web python manage.py extend_event_series
+
+# Seasons: generate the next 2 years ahead for every active club. Safe to run repeatedly and
+# needs no --commit — unlike archiving or resyncing, creating a future season row is additive
+# and idempotent, so a monthly cadence just keeps every club's season list from ever running
+# out. --resync exists on the same command for removing seasons that no longer match a club's
+# settings, but that can delete rows, so it isn't run unattended here.
+0 5 1 * *  cd /srv/rosterchief && docker compose run --rm web python manage.py generate_seasons
+```
+
+## Maintenance mode
+
+Control panel → **Features → Maintenance mode**. While it is on:
+
+- every **club subdomain** serves a 503 maintenance page, in that club's own colours;
+- the **control panel and the sign-in screens stay open**, because closing them would leave
+  you with no way to turn it back off;
+- `/healthz` keeps answering on every host, or the load balancer would take the node out of
+  rotation and the control panel with it;
+- the **scheduled jobs stand down** — `archive_overdue_clubs`, `extend_event_series` and
+  `import_members_csv` refuse to run.
+
+`migrate` and `collectstatic` are deliberately **not** blocked. Maintenance is usually
+declared *in order* to run them, and a guard that stopped them would mean turning the mode
+off to do the work you turned it on for.
+
+The scheduled jobs exit **non-zero** while the platform is closed, so cron will mail you.
+That is intended: a job that silently skips itself is how a month of billing goes missing. If
+you genuinely mean to run one during a window, pass `--ignore-maintenance`.
+
+So a migration-heavy deploy looks like:
+
+```bash
+# 1. Close the platform in the control panel (or from a shell):
+docker compose run --rm web python manage.py shell -c \
+  "from features.models import Maintenance; Maintenance.start(message='Upgrading. Back by 21:00.')"
+
+# 2. Do the work — migrate is not blocked.
+docker compose build
+docker compose run --rm web python manage.py migrate
+docker compose up -d --no-deps web
+
+# 3. Reopen from the control panel.
+```
+
+The state lives in Redis as well as the database, so it takes effect on **every worker and
+every server at once** — a per-process cache would leave some workers still serving clubs.
+
+## Behind an existing Caddy (dev / test server)
+
+If the box already runs Caddy on :80 and :443 — a test server sharing a host with other
+sites — do **not** run ours: two Caddies cannot both hold port 80. Run the app only, publish
+it on the loopback, and add a site block to the Caddy that is already there.
+
+```bash
+docker compose -f compose.behind-proxy.yaml up -d          # web + db + redis, no caddy
+```
+
+`web` publishes on `127.0.0.1:8001` (override with `WEB_PORT`). **Loopback, not 0.0.0.0** —
+bound to all interfaces, a test instance is reachable at `http://<server-ip>:8001` with no
+TLS, bypassing the proxy and every security header with it.
+
+Then add a site block to the host's Caddyfile. Caddy serves any number of domains on the same
+ports — TLS is chosen per connection by SNI — so a second (or tenth) site is just another
+block.
+
+### If that Caddy already does Cloudflare DNS-01
+
+Which is the usual case: the box has a domain on Cloudflare and Caddy already has the DNS
+plugin. Then set the challenge **once, globally**, and every site inherits it — no `tls`
+block per site, and wildcards simply work:
+
+```caddy
+{
+	email you@example.com
+
+	# Applies DNS-01 to every site below.
+	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+}
+
+# --- whatever the box already serves --------------------------------------
+existing-thing.example.com {
+	reverse_proxy 127.0.0.1:3000
+}
+
+# --- RosterChief test instance --------------------------------------------
+# The bare host AND the wildcard, on one certificate.
+test.rosterchief.app, *.test.rosterchief.app {
+	encode zstd gzip
+
+	reverse_proxy 127.0.0.1:8001 {
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Real-IP {remote_host}
+	}
+}
+```
+
+### If the two domains need different tokens
+
+Different Cloudflare accounts, or tokens scoped per zone. Drop `acme_dns` and give each site
+its own `tls`; a snippet keeps it short:
+
+```caddy
+{
+	email you@example.com
+}
+
+(cf) {
+	tls {
+		dns cloudflare {args[0]}
+	}
+}
+
+existing-thing.example.com {
+	import cf {env.CF_TOKEN_EXAMPLE}
+	reverse_proxy 127.0.0.1:3000
+}
+
+test.rosterchief.app, *.test.rosterchief.app {
+	import cf {env.CF_TOKEN_ROSTERCHIEF}
+	reverse_proxy 127.0.0.1:8001 {
+		header_up X-Forwarded-Proto {scheme}
+	}
+}
+```
+
+### What actually goes wrong
+
+1. **The token must cover the *new* zone.** A Cloudflare token is scoped to named zones, and
+   an existing one almost certainly grants `Zone:DNS:Edit` on the domain it was made for and
+   nothing else. The new site then fails its DNS-01 challenge on a permissions error whose
+   text does not say so. Widen the token, or mint a second one and use the snippet form.
+2. **Both hostnames must be listed.** `*.test.rosterchief.app` does **not** match
+   `test.rosterchief.app` — a wildcard covers exactly one label. Leave the bare host out and
+   the club subdomains have a certificate while the control panel does not. Hence the comma.
+   (Wildcards are also only one level deep: `ajax.test.…` yes, `a.b.test.…` no.)
+3. **Caddy must have the DNS plugin.** Stock `caddy` cannot answer a DNS-01 challenge at all.
+   `caddy add-package github.com/caddy-dns/cloudflare`, or run a Caddy built like
+   `deploy/caddy/Dockerfile`. (If DNS-01 already works on the box, you have it.)
+4. **The token must be in *Caddy's* environment**, not your shell's — `{env.…}` reads the
+   process it runs in:
+
+   ```ini
+   # /etc/systemd/system/caddy.service.d/override.conf
+   [Service]
+   EnvironmentFile=/etc/caddy/caddy.env     # CLOUDFLARE_API_TOKEN=...
+   ```
+
+   Then `systemctl daemon-reload && systemctl restart caddy`.
+
+5. **`header_up X-Forwarded-Proto` is not optional**, exactly as in the bundled Caddyfile:
+   without it Django believes the request behind the proxy is plain HTTP.
+
+6. **Give the test instance its own subdomain tree** and set
+   `ROSTERCHIEF_BASE_DOMAIN=test.rosterchief.app`. That variable drives tenant resolution,
+   the shared session cookie *and* the WebAuthn RP ID — point it at the production domain and
+   test passkeys start colliding with real ones.
+
+### Applying and checking it
+
+```bash
+caddy validate --config /etc/caddy/Caddyfile   # syntax and modules
+systemctl reload caddy                          # zero downtime; existing certs untouched
+journalctl -u caddy -f                          # watch the DNS-01 challenge
+
+curl -I https://test.rosterchief.app/healthz
+curl -I https://any-club-slug.test.rosterchief.app/   # proves the WILDCARD, not just the host
+```
+
+Reloading provisions only what is new, so the existing site's certificate is not reissued.
+Allow 30–60s for the DNS record to propagate before the challenge completes.
+
+DNS needs both records, pointing at the test box:
+
+```
+A   test.rosterchief.app    -> <server ip>
+A   *.test.rosterchief.app  -> <server ip>
+```
+
+The compose project is named `rosterchief-test`, so its containers and volumes never collide
+with a production stack on the same host.
+
+### Deploying with one command
+
+Once the server has the repo cloned at `/home/bernard/RosterChief` and its two env files in
+place, `deploy/deploy-dev.sh` does a full deploy over SSH:
+
+```bash
+deploy/deploy-dev.sh            # deploy the current branch
+BRANCH=main deploy/deploy-dev.sh
+deploy/deploy-dev.sh --push     # push the branch first, then deploy
+```
+
+It runs from your machine and does the work on the server in one SSH session: fetch the pushed
+branch (a hard reset to `origin/<branch>`, since a deploy target only receives deploys), build
+the image, run migrations *explicitly*, restart only `web`, and wait for `/healthz`.
+
+It refuses to deploy a branch whose local commits are not pushed — the server pulls from git,
+so unpushed work would ship stale code silently. Override the host, user, directory or branch
+with the `SSH_HOST` / `SSH_USER` / `REMOTE_DIR` / `BRANCH` environment variables.
+
+First-time setup on the server, once:
+
+```bash
+git clone git@git.siebens.org:bernard/RosterChief.git /home/bernard/RosterChief
+cd /home/bernard/RosterChief
+cp .env.compose.example .env             # fill in POSTGRES_PASSWORD etc.
+cp .env.production.example .env.production
+# then add the reverse_proxy site block to the host's Caddy (see above)
+```
+
+## Automated backups
+
+`deploy/backup.sh` dumps the database, tars the uploads while they are still on local disk,
+prunes anything older than `KEEP_DAYS`, and — if you set `BACKUP_REMOTE` — copies the lot off
+the box with rclone.
+
+```bash
+deploy/backup.sh /var/backups/rosterchief
+```
+
+It writes to a `.part` file and only moves it into place once `gzip -t` says the archive is
+readable and non-empty. A truncated dump that *looks* like a backup is the failure mode worth
+engineering against, because you only discover it on the day you need it.
+
+Schedule it as root on the host (single server; on several, run it on the database node):
+
+```cron
+# Nightly at 02:30, before the billing and event jobs.
+30 2 * * *  cd /srv/rosterchief && BACKUP_REMOTE=b2:rosterchief-backups KEEP_DAYS=14 deploy/backup.sh /var/backups/rosterchief
+
+# Weekly restore rehearsal into a throwaway database. This is the only line here that proves
+# the others work.
+0 4 * * 0   cd /srv/rosterchief && deploy/restore-check.sh
+```
+
+Cron mails you on non-zero exit, and the script uses `set -Eeuo pipefail` so it *does* exit
+non-zero. A backup script that fails quietly is worse than none, because you will believe you
+have backups.
+
+**Offsite matters more than frequency.** A dump sitting on the same disk as the database
+survives a bad migration but not the server. `BACKUP_REMOTE` takes any rclone remote (S3,
+Backblaze, a second box).
+
+**Once uploads move to S3** (`AWS_STORAGE_BUCKET_NAME`), the script skips the media tarball:
+the bucket's own versioning is the backup. Turn versioning on when you create it.
+
+### Restoring
+
+```bash
+gunzip -c /var/backups/rosterchief/db-2026-07-14-0230.sql.gz \
+  | docker compose exec -T db psql -U rosterchief rosterchief
+```
+
+The dump is taken with `--clean --if-exists`, so it drops and recreates rather than colliding
+with what is there. Rehearse it once, now, against a scratch database — not the first time you
+need it.
+
+## Backups (manual)
+
+Two things carry state: Postgres and the uploads.
+
+```bash
+# Database
+docker compose exec -T db pg_dump -U rosterchief rosterchief | gzip > rosterchief-$(date +%F).sql.gz
+
+# Uploads — until they are on S3, in which case the bucket's own versioning is the backup.
+docker compose cp web:/app/media ./media-backup
+```
+
+Restore is `gunzip -c dump.sql.gz | docker compose exec -T db psql -U rosterchief rosterchief`.
+Test it once, now, rather than the first time you need it.
+
+## Sizing the server
+
+For **1–5 clubs, ~1000 members, ~10 events per club per week**.
+
+The short answer: **2 vCPU, 4 GB RAM, 40 GB SSD** — a €4–6/month VPS (Hetzner CX22 or
+equivalent). The interesting part is *why*, because the data is not what sizes this box.
+
+### The data is negligible
+
+Row counts for that workload, from the actual schema (attendance dominates: every event
+invites a squad, so one event is ~20 rows):
+
+| table | rows/year | MB/year |
+|---|---:|---:|
+| `events.Attendance` | 52,000 | 16 |
+| `events.Event` | 2,600 | 2 |
+| `formbuilder` answers | 10,000 | 3 |
+| `shop` orders + lines | 3,000 | 1 |
+| members, memberships, rosters | ~3,000 | 1 |
+| **total, with WAL and bloat** | | **~40 MB/year** |
+
+That is **0.2 GB after five years**. Uploads are club logos — a handful of files. Invoices are
+rendered on demand and never stored. Nothing here grows into a problem.
+
+So do not size for the data. Size for the **processes**.
+
+### What actually consumes the box
+
+Measured, running this app under gunicorn with `DEBUG=False`, before the tuning below —
+`--workers 3`, no `--preload`, Postgres and Redis on their image defaults:
+
+| | memory |
+|---|---|
+| gunicorn master + 3 workers | **~270 MB** (~54 MB per worker) |
+| PostgreSQL (default `shared_buffers`) | ~200–400 MB |
+| Redis (cache only) | < 50 MB |
+| Caddy | ~30 MB |
+| OS + Docker daemon | ~400 MB |
+| **steady state** | **~1.0–1.2 GB** |
+
+Since then, `Dockerfile`/`compose.yaml` were tuned for smaller boxes: `--workers 2 --preload`
+(one fewer duplicated Django process, and `--preload` shares immutable memory across workers
+via copy-on-write instead of each worker importing Django independently), plus trimmed Postgres
+`shared_buffers`/`max_connections` and a Redis `--maxmemory` cap. Expect the gunicorn and
+Postgres rows to come in lower than above — not yet re-measured, so treat the table as the
+shape of where memory goes rather than exact numbers on the current config.
+
+2 GB would run it. 4 GB is the recommendation for three reasons, all of which are the kind of
+thing that bites at the worst moment:
+
+1. **`docker compose build` is the memory spike, not serving.** npm, uv and `collectstatic`
+   together will OOM a 2 GB box that is also running Postgres. Either take the 4 GB, or build
+   the image elsewhere and pull it.
+2. **Rendering an invoice loads WeasyPrint.** It is imported lazily (which is why the workers
+   measure 54 MB and not 150), so pango and its fonts land in whichever worker renders a PDF —
+   expect that worker to grow by ~50–100 MB the first time someone downloads an invoice.
+3. **Headroom is Postgres's page cache.** With 200 MB of data and 4 GB of RAM, the entire
+   database lives in cache and the disk is never touched for reads.
+
+### Disk
+
+| | |
+|---|---|
+| Docker images (app ~1 GB with pango, postgres, redis, caddy) | ~1.5 GB |
+| Build cache | 2–4 GB |
+| Database, 5 years | < 0.5 GB |
+| Backups: 14 daily compressed dumps | < 0.5 GB |
+| Logs | ~1 GB |
+| **40 GB is roomy; 20 GB works** | |
+
+### CPU and concurrency
+
+2 vCPU. Three workers × four threads is twelve concurrent requests, against a peak of "the
+whole club checks the Saturday line-up at 09:00" — perhaps a few hundred requests over a few
+minutes. This workload is not CPU-bound; the one CPU-heavy operation is PDF rendering, which
+happens a handful of times a month.
+
+### When to grow
+
+Not at "more members" — at these:
+
+- **Uploads become real content** (photo galleries, documents). Media, not rows, is what makes
+  storage grow, and it is also the trigger for moving to S3.
+- **Attendance passes a few million rows** (~20 clubs at this rate, i.e. several years out).
+  Add an index before adding a server.
+- **You want zero-downtime deploys.** That is a second app node, not a bigger one.
+
+## For fun: three nodes on AWS
+
+Wildly over-engineered for 1000 members, but here is what it looks like — and what it costs.
+
+### The layout
+
+```
+Route 53 (rosterchief.app + *.rosterchief.app)
+        |
+   ACM certificate (wildcard, free)
+        |
+Application Load Balancer  (TLS terminates here)
+        |
+   +----+----+----+
+   |         |    |
+ ECS task  task  task        3 × Fargate, one per AZ, same image
+   |         |    |
+   +----+----+----+
+        |
+   +----+---------------+----------------+
+   |                    |                |
+ RDS PostgreSQL   ElastiCache Redis    S3 (media)
+ (Multi-AZ)       (cache.t4g.micro)    + CloudFront (optional)
+```
+
+**The one genuinely nice thing AWS gives you here: ACM issues the wildcard certificate for
+free, with DNS validation in Route 53.** The whole DNS-01 dance disappears — no Caddy plugin,
+no API token, no renewal. The ALB terminates TLS and forwards to the tasks. That is the single
+biggest simplification versus the VPS.
+
+### What changes in the app
+
+Nothing in the code. Only environment:
+
+| | |
+|---|---|
+| `DJANGO_DATABASE_URL` | the RDS endpoint |
+| `DJANGO_REDIS_URL` | the ElastiCache endpoint |
+| `AWS_STORAGE_BUCKET_NAME` | the media bucket — **required** now, three nodes cannot share a disk |
+| `SECURE_PROXY_SSL_HEADER` | already set; the ALB sends `X-Forwarded-Proto` |
+| health check | point the target group at **`/healthz`** — that is what it is for |
+
+Sessions are database-backed, so **no sticky sessions**: any task can serve any request.
+
+**Scheduled jobs get better here.** EventBridge Scheduler firing a one-off ECS task solves the
+"run it on exactly one node" problem properly — no cron on three boxes racing each other:
+
+```
+EventBridge (cron: 0 6 * * ? *) -> ECS RunTask -> archive_overdue_clubs --commit
+```
+
+Backups become RDS automated snapshots + PITR, and `deploy/backup.sh` retires — though the
+*restore rehearsal* does not. Snapshots you have never restored are still a hypothesis.
+
+### Monthly cost (eu-central-1, on-demand, indicative)
+
+| | | $/month |
+|---|---|---:|
+| ALB | fixed + a little LCU | ~22 |
+| ECS Fargate | 3 × (0.5 vCPU, 1 GB) | ~54 |
+| RDS PostgreSQL | `db.t4g.micro`, 20 GB gp3, single-AZ | ~17 |
+| ElastiCache | `cache.t4g.micro` | ~12 |
+| S3 + CloudFront | a few GB, low traffic | ~2 |
+| Route 53 | hosted zone + queries | ~1 |
+| ECR, CloudWatch logs | small | ~3 |
+| | **single-AZ total** | **~110** |
+| RDS Multi-AZ | doubles the database | +17 |
+| | **highly-available total** | **~130** |
+
+**Watch the NAT Gateway.** If the tasks sit in private subnets and reach the internet through
+a NAT Gateway, add **~$32/month per AZ plus data charges** — for three AZs that is more than
+the compute. Either put the tasks in public subnets with tight security groups, or use VPC
+endpoints for ECR/S3/CloudWatch. It is the single most common surprise on an AWS bill of this
+shape.
+
+Prices are indicative and move; check the calculator before committing.
+
+### The honest comparison
+
+| | | |
+|---|---|---|
+| **Hetzner CX22** | 2 vCPU, 4 GB, 40 GB | **~€5/month** |
+| **AWS, three nodes** | as above | **~$110–130/month** |
+
+Roughly **25×**, for a workload whose database is 200 MB after five years. What the money buys
+is real — managed Postgres with PITR, three AZs, no box to patch, free wildcard certificates —
+but it is bought for *resilience*, not for capacity. At 1000 members you are paying for the
+insurance, not the compute.
+
+A reasonable middle: one VPS now, and move Postgres to a managed service (RDS, or a €15/month
+managed Postgres) the day the data starts to matter more than the uptime. That is the change
+that is painful to do late, and everything else in this document is already designed for it.
+
+## Going multi-server
+
+Nothing in the code changes. What changes is where the services live:
+
+| | one server | several |
+|---|---|---|
+| Postgres | `db` container | `DJANGO_DATABASE_URL` → your central Postgres |
+| Cache / flags | `redis` container | managed Redis (or your existing one) |
+| Uploads | local disk | **S3 bucket** (`AWS_STORAGE_BUCKET_NAME`) |
+| Static files | WhiteNoise, in the image | unchanged — that is why WhiteNoise is there |
+| Cron | host crontab | one node only |
+| TLS | Caddy on the box | load balancer, or Caddy on each node |
+
+Drop `db` and `redis` from `compose.yaml`, point the URLs at the central services, and run
+`web` on as many nodes as you like behind a load balancer pointed at `/healthz`.
+
+The health check tests the database *and* a cache round trip, not just that the process is
+listening — a node that cannot reach Postgres, or whose cache silently swallows writes, is
+not healthy, and a load balancer must not keep feeding it traffic.
+
+## Rollback
+
+Images are the unit of rollback. Tag on build, keep the last few, and:
+
+```bash
+docker compose up -d --no-deps web   # with the previous image tag
+```
+
+Migrations are the exception: they don't roll back with the image. Prefer additive migrations
+(add a column, deploy, backfill, then stop writing the old one) so that yesterday's image
+still runs against today's schema.
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..d300434
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,109 @@
+# syntax=docker/dockerfile:1
+
+# --- 1. the stylesheet -------------------------------------------------------
+# Tailwind is a build-time concern: the CSS it emits is committed, but building it here means
+# the image never depends on someone having remembered to run `npm run build`.
+FROM node:22-slim AS css
+
+WORKDIR /build
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY assets ./assets
+COPY templates ./templates
+COPY controlpanel ./controlpanel
+COPY billing ./billing
+RUN npm run build
+
+
+# --- 2. the virtualenv -------------------------------------------------------
+# Separate from the runtime for one reason: django-lucide is a *git* dependency (our lucide
+# fork), so uv shells out to git to fetch it. python:*-slim has no git, and installing it in
+# the runtime image would leave a build-time tool — plus its dependency tree — in production
+# for the sake of one package that is already vendored into the venv by then.
+FROM python:3.14-slim AS venv
+
+RUN apt-get update && apt-get install --no-install-recommends -y git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# Dependencies first: they change far less often than the code, so this layer caches.
+COPY pyproject.toml uv.lock ./
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev --no-install-project
+
+
+# --- 3. the runtime ----------------------------------------------------------
+FROM python:3.14-slim AS app
+
+# WeasyPrint binds to these at import: no pango, no invoices. This is also why building the
+# PDF path in a container is easier than on a Mac — apt has what Homebrew would have to.
+RUN apt-get update && apt-get install --no-install-recommends -y \
+        libpango-1.0-0 \
+        libpangoft2-1.0-0 \
+        libharfbuzz0b \
+        libffi8 \
+        libjpeg62-turbo \
+        libopenjp2-7 \
+        shared-mime-info \
+        curl \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    # gunicorn 26's control server puts a socket in $HOME. The app user has no home dir, so
+    # without this it logs "Permission denied: /home/rosterchief" on every boot. /app is
+    # already the workdir and owned by the app user, so point HOME there.
+    HOME="/app"
+
+WORKDIR /app
+
+# The venv arrives fully built. Same base image, so the compiled wheels inside it are ABI
+# compatible; nothing is re-resolved here, and no git is needed to run what git fetched.
+COPY --from=venv /app/.venv ./.venv
+
+COPY . .
+COPY --from=css /build/static/css/app.css ./static/css/app.css
+
+# collectstatic needs a settings module that imports: a throwaway key, never used at runtime.
+RUN DJANGO_SECRET_KEY=build-only-not-a-secret \
+    DJANGO_STATICFILES_BACKEND=whitenoise.storage.CompressedManifestStaticFilesStorage \
+    python manage.py collectstatic --noinput
+
+# mkdir before chown, and before the volume ever mounts: media_data has nothing to copy from
+# at /app/media otherwise, so Docker creates the mount point itself, owned by root — and the
+# app runs as rosterchief, not root. Existing image content (even an empty, correctly-owned
+# dir) is what a named volume copies its initial ownership from on first use.
+RUN useradd --system --uid 1000 rosterchief \
+    && mkdir -p /app/media \
+    && chown -R rosterchief /app
+USER rosterchief
+
+EXPOSE 8000
+
+# Migrations are NOT run here. With more than one app container they would race, and a failed
+# migration inside a starting web process is a bad place to find out — deploy runs them once,
+# explicitly (see DEPLOYMENT.md).
+# 2 workers, not 3: DEPLOYMENT.md's own sizing says this workload isn't CPU-bound, and each
+# worker duplicates a full Django process — the single biggest lever on a memory-limited box.
+# --preload imports the app once in the master and forks workers via copy-on-write instead of
+# each re-importing Django independently (safe here: no app's ready() touches DB/Redis eagerly,
+# checked club/features/news/events). --max-requests recycles a worker periodically so the one
+# that happens to render a WeasyPrint invoice doesn't carry that +50-100MB forever.
+CMD ["gunicorn", "rosterchief.wsgi:application", \
+     "--bind", "0.0.0.0:8000", \
+     "--workers", "2", \
+     "--threads", "4", \
+     "--preload", \
+     "--max-requests", "500", \
+     "--max-requests-jitter", "50", \
+     "--timeout", "60", \
+     "--access-logfile", "-", \
+     "--error-logfile", "-"]
diff --git a/clubmanager/__init__.py b/api/__init__.py
similarity index 100%
rename from clubmanager/__init__.py
rename to api/__init__.py
diff --git a/api/apps.py b/api/apps.py
new file mode 100644
index 0000000..e1d9dc1
--- /dev/null
+++ b/api/apps.py
@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class ApiConfig(AppConfig):
+    name = "api"
+    verbose_name = "Public API"
diff --git a/api/errors.py b/api/errors.py
new file mode 100644
index 0000000..ddd37bc
--- /dev/null
+++ b/api/errors.py
@@ -0,0 +1,17 @@
+"""Shared error helpers for the public API -- see api/urls.py.
+
+Every endpoint is club-scoped via the same subdomain-based tenant resolution
+the rest of the platform uses (club.tenancy.ClubTenantMiddleware sets
+request.club before any view runs). A request with no club on the host --
+the bare base domain, an unknown slug, an archived club -- has nothing to
+serve, so it 404s the same way club.mixins.ClubStaffRequiredMixin already
+404s the staff-facing app off the base domain.
+"""
+
+from ninja.errors import HttpError
+
+
+def require_club(request):
+    if request.club is None:
+        raise HttpError(404, "No club found for this host.")
+    return request.club
diff --git a/api/middleware.py b/api/middleware.py
new file mode 100644
index 0000000..34ef327
--- /dev/null
+++ b/api/middleware.py
@@ -0,0 +1,31 @@
+"""CORS for the public API only.
+
+Every route under /api/v1/ is public, read-only, and unauthenticated -- no
+cookies or credentials are ever involved, so there's no CSRF/session risk in
+answering any origin. That's the whole reason this is a few lines here
+instead of pulling in django-cors-headers for a handful of GET routes: the
+rest of the site keeps Django's ordinary same-origin behaviour untouched.
+"""
+
+from django.http import HttpResponse
+
+API_PATH_PREFIX = "/api/v1/"
+
+
+class PublicApiCorsMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not request.path.startswith(API_PATH_PREFIX):
+            return self.get_response(request)
+
+        if request.method == "OPTIONS":
+            response = HttpResponse(status=204)
+        else:
+            response = self.get_response(request)
+
+        response["Access-Control-Allow-Origin"] = "*"
+        response["Access-Control-Allow-Methods"] = "GET, OPTIONS"
+        response["Access-Control-Allow-Headers"] = "Content-Type"
+        return response
diff --git a/api/tests.py b/api/tests.py
new file mode 100644
index 0000000..5d37276
--- /dev/null
+++ b/api/tests.py
@@ -0,0 +1,451 @@
+import datetime
+
+from django.test import TestCase, override_settings
+from django.utils import timezone
+
+from club.models import Club, Season, Sponsor
+from events.models import Event, Location, Opponent
+from members.models import Member
+from news.models import News, NewsPhoto
+from teams.models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "rival-fc.rosterchief.app", "testserver"],
+)
+class ApiTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today - datetime.timedelta(days=30), end_date=today + datetime.timedelta(days=300))
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+
+    def api_get(self, path, **params):
+        return self.client.get(f"/api/v1{path}", params, HTTP_HOST="ajax-united.rosterchief.app")
+
+    def api_get_base_domain(self, path, **params):
+        return self.client.get(f"/api/v1{path}", params, HTTP_HOST="rosterchief.app")
+
+
+class NewsApiTests(ApiTestBase):
+    def make_news(self, **overrides):
+        defaults = {"club": self.club, "title": "News", "body": "body", "status": News.Status.PUBLISHED, "published_at": timezone.now() - datetime.timedelta(hours=1), "visibility": News.Visibility.EXTERNAL}
+        defaults.update(overrides)
+        return News.objects.create(**defaults)
+
+    def test_a_draft_is_excluded(self):
+        self.make_news(status=News.Status.DRAFT, published_at=None)
+
+        self.assertEqual(self.api_get("/news/").json()["count"], 0)
+
+    def test_a_scheduled_but_not_yet_released_item_is_excluded(self):
+        self.make_news(published_at=timezone.now() + datetime.timedelta(days=1))
+
+        self.assertEqual(self.api_get("/news/").json()["count"], 0)
+
+    def test_an_internal_only_item_is_excluded(self):
+        self.make_news(visibility=News.Visibility.INTERNAL)
+
+        self.assertEqual(self.api_get("/news/").json()["count"], 0)
+
+    def test_an_external_item_is_included(self):
+        item = self.make_news(visibility=News.Visibility.EXTERNAL)
+
+        data = self.api_get("/news/").json()
+
+        self.assertEqual(data["count"], 1)
+        self.assertEqual(data["results"][0]["id"], str(item.pk))
+
+    def test_a_both_visibility_item_is_included(self):
+        self.make_news(visibility=News.Visibility.BOTH)
+
+        self.assertEqual(self.api_get("/news/").json()["count"], 1)
+
+    def test_newest_first(self):
+        older = self.make_news(title="Older", published_at=timezone.now() - datetime.timedelta(days=2))
+        newer = self.make_news(title="Newer", published_at=timezone.now() - datetime.timedelta(hours=1))
+
+        results = self.api_get("/news/").json()["results"]
+
+        self.assertEqual([r["id"] for r in results], [str(newer.pk), str(older.pk)])
+
+    def test_photos_get_absolute_urls(self):
+        item = self.make_news()
+        NewsPhoto.objects.create(news_item=item, image="clubs/ajax-united/news/x/pic.jpg", is_main=True)
+
+        photo = self.api_get("/news/").json()["results"][0]["photos"][0]
+
+        self.assertTrue(photo["url"].startswith("http://ajax-united.rosterchief.app/media/"))
+        self.assertTrue(photo["is_main"])
+
+    def test_pagination_limit_and_offset(self):
+        for i in range(3):
+            self.make_news(title=f"Item {i}", published_at=timezone.now() - datetime.timedelta(hours=1, minutes=i))
+
+        data = self.api_get("/news/", limit=1, offset=1).json()
+
+        self.assertEqual(data["count"], 3)
+        self.assertEqual(len(data["results"]), 1)
+
+    def test_limit_is_capped(self):
+        self.assertEqual(self.api_get("/news/", limit=1000).json()["limit"], 100)
+
+    def test_no_news_is_an_empty_list_not_an_error(self):
+        response = self.api_get("/news/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["results"], [])
+
+
+class TeamsApiTests(ApiTestBase):
+    def setUp(self):
+        super().setUp()
+        self.forward = Position.objects.create(club=self.club, name="Forward", short_name="FW", ordering=1)
+        self.defense = Position.objects.create(club=self.club, name="Defense", short_name="DF", ordering=2)
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+    def test_list_teams(self):
+        data = self.api_get("/teams/").json()
+
+        self.assertEqual(data, [{"id": str(self.team.pk), "name": "First Team", "short_name": "1st", "photo_url": None}])
+
+    def test_roster_groups_players_by_position(self):
+        alice = Member.objects.create(first_name="Alice", last_name="Ash")
+        bob = Member.objects.create(first_name="Bob", last_name="Birch")
+        carol = Member.objects.create(first_name="Carol", last_name="Cedar")
+        # Two forwards (ordering 1) at different jersey numbers, one defense (ordering 2).
+        TeamMembership.objects.create(team=self.team, member=bob, season=self.season, position=self.forward, jersey_number=9)
+        TeamMembership.objects.create(team=self.team, member=alice, season=self.season, position=self.forward, jersey_number=2)
+        TeamMembership.objects.create(team=self.team, member=carol, season=self.season, position=self.defense, jersey_number=1)
+
+        groups = self.api_get(f"/teams/{self.team.pk}/roster/").json()["players"]
+
+        # Groups in Position.ordering order (Forward before Defense); within a
+        # group, sorted by jersey number.
+        self.assertEqual([g["position"] for g in groups], ["Forward", "Defense"])
+        self.assertEqual([p["first_name"] for p in groups[0]["players"]], ["Alice", "Bob"])
+        self.assertEqual([p["first_name"] for p in groups[1]["players"]], ["Carol"])
+
+    def test_a_player_entry_no_longer_repeats_its_position(self):
+        # The position is now the group key, not a per-player field.
+        alice = Member.objects.create(first_name="Alice", last_name="Ash")
+        TeamMembership.objects.create(team=self.team, member=alice, season=self.season, position=self.forward, jersey_number=2)
+
+        player = self.api_get(f"/teams/{self.team.pk}/roster/").json()["players"][0]["players"][0]
+
+        self.assertNotIn("position", player)
+
+    def test_roster_includes_staff(self):
+        dana = Member.objects.create(first_name="Dana", last_name="Dean")
+        StaffAssignment.objects.create(team=self.team, member=dana, season=self.season, position=self.coach_position)
+
+        staff = self.api_get(f"/teams/{self.team.pk}/roster/").json()["staff"]
+
+        self.assertEqual(staff, [{"id": str(dana.pk), "first_name": "Dana", "last_name": "Dean", "position": "Head Coach"}])
+
+    def test_roster_is_current_season_only(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2000, 1, 1), end_date=datetime.date(2000, 12, 31))
+        eve = Member.objects.create(first_name="Eve", last_name="Elm")
+        TeamMembership.objects.create(team=self.team, member=eve, season=other_season, position=self.forward, jersey_number=1)
+
+        players = self.api_get(f"/teams/{self.team.pk}/roster/").json()["players"]
+
+        self.assertEqual(players, [])
+
+    def test_roster_is_empty_with_no_current_season(self):
+        self.season.delete()
+        team_without_season = self.team
+
+        data = self.api_get(f"/teams/{team_without_season.pk}/roster/").json()
+
+        self.assertEqual(data["season"], None)
+        self.assertEqual(data["players"], [])
+        self.assertEqual(data["staff"], [])
+
+    def test_list_teams_includes_the_current_seasons_photo(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        photo_url = self.api_get("/teams/").json()[0]["photo_url"]
+
+        self.assertTrue(photo_url.startswith("http://ajax-united.rosterchief.app/media/"))
+
+    def test_roster_includes_the_current_seasons_photo(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        photo_url = self.api_get(f"/teams/{self.team.pk}/roster/").json()["team"]["photo_url"]
+
+        self.assertTrue(photo_url.startswith("http://ajax-united.rosterchief.app/media/"))
+
+    def test_a_photo_from_a_different_season_does_not_leak(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2000, 1, 1), end_date=datetime.date(2000, 12, 31))
+        TeamPhoto.objects.create(team=self.team, season=other_season, image="clubs/ajax-united/teams/x/00-00/pic.jpg")
+
+        self.assertIsNone(self.api_get("/teams/").json()[0]["photo_url"])
+        self.assertIsNone(self.api_get(f"/teams/{self.team.pk}/roster/").json()["team"]["photo_url"])
+
+    def test_a_team_from_another_club_404s(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_team = Team.objects.create(club=other_club, name="Rival Team", short_name="RIV")
+
+        response = self.api_get(f"/teams/{other_team.pk}/roster/")
+
+        self.assertEqual(response.status_code, 404)
+
+
+class GamesApiTests(ApiTestBase):
+    def setUp(self):
+        super().setUp()
+        self.home_location = Location.objects.create(club=self.club, name="Home Arena", address="1 St", city="Town", zip_code="1000", country="BE", is_home=True)
+        self.opponent = Opponent.objects.create(club=self.club, name="Rivals FC")
+
+    def make_game(self, **overrides):
+        defaults = {"club": self.club, "title": "Game", "kind": Event.EventKind.GAME, "start": timezone.now() + datetime.timedelta(days=1), "opponent": self.opponent}
+        defaults.update(overrides)
+        event = Event.objects.create(**defaults)
+        event.teams.add(self.team)
+        return event
+
+    def test_upcoming_games_are_listed_with_location_and_teams(self):
+        self.make_game(location=self.home_location)
+
+        games = self.api_get("/games/upcoming/").json()
+
+        self.assertEqual(len(games), 1)
+        self.assertEqual(games[0]["home_team"], "First Team")
+        self.assertEqual(games[0]["away_team"], "Rivals FC")
+        self.assertEqual(games[0]["location"]["name"], "Home Arena")
+        self.assertEqual(games[0]["status"], "upcoming")
+
+    def test_upcoming_excludes_cancelled_games(self):
+        self.make_game(cancelled=True)
+
+        self.assertEqual(self.api_get("/games/upcoming/").json(), [])
+
+    def test_upcoming_excludes_past_games(self):
+        self.make_game(start=timezone.now() - datetime.timedelta(days=1))
+
+        self.assertEqual(self.api_get("/games/upcoming/").json(), [])
+
+    def test_upcoming_includes_tournaments(self):
+        self.make_game(kind=Event.EventKind.TOURNAMENT)
+
+        self.assertEqual(len(self.api_get("/games/upcoming/").json()), 1)
+
+    def test_upcoming_excludes_other_kinds(self):
+        self.make_game(kind=Event.EventKind.TRAINING)
+        self.make_game(kind=Event.EventKind.SOCIAL)
+
+        self.assertEqual(self.api_get("/games/upcoming/").json(), [])
+
+    def test_live_endpoint_stays_game_only(self):
+        # is_live/scores are game-specific -- a tournament wouldn't have
+        # anything meaningful to show here even if flagged live.
+        self.make_game(kind=Event.EventKind.TOURNAMENT, start=timezone.now() - datetime.timedelta(minutes=10), is_live=True)
+
+        self.assertEqual(self.api_get("/games/live/").json(), [])
+
+    def test_count_is_respected(self):
+        for i in range(3):
+            self.make_game(start=timezone.now() + datetime.timedelta(days=i + 1))
+
+        self.assertEqual(len(self.api_get("/games/upcoming/", count=2).json()), 2)
+
+    def test_count_is_capped(self):
+        for i in range(3):
+            self.make_game(start=timezone.now() + datetime.timedelta(days=i + 1))
+
+        # Cap is 50, well above the 3 created -- just confirm an oversized
+        # request doesn't error and doesn't somehow exceed what exists.
+        response = self.api_get("/games/upcoming/", count=1000)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(len(response.json()), 3)
+
+    def test_live_games_are_listed_with_scores(self):
+        self.make_game(start=timezone.now() - datetime.timedelta(minutes=10), is_live=True, score_for=2, score_against=1, location=self.home_location)
+
+        games = self.api_get("/games/live/").json()
+
+        self.assertEqual(len(games), 1)
+        self.assertEqual(games[0]["status"], "live")
+        self.assertEqual(games[0]["home_score"], 2)
+        self.assertEqual(games[0]["away_score"], 1)
+
+    def test_live_excludes_cancelled_games(self):
+        self.make_game(is_live=True, cancelled=True)
+
+        self.assertEqual(self.api_get("/games/live/").json(), [])
+
+    def test_non_live_games_are_excluded_from_live_endpoint(self):
+        self.make_game()
+
+        self.assertEqual(self.api_get("/games/live/").json(), [])
+
+    def test_score_relabelling_for_an_away_game(self):
+        # No location (or a non-home one) -- is_home_game is False, so our
+        # team's score_for/score_against map to the away side.
+        self.make_game(start=timezone.now() - datetime.timedelta(days=1), score_for=4, score_against=3)
+
+        games = self.api_get(f"/teams/{self.team.pk}/games/").json()
+
+        self.assertEqual(games[0]["home_team"], "Rivals FC")
+        self.assertEqual(games[0]["away_team"], "First Team")
+        self.assertEqual(games[0]["home_score"], 3)
+        self.assertEqual(games[0]["away_score"], 4)
+        self.assertEqual(games[0]["status"], "finished")
+
+    def test_score_relabelling_for_a_home_game(self):
+        self.make_game(start=timezone.now() - datetime.timedelta(days=1), score_for=4, score_against=3, location=self.home_location)
+
+        games = self.api_get(f"/teams/{self.team.pk}/games/").json()
+
+        self.assertEqual(games[0]["home_team"], "First Team")
+        self.assertEqual(games[0]["away_team"], "Rivals FC")
+        self.assertEqual(games[0]["home_score"], 4)
+        self.assertEqual(games[0]["away_score"], 3)
+
+    def test_team_games_includes_past_and_upcoming_for_the_current_season(self):
+        self.make_game(title="Past", start=timezone.now() - datetime.timedelta(days=1), score_for=1, score_against=0)
+        self.make_game(title="Future", start=timezone.now() + datetime.timedelta(days=1))
+
+        games = self.api_get(f"/teams/{self.team.pk}/games/").json()
+
+        self.assertEqual(len(games), 2)
+
+    def test_team_games_excludes_a_different_season(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2000, 1, 1), end_date=datetime.date(2000, 12, 31))
+        self.make_game(start=datetime.datetime(2000, 6, 1, tzinfo=datetime.UTC), season=other_season)
+
+        self.assertEqual(self.api_get(f"/teams/{self.team.pk}/games/").json(), [])
+
+    def test_team_games_excludes_cancelled(self):
+        self.make_game(cancelled=True)
+
+        self.assertEqual(self.api_get(f"/teams/{self.team.pk}/games/").json(), [])
+
+    def test_team_games_is_empty_with_no_current_season(self):
+        self.make_game()
+        self.season.delete()
+
+        self.assertEqual(self.api_get(f"/teams/{self.team.pk}/games/").json(), [])
+
+    def test_a_team_from_another_club_404s_on_games(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_team = Team.objects.create(club=other_club, name="Rival Team", short_name="RIV")
+
+        response = self.api_get(f"/teams/{other_team.pk}/games/")
+
+        self.assertEqual(response.status_code, 404)
+
+
+class TenancyAndCorsTests(ApiTestBase):
+    def test_the_base_domain_404s(self):
+        response = self.api_get_base_domain("/news/")
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_a_get_response_carries_the_cors_header(self):
+        response = self.api_get("/news/")
+
+        self.assertEqual(response["Access-Control-Allow-Origin"], "*")
+
+    def test_an_options_preflight_gets_a_204_with_cors_headers(self):
+        response = self.client.options("/api/v1/news/", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertEqual(response.status_code, 204)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "*")
+        self.assertIn("GET", response["Access-Control-Allow-Methods"])
+
+    def test_cors_headers_are_not_added_outside_the_api(self):
+        response = self.client.get("/", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertNotIn("Access-Control-Allow-Origin", response)
+
+    def test_docs_page_resolves(self):
+        self.assertEqual(self.api_get("/docs").status_code, 200)
+
+    def test_openapi_schema_resolves(self):
+        self.assertEqual(self.api_get("/openapi.json").status_code, 200)
+
+
+class SponsorApiTests(ApiTestBase):
+    def make_sponsor(self, **overrides):
+        today = timezone.localdate()
+        defaults = {"club": self.club, "name": "Acme Corp", "start_date": today - datetime.timedelta(days=10), "end_date": today + datetime.timedelta(days=10)}
+        defaults.update(overrides)
+        return Sponsor.objects.create(**defaults)
+
+    def test_a_sponsor_covering_today_is_included(self):
+        self.make_sponsor()
+
+        data = self.api_get("/sponsors/").json()
+
+        self.assertEqual(len(data), 1)
+        self.assertEqual(data[0]["name"], "Acme Corp")
+
+    def test_a_sponsor_starting_in_the_future_is_excluded(self):
+        today = timezone.localdate()
+        self.make_sponsor(start_date=today + datetime.timedelta(days=1), end_date=None)
+
+        self.assertEqual(self.api_get("/sponsors/").json(), [])
+
+    def test_a_sponsor_that_already_ended_is_excluded(self):
+        today = timezone.localdate()
+        self.make_sponsor(start_date=today - datetime.timedelta(days=20), end_date=today - datetime.timedelta(days=1))
+
+        self.assertEqual(self.api_get("/sponsors/").json(), [])
+
+    def test_a_sponsor_with_no_end_date_and_a_past_start_is_included(self):
+        today = timezone.localdate()
+        self.make_sponsor(start_date=today - datetime.timedelta(days=100), end_date=None)
+
+        self.assertEqual(len(self.api_get("/sponsors/").json()), 1)
+
+    def test_a_sponsor_starting_today_is_included(self):
+        today = timezone.localdate()
+        self.make_sponsor(start_date=today, end_date=None)
+
+        self.assertEqual(len(self.api_get("/sponsors/").json()), 1)
+
+    def test_a_sponsor_ending_today_is_included(self):
+        today = timezone.localdate()
+        self.make_sponsor(start_date=today - datetime.timedelta(days=10), end_date=today)
+
+        self.assertEqual(len(self.api_get("/sponsors/").json()), 1)
+
+    def test_another_clubs_sponsor_never_leaks_in(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.make_sponsor(club=other_club)
+
+        self.assertEqual(self.api_get("/sponsors/").json(), [])
+
+    def test_logo_url_is_absolute_when_set(self):
+        self.make_sponsor(logo="clubs/ajax-united/sponsors/x/logo.png")
+
+        logo_url = self.api_get("/sponsors/").json()[0]["logo_url"]
+
+        self.assertTrue(logo_url.startswith("http://ajax-united.rosterchief.app/media/"))
+
+    def test_logo_url_is_null_when_not_set(self):
+        self.make_sponsor()
+
+        self.assertIsNone(self.api_get("/sponsors/").json()[0]["logo_url"])
+
+    def test_randomize_returns_the_same_set_of_sponsors(self):
+        for i in range(5):
+            self.make_sponsor(name=f"Sponsor {i}")
+
+        stable = {s["id"] for s in self.api_get("/sponsors/").json()}
+        randomized = {s["id"] for s in self.api_get("/sponsors/", randomize="true").json()}
+
+        self.assertEqual(stable, randomized)
+        self.assertEqual(len(stable), 5)
+
+    def test_default_order_is_stable_and_alphabetical(self):
+        self.make_sponsor(name="Zulu Corp")
+        self.make_sponsor(name="Acme Corp")
+
+        names = [s["name"] for s in self.api_get("/sponsors/").json()]
+
+        self.assertEqual(names, ["Acme Corp", "Zulu Corp"])
diff --git a/api/urls.py b/api/urls.py
new file mode 100644
index 0000000..f6fc8f6
--- /dev/null
+++ b/api/urls.py
@@ -0,0 +1,28 @@
+"""The public read-only API -- see ARCHITECTURE.md and the plan this shipped
+under. Mounted at /api/v1/ (rosterchief/urls.py), club-scoped by the same
+subdomain-based tenant resolution every other view uses
+(club.tenancy.ClubTenantMiddleware sets request.club before this ever runs).
+
+Each domain app owns its own router and schemas (news/api.py, teams/api.py,
+events/api.py) -- this module only wires them together, same reasoning as
+management/controlpanel never owning domain logic themselves.
+"""
+
+from ninja import NinjaAPI
+
+from club.api import router as club_router
+from events.api import router as events_router
+from news.api import router as news_router
+from teams.api import router as teams_router
+
+api = NinjaAPI(
+    title="RosterChief public API",
+    version="1.0.0",
+    description="Public, read-only data for a club's own external website: news, team rosters, fixtures, and sponsors.",
+    urls_namespace="api",
+)
+
+api.add_router("/news", news_router)
+api.add_router("/teams", teams_router)
+api.add_router("/", events_router)
+api.add_router("/sponsors", club_router)
diff --git a/assets/app.css b/assets/app.css
new file mode 100644
index 0000000..224321f
--- /dev/null
+++ b/assets/app.css
@@ -0,0 +1,211 @@
+@import "tailwindcss";
+
+/* Scan Django templates for utility classes (Tailwind's auto-detection doesn't
+   know about our template dirs). */
+@source "../templates";
+@source "../controlpanel";
+@source "../billing";
+@source "../management";
+
+/* daisyUI: light is the default, dark applies automatically when the OS asks
+   for it. An explicit data-theme on <html> (set by the toggle) overrides both. */
+@plugin "daisyui" {
+    themes: light --default, dark --prefersdark;
+}
+
+/* Fonts are self-hosted (files copied from the @fontsource packages into
+   static/fonts/, paths are relative to the built css at /static/css/app.css).
+   Google's CDN would leak every visitor's IP to a third party on page load,
+   which we don't want to inherit for an EU club platform.
+
+   Two subsets each: `latin` covers western europe, `latin-ext` carries the
+   polish/czech/turkish letters that turn up in member names. The unicode-range
+   means a browser only fetches latin-ext when a page actually uses those glyphs.
+
+   Ubuntu is static (it has no variable version); its real weights are 400/500/700,
+   so `font-semibold` (600) is synthesised up to 700 by the browser. JetBrains Mono
+   and Roboto are variable: one file covers the whole weight axis. */
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 400;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-400-normal.woff2") format("woff2");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 400;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-ext-400-normal.woff2") format("woff2");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: italic;
+    font-weight: 400;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-400-italic.woff2") format("woff2");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: italic;
+    font-weight: 400;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-ext-400-italic.woff2") format("woff2");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 500;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-500-normal.woff2") format("woff2");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 500;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-ext-500-normal.woff2") format("woff2");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 700;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-700-normal.woff2") format("woff2");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Ubuntu";
+    font-style: normal;
+    font-weight: 700;
+    font-display: swap;
+    src: url("../fonts/ubuntu-latin-ext-700-normal.woff2") format("woff2");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+@font-face {
+    font-family: "JetBrains Mono";
+    font-style: normal;
+    font-weight: 100 800;
+    font-display: swap;
+    src: url("../fonts/jetbrains-mono-latin-wght-normal.woff2") format("woff2-variations");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "JetBrains Mono";
+    font-style: normal;
+    font-weight: 100 800;
+    font-display: swap;
+    src: url("../fonts/jetbrains-mono-latin-ext-wght-normal.woff2") format("woff2-variations");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+@font-face {
+    font-family: "Roboto";
+    font-style: normal;
+    font-weight: 100 900;
+    font-display: swap;
+    src: url("../fonts/roboto-latin-standard-normal.woff2") format("woff2-variations");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Roboto";
+    font-style: normal;
+    font-weight: 100 900;
+    font-display: swap;
+    src: url("../fonts/roboto-latin-ext-standard-normal.woff2") format("woff2-variations");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Tourney is a display face for jersey numbers and the like. Its variable file
+   carries two axes -- weight 100-900 and width 75-125 -- so font-stretch has to be
+   declared as a range too, otherwise the browser clamps to the default width and
+   `font-stretch: 125%` (a wide shirt number) silently does nothing. */
+@font-face {
+    font-family: "Tourney";
+    font-style: normal;
+    font-weight: 100 900;
+    font-stretch: 75% 125%;
+    font-display: swap;
+    src: url("../fonts/tourney-latin-standard-normal.woff2") format("woff2-variations");
+    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+@font-face {
+    font-family: "Tourney";
+    font-style: normal;
+    font-weight: 100 900;
+    font-stretch: 75% 125%;
+    font-display: swap;
+    src: url("../fonts/tourney-latin-ext-standard-normal.woff2") format("woff2-variations");
+    unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Setting --font-sans / --font-mono changes the body and <code> defaults; every
+   --font-* also generates a utility, so --font-roboto gives us `font-roboto` to
+   opt into Roboto where we want it. */
+@theme {
+    --font-sans: "Ubuntu", ui-sans-serif, system-ui, sans-serif;
+    --font-mono: "JetBrains Mono", ui-monospace, SFMono-Regular, monospace;
+    --font-ubuntu: "Ubuntu", ui-sans-serif, system-ui, sans-serif;
+    --font-roboto: "Roboto", ui-sans-serif, system-ui, sans-serif;
+    --font-tourney: "Tourney", ui-sans-serif, system-ui, sans-serif;
+}
+
+/* The logo is a background image, not `content:` -- content-replacement on a real
+   element (rather than ::before/::after) isn't supported in Firefox.
+
+   Default = dark-ink logo, for a light background. The media query covers "auto",
+   where the toggle deliberately sets no data-theme at all; the attribute selectors
+   are more specific, so an explicit choice always beats the OS. */
+.logo {
+    background-image: var(--logo-dark);
+    background-position: center;
+    background-repeat: no-repeat;
+    background-size: contain;
+}
+
+@media (prefers-color-scheme: dark) {
+    .logo {
+        background-image: var(--logo-light);
+    }
+}
+
+[data-theme="light"] .logo {
+    background-image: var(--logo-dark);
+}
+
+[data-theme="dark"] .logo {
+    background-image: var(--logo-light);
+}
+
+/* Club-uploaded logos are arbitrary raster files (often much smaller than the
+   badge they're displayed in), so the browser is upscaling them -- and the
+   default resampling some engines fall back to for that reads as pixelated.
+   Forcing the element onto its own GPU-composited layer makes Chrome/Safari
+   pick their higher-quality scaler; the image-rendering hints are a no-op
+   where unsupported, degrading gracefully to the browser default. Doesn't
+   apply to SVG logos, which scale losslessly regardless. */
+.club-logo {
+    image-rendering: -webkit-optimize-contrast;
+    image-rendering: smooth;
+    image-rendering: high-quality;
+    backface-visibility: hidden;
+    transform: translateZ(0);
+}
diff --git a/authentication/__init__.py b/authentication/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/authentication/adapters.py b/authentication/adapters.py
new file mode 100644
index 0000000..d9857e9
--- /dev/null
+++ b/authentication/adapters.py
@@ -0,0 +1,37 @@
+"""allauth adapters.
+
+The MFA adapter exists for one important reason: WebAuthn credentials are bound
+to a **Relying Party ID** (a domain). allauth's default RP ID is the request's
+host — which under our subdomain tenancy would be ``ajax-united.rosterchief.app``,
+binding a passkey to *one club*. A member of two clubs would then need two
+passkeys, and a credential registered at one club would silently fail at another.
+
+Pinning the RP ID to the registrable parent domain (``rosterchief.app``) makes a
+single passkey work across every club subdomain.
+"""
+
+from allauth.mfa.adapter import DefaultMFAAdapter
+from django.conf import settings
+
+
+class RosterChiefMFAAdapter(DefaultMFAAdapter):
+    def get_public_key_credential_rp_entity(self) -> dict[str, str]:
+        return {
+            "id": webauthn_rp_id(),
+            "name": settings.MFA_WEBAUTHN_RP_NAME,
+        }
+
+
+def webauthn_rp_id() -> str:
+    """The registrable parent domain that passkeys are bound to.
+
+    Falls back to the request host when no base domain is configured (e.g. a
+    bare ``localhost`` dev server), which keeps WebAuthn usable there.
+    """
+    base_domain = getattr(settings, "ROSTERCHIEF_BASE_DOMAIN", "")
+    if base_domain:
+        return base_domain
+
+    from allauth.core import context
+
+    return context.request.get_host().partition(":")[0]
diff --git a/authentication/admin.py b/authentication/admin.py
new file mode 100644
index 0000000..28b106b
--- /dev/null
+++ b/authentication/admin.py
@@ -0,0 +1,44 @@
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
+from django.utils.translation import gettext_lazy as _
+
+from members.models import Member
+
+from .forms import UserChangeForm, UserCreationForm
+from .models import User
+
+
+class MemberInline(admin.StackedInline):
+    """Edit the member profile attached to a login from the User page."""
+
+    model = Member
+    can_delete = False
+    extra = 0
+    max_num = 1
+    verbose_name_plural = _("member profile")
+    fields = ("first_name", "last_name", "date_of_birth", "email", "phone", "emergency_phone")
+
+
+@admin.register(User)
+class UserAdmin(BaseUserAdmin):
+    add_form = UserCreationForm
+    form = UserChangeForm
+    model = User
+    inlines = [MemberInline]
+
+    list_display = ("email", "full_name", "is_staff", "is_active")
+    list_filter = ("is_staff", "is_superuser", "is_active", "groups")
+    search_fields = ("email", "member__first_name", "member__last_name")
+    ordering = ("email",)
+    readonly_fields = ("last_login",)
+
+    fieldsets = (
+        (None, {"fields": ("email", "password")}),
+        (_("Permissions"), {"fields": ("is_active", "is_staff", "is_superuser", "groups", "user_permissions")}),
+        (_("Important dates"), {"fields": ("last_login",)}),
+    )
+    add_fieldsets = ((None, {"classes": ("wide",), "fields": ("email", "password1", "password2")}),)
+
+    @admin.display(description=_("name"))
+    def full_name(self, obj):
+        return obj.get_full_name()
diff --git a/authentication/apps.py b/authentication/apps.py
new file mode 100644
index 0000000..372ba81
--- /dev/null
+++ b/authentication/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class AuthenticationConfig(AppConfig):
+    name = "authentication"
diff --git a/authentication/forms.py b/authentication/forms.py
new file mode 100644
index 0000000..b922d84
--- /dev/null
+++ b/authentication/forms.py
@@ -0,0 +1,20 @@
+from django.contrib.auth.forms import BaseUserCreationForm
+from django.contrib.auth.forms import UserChangeForm as DjangoUserChangeForm
+
+from .models import User
+
+
+class UserCreationForm(BaseUserCreationForm):
+    """Add-user form for the email-based custom User (no ``username`` field)."""
+
+    class Meta:
+        model = User
+        fields = ("email",)
+
+
+class UserChangeForm(DjangoUserChangeForm):
+    """Change-user form; keeps the read-only password hash widget."""
+
+    class Meta:
+        model = User
+        fields = "__all__"
diff --git a/authentication/managers.py b/authentication/managers.py
new file mode 100644
index 0000000..9f49068
--- /dev/null
+++ b/authentication/managers.py
@@ -0,0 +1,32 @@
+from django.contrib.auth.base_user import BaseUserManager
+
+
+class UserManager(BaseUserManager):
+    """Manager for the email-based custom User model."""
+
+    use_in_migrations = True
+
+    def _create_user(self, email, password, **extra_fields):
+        if not email:
+            raise ValueError("Users must have an email address.")
+        email = self.normalize_email(email)
+        user = self.model(email=email, **extra_fields)
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
+    def create_user(self, email, password=None, **extra_fields):
+        extra_fields.setdefault("is_staff", False)
+        extra_fields.setdefault("is_superuser", False)
+        return self._create_user(email, password, **extra_fields)
+
+    def create_superuser(self, email, password=None, **extra_fields):
+        extra_fields.setdefault("is_staff", True)
+        extra_fields.setdefault("is_superuser", True)
+
+        if extra_fields.get("is_staff") is not True:
+            raise ValueError("Superuser must have is_staff=True.")
+        if extra_fields.get("is_superuser") is not True:
+            raise ValueError("Superuser must have is_superuser=True.")
+
+        return self._create_user(email, password, **extra_fields)
diff --git a/authentication/middleware.py b/authentication/middleware.py
new file mode 100644
index 0000000..8cbe9ac
--- /dev/null
+++ b/authentication/middleware.py
@@ -0,0 +1,49 @@
+"""Force MFA enrolment for privileged users.
+
+Anyone who can change other people's data must have a second factor: Django
+staff/superusers, and anyone holding an elevated ``ClubRole`` (ADMIN or EDITOR)
+in *any* club. Regular members may enrol, but aren't forced to.
+
+Enrolled users are challenged for their second factor by allauth at login; this
+middleware only handles the other half — a privileged user who has never
+enrolled is redirected to the MFA setup page until they do.
+"""
+
+from allauth.mfa.utils import is_mfa_enabled
+from django.conf import settings
+from django.shortcuts import redirect
+from django.urls import reverse
+
+from club.models import ClubRole
+
+#: Paths a not-yet-enrolled user must still reach (to enrol, or to log out).
+#: ``/__reload__/`` is django-browser-reload's event stream, which only exists
+#: under DEBUG — without it, live reload dies on the enrolment page itself.
+EXEMPT_PREFIXES = ("/accounts/", "/static/", "/media/", "/__reload__/")
+
+ELEVATED_ROLES = (ClubRole.Roles.ADMIN, ClubRole.Roles.EDITOR)
+
+
+def mfa_required_for(user) -> bool:
+    """Privileged users must hold a second factor."""
+    if user.is_staff or user.is_superuser:
+        return True
+    return ClubRole.objects.filter(member__user=user, role__in=ELEVATED_ROLES).exists()
+
+
+class RequireMFAMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if self.needs_enrolment(request):
+            return redirect(reverse(settings.MFA_ENROLMENT_URL_NAME))
+        return self.get_response(request)
+
+    def needs_enrolment(self, request) -> bool:
+        user = getattr(request, "user", None)
+        if user is None or not user.is_authenticated:
+            return False
+        if request.path.startswith(EXEMPT_PREFIXES):
+            return False
+        return mfa_required_for(user) and not is_mfa_enabled(user)
diff --git a/authentication/migrations/0001_initial.py b/authentication/migrations/0001_initial.py
new file mode 100644
index 0000000..5e98af2
--- /dev/null
+++ b/authentication/migrations/0001_initial.py
@@ -0,0 +1,94 @@
+# Generated by Django 6.0.6 on 2026-07-02 07:33
+
+import authentication.managers
+import django.db.models.deletion
+import phonenumber_field.modelfields
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Family',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255)),
+            ],
+            options={
+                'verbose_name': 'family',
+                'verbose_name_plural': 'families',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='User',
+            fields=[
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('email', models.EmailField(db_index=True, max_length=254, unique=True)),
+                ('is_staff', models.BooleanField(default=False)),
+                ('is_active', models.BooleanField(default=True)),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'verbose_name': 'user',
+                'verbose_name_plural': 'users',
+                'ordering': ['email'],
+            },
+            managers=[
+                ('objects', authentication.managers.UserManager()),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Member',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('first_name', models.CharField(max_length=150)),
+                ('last_name', models.CharField(max_length=150)),
+                ('date_of_birth', models.DateField(blank=True, null=True)),
+                ('email', models.EmailField(blank=True, max_length=254)),
+                ('phone', phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None)),
+                ('emergency_phone', phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None)),
+                ('user', models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='member', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'member',
+                'verbose_name_plural': 'members',
+                'ordering': ['last_name', 'first_name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='FamilyMembership',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('role', models.CharField(choices=[('parent', 'parent'), ('child', 'child'), ('guardian', 'guardian'), ('other', 'other')], default='parent', max_length=255)),
+                ('family', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='memberships', to='authentication.family')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='family_memberships', to='authentication.member')),
+            ],
+            options={
+                'verbose_name': 'family membership',
+                'verbose_name_plural': 'family memberships',
+                'ordering': ['family', 'role', 'member__last_name', 'member__first_name'],
+            },
+        ),
+        migrations.AddIndex(
+            model_name='member',
+            index=models.Index(fields=['last_name', 'first_name'], name='authenticat_last_na_0a0eca_idx'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='familymembership',
+            unique_together={('family', 'member')},
+        ),
+    ]
diff --git a/authentication/migrations/0002_alter_family_name.py b/authentication/migrations/0002_alter_family_name.py
new file mode 100644
index 0000000..ea2c70a
--- /dev/null
+++ b/authentication/migrations/0002_alter_family_name.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-02 14:33
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='family',
+            name='name',
+            field=models.CharField(blank=True, max_length=255),
+        ),
+    ]
diff --git a/authentication/migrations/0003_alter_family_name_alter_familymembership_family_and_more.py b/authentication/migrations/0003_alter_family_name_alter_familymembership_family_and_more.py
new file mode 100644
index 0000000..cbf8e1d
--- /dev/null
+++ b/authentication/migrations/0003_alter_family_name_alter_familymembership_family_and_more.py
@@ -0,0 +1,86 @@
+# Generated by Django 6.0.6 on 2026-07-05 13:50
+
+import django.db.models.deletion
+import phonenumber_field.modelfields
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0002_alter_family_name'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='family',
+            name='name',
+            field=models.CharField(blank=True, max_length=255, verbose_name='name'),
+        ),
+        migrations.AlterField(
+            model_name='familymembership',
+            name='family',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='memberships', to='authentication.family', verbose_name='family'),
+        ),
+        migrations.AlterField(
+            model_name='familymembership',
+            name='member',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='family_memberships', to='authentication.member', verbose_name='member'),
+        ),
+        migrations.AlterField(
+            model_name='familymembership',
+            name='role',
+            field=models.CharField(choices=[('parent', 'parent'), ('child', 'child'), ('guardian', 'guardian'), ('other', 'other')], default='parent', max_length=255, verbose_name='role'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='date_of_birth',
+            field=models.DateField(blank=True, null=True, verbose_name='date of birth'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='email',
+            field=models.EmailField(blank=True, max_length=254, verbose_name='email'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='emergency_phone',
+            field=phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None, verbose_name='emergency phone number'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='first_name',
+            field=models.CharField(max_length=150, verbose_name='first name'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='last_name',
+            field=models.CharField(max_length=150, verbose_name='last name'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='phone',
+            field=phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None, verbose_name='phone number'),
+        ),
+        migrations.AlterField(
+            model_name='member',
+            name='user',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='member', to=settings.AUTH_USER_MODEL, verbose_name='user'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='email',
+            field=models.EmailField(db_index=True, max_length=254, unique=True, verbose_name='email'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='is_active',
+            field=models.BooleanField(default=True, verbose_name='is active?'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='is_staff',
+            field=models.BooleanField(default=False, verbose_name='is staff?'),
+        ),
+    ]
diff --git a/authentication/migrations/0004_remove_familymembership_family_and_more.py b/authentication/migrations/0004_remove_familymembership_family_and_more.py
new file mode 100644
index 0000000..886aa84
--- /dev/null
+++ b/authentication/migrations/0004_remove_familymembership_family_and_more.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-07-11 22:09
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0003_alter_family_name_alter_familymembership_family_and_more'),
+        ('club', '0005_alter_clubmembership_member'),
+    ]
+
+    operations = [
+        migrations.DeleteModel(
+            name='FamilyMembership',
+        ),
+        migrations.DeleteModel(
+            name='Family',
+        ),
+        migrations.DeleteModel(
+            name='Member',
+        ),
+    ]
diff --git a/authentication/migrations/__init__.py b/authentication/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/authentication/models.py b/authentication/models.py
new file mode 100644
index 0000000..f4d8c83
--- /dev/null
+++ b/authentication/models.py
@@ -0,0 +1,41 @@
+import uuid
+
+from django.contrib.auth.base_user import AbstractBaseUser
+from django.contrib.auth.models import PermissionsMixin
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+
+from .managers import UserManager
+
+
+class User(AbstractBaseUser, PermissionsMixin):
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+    email = models.EmailField(_("email"), unique=True, db_index=True)
+
+    is_staff = models.BooleanField(_("is staff?"), default=False)
+    is_active = models.BooleanField(_("is active?"), default=True)
+
+    objects = UserManager()
+
+    USERNAME_FIELD = "email"
+    REQUIRED_FIELDS = []
+
+    class Meta:
+        verbose_name = _("user")
+        verbose_name_plural = _("users")
+        ordering = ["email"]
+
+    def __str__(self):
+        return self.get_full_name()
+
+    def get_full_name(self):
+        member = getattr(self, "member", None)
+        if member is not None:
+            return member.get_full_name()
+        return self.email
+
+    def get_short_name(self):
+        member = getattr(self, "member", None)
+        if member is not None:
+            return member.get_short_name()
+        return self.email
diff --git a/authentication/tests.py b/authentication/tests.py
new file mode 100644
index 0000000..a3b62d7
--- /dev/null
+++ b/authentication/tests.py
@@ -0,0 +1,484 @@
+import re
+import uuid
+from urllib.parse import parse_qs, urlparse
+
+from allauth.core import context
+from allauth.mfa.models import Authenticator
+from allauth.mfa.recovery_codes.internal.auth import RecoveryCodes
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import AnonymousUser
+from django.db import IntegrityError
+from django.http import HttpResponse
+from django.test import RequestFactory, TestCase, override_settings
+from django.urls import reverse
+
+from club.models import Club, ClubRole
+from members.models import Member
+
+from .adapters import RosterChiefMFAAdapter, webauthn_rp_id
+from .middleware import RequireMFAMiddleware, mfa_required_for
+
+User = get_user_model()
+
+
+def enrol_mfa(user):
+    """Give ``user`` a second factor (enough for is_mfa_enabled)."""
+    return Authenticator.objects.create(user=user, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+
+
+class UserManagerTests(TestCase):
+    def test_create_user_defaults(self):
+        user = User.objects.create_user(email="alice@example.com", password="secret123")
+
+        self.assertEqual(user.email, "alice@example.com")
+        self.assertTrue(user.check_password("secret123"))
+        self.assertFalse(user.is_staff)
+        self.assertFalse(user.is_superuser)
+        self.assertTrue(user.is_active)
+
+    def test_create_user_requires_email(self):
+        with self.assertRaises(ValueError):
+            User.objects.create_user(email="", password="secret123")
+
+    def test_create_user_normalizes_email_domain(self):
+        # BaseUserManager lowercases the domain part of the address.
+        user = User.objects.create_user(email="Bob@Example.COM", password="secret123")
+
+        self.assertEqual(user.email, "Bob@example.com")
+
+    def test_create_user_password_is_hashed(self):
+        user = User.objects.create_user(email="carol@example.com", password="secret123")
+
+        self.assertNotEqual(user.password, "secret123")
+
+    def test_create_user_without_password_is_unusable(self):
+        user = User.objects.create_user(email="dave@example.com")
+
+        self.assertFalse(user.has_usable_password())
+
+    def test_create_superuser_defaults(self):
+        admin = User.objects.create_superuser(email="admin@example.com", password="secret123")
+
+        self.assertTrue(admin.is_staff)
+        self.assertTrue(admin.is_superuser)
+        self.assertTrue(admin.is_active)
+
+    def test_create_superuser_rejects_non_staff(self):
+        with self.assertRaises(ValueError):
+            User.objects.create_superuser(email="admin@example.com", password="x", is_staff=False)
+
+    def test_create_superuser_rejects_non_superuser(self):
+        with self.assertRaises(ValueError):
+            User.objects.create_superuser(email="admin@example.com", password="x", is_superuser=False)
+
+
+class UserModelTests(TestCase):
+    def test_email_is_username_field(self):
+        self.assertEqual(User.USERNAME_FIELD, "email")
+        self.assertEqual(User.REQUIRED_FIELDS, [])
+
+    def test_email_is_unique(self):
+        User.objects.create_user(email="dup@example.com", password="x")
+        with self.assertRaises(IntegrityError):
+            User.objects.create_user(email="dup@example.com", password="y")
+
+    def test_pk_is_uuid(self):
+        user = User.objects.create_user(email="uuid@example.com", password="x")
+        self.assertIsInstance(user.pk, uuid.UUID)
+
+    def test_str_and_names_fall_back_to_email_without_member(self):
+        user = User.objects.create_user(email="lonely@example.com", password="x")
+
+        self.assertEqual(str(user), "lonely@example.com")
+        self.assertEqual(user.get_full_name(), "lonely@example.com")
+        self.assertEqual(user.get_short_name(), "lonely@example.com")
+
+    def test_str_and_names_use_linked_member(self):
+        user = User.objects.create_user(email="linked@example.com", password="x")
+        Member.objects.create(user=user, first_name="Jane", last_name="Doe")
+
+        # Re-fetch so the reverse OneToOne relation is resolved from the DB.
+        user = User.objects.get(pk=user.pk)
+
+        self.assertEqual(str(user), "Jane Doe")
+        self.assertEqual(user.get_full_name(), "Jane Doe")
+        self.assertEqual(user.get_short_name(), "Jane")
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    MFA_WEBAUTHN_RP_NAME="RosterChief",
+    ALLOWED_HOSTS=[".rosterchief.app", "example.test"],
+)
+class WebAuthnRelyingPartyTests(TestCase):
+    """A passkey is bound to a Relying Party ID (a domain).
+
+    allauth's default RP ID is the request host, which under our subdomain
+    tenancy would bind a passkey to a single club. We pin it to the registrable
+    parent domain so ONE passkey works across every club.
+    """
+
+    def rp_entity(self, host):
+        request = RequestFactory().get("/", HTTP_HOST=host)
+        with context.request_context(request):
+            return RosterChiefMFAAdapter().get_public_key_credential_rp_entity()
+
+    def test_rp_id_is_the_parent_domain_not_the_club_subdomain(self):
+        self.assertEqual(self.rp_entity("ajax-united.rosterchief.app")["id"], "rosterchief.app")
+
+    def test_rp_id_is_identical_across_clubs(self):
+        # The whole point: a passkey registered at one club works at the others.
+        here = self.rp_entity("ajax-united.rosterchief.app")
+        there = self.rp_entity("rival-fc.rosterchief.app")
+
+        self.assertEqual(here["id"], there["id"])
+
+    def test_rp_name_comes_from_settings(self):
+        self.assertEqual(self.rp_entity("ajax-united.rosterchief.app")["name"], "RosterChief")
+
+    @override_settings(ROSTERCHIEF_BASE_DOMAIN="")
+    def test_falls_back_to_the_request_host_without_a_base_domain(self):
+        request = RequestFactory().get("/", HTTP_HOST="example.test:8000")
+
+        with context.request_context(request):
+            self.assertEqual(webauthn_rp_id(), "example.test")
+
+
+class MFARequirementTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def make_user(self, email, **kwargs):
+        return User.objects.create_user(email=email, password="pw-secret-123", **kwargs)
+
+    def with_role(self, user, role):
+        member = Member.objects.create(user=user, first_name="Ada", last_name="Min")
+        ClubRole.objects.create(club=self.club, member=member, role=role)
+        return user
+
+    def test_staff_must_have_mfa(self):
+        self.assertTrue(mfa_required_for(self.make_user("staff@example.com", is_staff=True)))
+
+    def test_superuser_must_have_mfa(self):
+        self.assertTrue(mfa_required_for(User.objects.create_superuser(email="root@example.com", password="pw-secret-123")))
+
+    def test_club_admin_must_have_mfa(self):
+        user = self.with_role(self.make_user("admin@example.com"), ClubRole.Roles.ADMIN)
+
+        self.assertTrue(mfa_required_for(user))
+
+    def test_editor_must_have_mfa(self):
+        user = self.with_role(self.make_user("editor@example.com"), ClubRole.Roles.EDITOR)
+
+        self.assertTrue(mfa_required_for(user))
+
+    def test_plain_member_does_not_need_mfa(self):
+        user = self.with_role(self.make_user("member@example.com"), ClubRole.Roles.MEMBER)
+
+        self.assertFalse(mfa_required_for(user))
+
+    def test_user_without_any_role_does_not_need_mfa(self):
+        self.assertFalse(mfa_required_for(self.make_user("nobody@example.com")))
+
+
+class RequireMFAMiddlewareTests(TestCase):
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.middleware = RequireMFAMiddleware(lambda request: HttpResponse("ok"))
+
+    def dispatch(self, user, path="/"):
+        request = self.factory.get(path)
+        request.user = user
+        return self.middleware(request)
+
+    def make_staff(self):
+        return User.objects.create_user(email="staff@example.com", password="pw-secret-123", is_staff=True)
+
+    def test_anonymous_passes_through(self):
+        self.assertEqual(self.dispatch(AnonymousUser()).content, b"ok")
+
+    def test_unprivileged_user_passes_through(self):
+        user = User.objects.create_user(email="plain@example.com", password="pw-secret-123")
+
+        self.assertEqual(self.dispatch(user).content, b"ok")
+
+    def test_privileged_user_without_mfa_is_sent_to_enrolment(self):
+        response = self.dispatch(self.make_staff())
+
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.url, reverse("mfa_index"))
+
+    def test_privileged_user_can_still_reach_the_enrolment_pages(self):
+        # Otherwise they'd be redirected in a loop and could never enrol.
+        response = self.dispatch(self.make_staff(), path="/accounts/2fa/totp/activate/")
+
+        self.assertEqual(response.content, b"ok")
+
+    def test_enrolled_privileged_user_passes_through(self):
+        staff = self.make_staff()
+        enrol_mfa(staff)
+
+        self.assertEqual(self.dispatch(staff).content, b"ok")
+
+
+class AdminLoginRoutingTests(TestCase):
+    def test_admin_login_is_routed_through_allauth(self):
+        # Django's own admin login knows nothing about second factors.
+        response = self.client.get("/admin/login/", {"next": "/admin/"})
+
+        self.assertEqual(response.status_code, 302)
+        redirect = urlparse(response.url)
+        self.assertEqual(redirect.path, reverse("account_login"))
+        # The original destination survives the hop (percent-encoded).
+        self.assertEqual(parse_qs(redirect.query)["next"], ["/admin/"])
+
+    def test_allauth_login_page_loads(self):
+        self.assertEqual(self.client.get(reverse("account_login")).status_code, 200)
+
+
+class AuthFormRenderingTests(TestCase):
+    """Every allauth form must actually render its fields.
+
+    Regression: the `fields` element passed `attrs.exclude` straight into a filter.
+    On a page that never sets it, resolving a filter *argument* raises
+    VariableDoesNotExist — which Django swallows inside {% if %} and reads as false —
+    so every field was silently dropped from every form except the login page (the one
+    page that does pass `exclude`).
+    """
+
+    def test_the_login_form_renders_its_fields(self):
+        self.assertContains(self.client.get(reverse("account_login")), 'name="login"')
+
+    def test_the_password_reset_form_renders_its_fields(self):
+        self.assertContains(self.client.get(reverse("account_reset_password")), 'name="email"')
+
+    def test_the_signup_form_renders_its_fields(self):
+        self.assertContains(self.client.get(reverse("account_signup")), 'name="password1"')
+
+
+class TwoFactorPageTests(TestCase):
+    def setUp(self):
+        user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        enrol_mfa(user)
+        # Password accepted, second factor still owed: this is the 2FA challenge page.
+        self.response = self.client.post(reverse("account_login"), {"login": "mfa@example.com", "password": "pw-secret-123"}, follow=True)
+
+    def test_the_code_field_renders_as_an_otp_input(self):
+        self.assertContains(self.response, 'name="code"')
+        self.assertContains(self.response, "otp otp-lg")
+
+    def test_the_input_comes_after_the_boxes(self):
+        # daisyUI places each box with nth-child, which counts every child. With the input
+        # first, all six boxes shift a stride right, the container grows to seven strides
+        # and the ::after focus marker appears as a phantom seventh box.
+        html = self.response.content.decode()
+        otp = html[html.index('class="otp otp-lg"') : html.index('name="code"')]
+
+        self.assertEqual(otp.count("<span></span>"), 6)
+
+    def test_the_boxes_are_wrapped_in_a_label_so_tapping_focuses_the_input(self):
+        # daisyUI's overlaid otp input carries `pointer-events: none` (so clicks land on the
+        # boxes, not a naked input) — which also means a tap on the boxes never reaches the
+        # input directly. A <label for> is what closes that gap: browsers focus a labelled
+        # control on click regardless of the control's own pointer-events. Without this
+        # wrapper the field cannot be entered on a touchscreen, which has no Tab key to fall
+        # back on.
+        html = self.response.content.decode()
+        label_start = html.index('<label class="contents"')
+        otp_start = html.index('class="otp otp-lg"')
+
+        self.assertLess(label_start, otp_start)
+        self.assertIn('for="id_code"', html[label_start : label_start + 60])
+
+    def test_the_otp_field_has_no_placeholder(self):
+        # allauth sets placeholder="Code"; inside the boxes it reads as a typed-in code.
+        self.assertNotContains(self.response, 'placeholder="Code"')
+
+    def test_cancel_sits_beside_sign_in_and_is_not_primary(self):
+        self.assertContains(self.response, '<button class="btn btn-outline gap-2" type="submit" form="logout-from-stage">')
+        self.assertContains(self.response, '<button class="btn btn-primary gap-2" type="submit">')
+
+    def test_cancel_has_a_form_to_submit(self):
+        self.assertContains(self.response, 'id="logout-from-stage"')
+
+    def test_the_security_key_button_is_an_accent_button_with_a_working_form(self):
+        self.assertContains(self.response, "btn btn-accent")
+        self.assertContains(self.response, 'form="webauthn_form"')
+        # The id lives on the form element — without it the button submits nothing.
+        self.assertContains(self.response, 'id="webauthn_form"')
+        self.assertContains(self.response, "allauth.webauthn.forms.authenticateForm")
+
+
+class MfaPageTests(TestCase):
+    """Every MFA screen must render. They are built from allauth's `element` primitives,
+    so styling lives in the element overrides rather than in eight page templates."""
+
+    def setUp(self):
+        self.user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        # A real password login (not force_login) so allauth counts it as a recent
+        # authentication and doesn't bounce the sensitive pages to reauthenticate.
+        self.client.post(reverse("account_login"), {"login": "mfa@example.com", "password": "pw-secret-123"}, follow=True)
+
+    def test_the_manage_page_renders_a_panel_per_authenticator(self):
+        response = self.client.get(reverse("mfa_index"))
+
+        self.assertContains(response, "Authenticator App")
+        self.assertContains(response, "card border")
+
+    def test_the_security_key_list_renders(self):
+        # Regression: allauth's template does {% load humanize %}, which raised
+        # TemplateSyntaxError until django.contrib.humanize was installed.
+        self.assertEqual(self.client.get(reverse("mfa_list_webauthn")).status_code, 200)
+
+    def test_the_totp_activate_page_boxes_the_code_and_plates_the_qr(self):
+        response = self.client.get(reverse("mfa_activate_totp"))
+
+        self.assertContains(response, "otp otp-lg")
+        # The QR is dark-on-transparent: without a white plate it is unscannable on the
+        # dark theme.
+        self.assertContains(response, "bg-white p-3")
+        self.assertContains(response, "font-mono")  # the secret, to be copied by hand
+
+    def test_the_deactivate_button_is_destructive(self):
+        enrol_mfa(self.user)
+
+        response = self.client.get(reverse("mfa_index"))
+
+        # allauth tags it "danger" — it must not look like the safe action.
+        self.assertContains(response, "btn-error")
+
+    def test_reauthenticating_with_a_code_boxes_the_input(self):
+        enrol_mfa(self.user)
+
+        self.assertContains(self.client.get(reverse("mfa_reauthenticate")), "otp otp-lg")
+
+
+class ActionBarTests(TestCase):
+    """A form's action bar is drawn when the actions slot has content.
+
+    Regression: it was keyed on `no_visible_fields`, which allauth sets to say a form has
+    no visible *fields* — logout and TOTP deactivate are a bare csrf token plus a button.
+    Keying the bar on it hid the button on exactly the pages that are nothing but a button.
+    """
+
+    def setUp(self):
+        self.user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        self.client.post(reverse("account_login"), {"login": "mfa@example.com", "password": "pw-secret-123"}, follow=True)
+
+    def test_the_sign_out_page_has_its_button(self):
+        response = self.client.get(reverse("account_logout"))
+
+        self.assertContains(response, "Sign Out")
+        self.assertContains(response, 'type="submit"')
+
+    def test_the_totp_deactivate_page_has_its_button(self):
+        enrol_mfa(self.user)
+
+        response = self.client.get(reverse("mfa_deactivate_totp"))
+
+        self.assertContains(response, "btn-error")
+        self.assertContains(response, 'type="submit"')
+
+
+class SignOutPageTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        self.client.force_login(self.user)
+        self.response = self.client.get(reverse("account_logout"))
+
+    def test_sign_out_and_cancel_sit_side_by_side_with_icons(self):
+        html = self.response.content.decode()
+        cancel = html[html.index('<a class="btn btn-outline gap-2" href="/">') :]
+        sign_out = html[html.index('<button class="btn btn-primary gap-2"') :]
+
+        self.assertIn("<svg", cancel[: cancel.index("</a>")])
+        self.assertIn("<svg", sign_out[: sign_out.index("</button>")])
+
+    def test_cancel_does_not_sign_you_out(self):
+        # It is a link, not a submit: only the POST logs you out.
+        self.client.get("/")
+
+        self.assertTrue(self.client.session.get("_auth_user_id"))
+
+    def test_signing_out_still_works(self):
+        self.client.post(reverse("account_logout"))
+
+        self.assertIsNone(self.client.session.get("_auth_user_id"))
+
+
+class ChangePasswordPageTests(TestCase):
+    def setUp(self):
+        User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        self.client.post(reverse("account_login"), {"login": "mfa@example.com", "password": "pw-secret-123"}, follow=True)
+        self.response = self.client.get(reverse("account_change_password"))
+
+    def test_the_fields_have_no_visible_labels(self):
+        # allauth gives each a placeholder, so the label would only repeat it.
+        self.assertNotContains(self.response, '<span class="label-text">Current Password</span>')
+        self.assertContains(self.response, 'name="oldpassword"')
+        self.assertContains(self.response, 'name="password1"')
+
+    def test_the_new_password_keeps_its_help_text(self):
+        self.assertContains(self.response, "id_password1_helptext")
+
+    def test_the_current_password_is_set_apart_from_the_new_one(self):
+        self.assertContains(self.response, "mt-10")
+
+    def test_forgot_password_is_an_accent_button_and_both_actions_have_icons(self):
+        html = self.response.content.decode()
+        forgot = html[html.index("btn-accent") :]
+        submit = html[html.index('class="btn btn-primary gap-2"') :]
+
+        self.assertIn("<svg", forgot[: forgot.index("</a>")])
+        self.assertIn("<svg", submit[: submit.index("</button>")])
+
+
+class MfaButtonIconTests(TestCase):
+    """Every button on the MFA screens carries an icon, and the recovery-code actions are
+    ranked: View is primary, Download and Generate are outline. Generate throws away the
+    codes you already have, so it must not read as the obvious thing to click."""
+
+    def setUp(self):
+        self.user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        # Sign in *before* enrolling: a user who already holds a second factor is stopped at
+        # the 2FA challenge and never reaches these pages.
+        self.client.post(reverse("account_login"), {"login": "mfa@example.com", "password": "pw-secret-123"}, follow=True)
+        enrol_mfa(self.user)
+        RecoveryCodes.activate(self.user).instance.save()
+
+    def buttons(self, url):
+        """Every <a class="btn"> / <button class="btn"> in the page body, minus the navbar."""
+        html = self.client.get(url, follow=True).content.decode()
+        body = html[html.index("<main") :]
+        return re.findall(r'<(?:a|button)[^>]*class="btn[^"]*"[^>]*>(.*?)</(?:a|button)>', body, re.S)
+
+    def test_every_button_on_the_manage_page_has_an_icon(self):
+        found = self.buttons(reverse("mfa_index"))
+
+        self.assertTrue(found)
+        for button in found:
+            self.assertIn("<svg", button)
+
+    def test_download_and_generate_are_outline_buttons(self):
+        html = self.client.get(reverse("mfa_index"), follow=True).content.decode()
+
+        self.assertEqual(html.count("btn-outline"), 2)  # Download + Generate, not View
+
+    def test_the_panel_actions_are_spaced_off_the_body_text(self):
+        self.assertContains(self.client.get(reverse("mfa_index"), follow=True), "card-actions mt-4")
+
+    def test_every_button_on_the_deactivate_page_has_an_icon(self):
+        for button in self.buttons(reverse("mfa_deactivate_totp")):
+            self.assertIn("<svg", button)
+
+    def test_every_button_on_the_add_security_key_page_has_an_icon(self):
+        for button in self.buttons(reverse("mfa_add_webauthn")):
+            self.assertIn("<svg", button)
+
+    def test_the_activate_page_gives_the_code_box_no_visible_label(self):
+        Authenticator.objects.filter(user=self.user, type=Authenticator.Type.TOTP).delete()
+
+        response = self.client.get(reverse("mfa_activate_totp"), follow=True)
+
+        self.assertContains(response, "otp otp-lg")
+        self.assertNotContains(response, '<span class="label-text">Code</span>')
diff --git a/billing/__init__.py b/billing/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/billing/admin.py b/billing/admin.py
new file mode 100644
index 0000000..82be11f
--- /dev/null
+++ b/billing/admin.py
@@ -0,0 +1,53 @@
+from django.contrib import admin
+
+from .models import Due, DuePayment, Subscription, Tier, TierPrice
+
+
+class TierPriceInline(admin.TabularInline):
+    model = TierPrice
+    extra = 0
+
+
+@admin.register(Tier)
+class TierAdmin(admin.ModelAdmin):
+    list_display = ["name", "is_active"]
+    list_filter = ["is_active"]
+    search_fields = ["name"]
+    prepopulated_fields = {"slug": ["name"]}
+    inlines = [TierPriceInline]
+
+
+@admin.register(TierPrice)
+class TierPriceAdmin(admin.ModelAdmin):
+    list_display = ["tier", "amount", "active_from"]
+    list_filter = ["tier"]
+
+
+@admin.register(Subscription)
+class SubscriptionAdmin(admin.ModelAdmin):
+    list_display = ["club", "tier", "auto_renew", "auto_archive"]
+    list_filter = ["tier", "auto_renew", "auto_archive"]
+    search_fields = ["club__name"]
+
+
+class DuePaymentInline(admin.TabularInline):
+    model = DuePayment
+    extra = 0
+    readonly_fields = ["recorded_by"]
+
+
+@admin.register(Due)
+class DueAdmin(admin.ModelAdmin):
+    list_display = ["club", "tier", "period_start", "period_end", "amount", "amount_paid", "status"]
+    list_filter = ["status", "tier"]
+    search_fields = ["club__name"]
+    # Money is settled by the billing service, which re-derives these from the payments.
+    readonly_fields = ["amount_paid", "status", "paid_at"]
+    inlines = [DuePaymentInline]
+
+
+@admin.register(DuePayment)
+class DuePaymentAdmin(admin.ModelAdmin):
+    list_display = ["due", "amount", "method", "paid_at", "recorded_by"]
+    list_filter = ["method"]
+    search_fields = ["due__club__name", "reference"]
diff --git a/billing/apps.py b/billing/apps.py
new file mode 100644
index 0000000..33b9fa5
--- /dev/null
+++ b/billing/apps.py
@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class BillingConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "billing"
+    verbose_name = "Billing"
diff --git a/billing/management/__init__.py b/billing/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/billing/management/commands/__init__.py b/billing/management/commands/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/billing/management/commands/archive_overdue_clubs.py b/billing/management/commands/archive_overdue_clubs.py
new file mode 100644
index 0000000..113c57a
--- /dev/null
+++ b/billing/management/commands/archive_overdue_clubs.py
@@ -0,0 +1,38 @@
+"""Archive clubs whose billing period has gone unpaid past its grace period.
+
+Reports by default and only acts with --commit. That asymmetry is the point: this command
+switches off paying customers, and a cron misconfiguration, a clock skew or a bad import
+should cost you a confusing email, not a morning of angry clubs.
+"""
+
+from django.utils import timezone
+
+from billing.services.dues import archivable_clubs
+from features.commands import MaintenanceAwareCommand
+
+
+class Command(MaintenanceAwareCommand):
+    help = "Archive clubs that are unpaid past their grace period (dry run unless --commit)."
+
+    def add_arguments(self, parser):
+        parser.add_argument("--commit", action="store_true", help="Actually archive them. Without this the command only reports.")
+
+    def handle(self, *args, **options):
+        today = timezone.localdate()
+        overdue = list(archivable_clubs(today))
+
+        if not overdue:
+            self.stdout.write(self.style.SUCCESS("Nothing overdue past grace."))
+            return
+
+        for due in overdue:
+            days = (today - due.grace_until).days
+            self.stdout.write(f"{due.club} — {due.tier}, {due.balance} owed, grace ended {due.grace_until} ({days} day{'s'[: days != 1]} ago)")
+
+        if not options["commit"]:
+            self.stdout.write(self.style.WARNING(f"\nDry run: {len(overdue)} club(s) would be archived. Re-run with --commit to do it."))
+            return
+
+        for due in overdue:
+            due.club.archive()
+        self.stdout.write(self.style.SUCCESS(f"\nArchived {len(overdue)} club(s). Their data is kept; restoring re-opens billing."))
diff --git a/billing/management/commands/renew_subscriptions.py b/billing/management/commands/renew_subscriptions.py
new file mode 100644
index 0000000..d642f57
--- /dev/null
+++ b/billing/management/commands/renew_subscriptions.py
@@ -0,0 +1,57 @@
+"""Issue the next billing period for clubs whose current one is running out.
+
+Unlike archive_overdue_clubs, this ACTS by default and only previews with --dry-run. The
+asymmetry is deliberate and runs the other way: archiving switches off a paying customer, so
+not acting is the safe failure. Here, not acting means a club keeps using the platform for
+free — and because nothing is owed, no dashboard number goes red and the archive job never
+fires either. A missed renewal is silent, and silence is the expensive failure.
+"""
+
+from django.core.management.base import CommandError
+
+from billing.models import RENEWAL_LEAD_DAYS
+from billing.services import BillingError
+from billing.services.dues import renew, subscriptions_due_for_renewal
+from features.commands import MaintenanceAwareCommand
+
+
+class Command(MaintenanceAwareCommand):
+    help = "Open the next billing period for clubs whose current period ends soon."
+
+    def add_arguments(self, parser):
+        parser.add_argument("--dry-run", action="store_true", help="Report what would be issued, and issue nothing.")
+        parser.add_argument("--lead-days", type=int, default=RENEWAL_LEAD_DAYS, help=f"Issue this many days before the period ends (default {RENEWAL_LEAD_DAYS}).")
+
+    def handle(self, *args, **options):
+        due_for_renewal = subscriptions_due_for_renewal(lead_days=options["lead_days"])
+
+        if not due_for_renewal:
+            self.stdout.write(self.style.SUCCESS("Nothing to renew."))
+            return
+
+        failures = []
+        for subscription in due_for_renewal:
+            club = subscription.club
+
+            if options["dry_run"]:
+                self.stdout.write(f"would renew {club} — {subscription.tier}, current period ends {subscription.latest_period_end or 'never opened'}")
+                continue
+
+            try:
+                due = renew(subscription)
+            except BillingError as error:
+                # One unpriced tier must not stop every other club from being billed.
+                failures.append(f"{club}: {error}")
+                self.stdout.write(self.style.ERROR(f"{club} — {error}"))
+                continue
+
+            self.stdout.write(self.style.SUCCESS(f"{club} — {due.period_start} to {due.period_end}, {due.amount} ({due.invoice.number})"))
+
+        if options["dry_run"]:
+            self.stdout.write(self.style.WARNING(f"\nDry run: {len(due_for_renewal)} club(s) would be renewed."))
+            return
+
+        if failures:
+            # Non-zero, so cron mails you: a club that could not be billed is revenue quietly
+            # not being collected.
+            raise CommandError(f"{len(failures)} club(s) could not be renewed:\n  " + "\n  ".join(failures))
diff --git a/billing/migrations/0001_initial.py b/billing/migrations/0001_initial.py
new file mode 100644
index 0000000..71943f4
--- /dev/null
+++ b/billing/migrations/0001_initial.py
@@ -0,0 +1,138 @@
+# Generated by Django 6.0.6 on 2026-07-13 23:40
+
+import django.core.validators
+import django.db.models.deletion
+import django.utils.timezone
+import uuid
+from decimal import Decimal
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0013_club_created_club_modified_clubmembership_created_and_more'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Tier',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('slug', models.SlugField(blank=True, max_length=255, unique=True, verbose_name='slug')),
+                ('description', models.TextField(blank=True, verbose_name='description')),
+                ('is_active', models.BooleanField(default=True, help_text='Inactive tiers keep billing existing subscriptions but cannot be chosen for new ones.', verbose_name='active')),
+            ],
+            options={
+                'verbose_name': 'tier',
+                'verbose_name_plural': 'tiers',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Due',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, validators=[django.core.validators.MinValueValidator(Decimal('0.00'))], verbose_name='amount')),
+                ('amount_paid', models.DecimalField(decimal_places=2, default=Decimal('0.00'), help_text='Kept in step with the payments by the billing service.', max_digits=10, verbose_name='amount paid')),
+                ('period_start', models.DateField(verbose_name='period start')),
+                ('period_end', models.DateField(blank=True, verbose_name='period end')),
+                ('grace_until', models.DateField(blank=True, help_text='Past this date an unpaid club is archived.', verbose_name='grace until')),
+                ('status', models.CharField(choices=[('unpaid', 'unpaid'), ('partial', 'partially paid'), ('paid', 'paid'), ('waived', 'waived'), ('cancelled', 'cancelled')], default='unpaid', max_length=20, verbose_name='status')),
+                ('paid_at', models.DateTimeField(blank=True, null=True, verbose_name='paid at')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='dues', to='club.club', verbose_name='club')),
+                ('tier', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='dues', to='billing.tier', verbose_name='tier')),
+            ],
+            options={
+                'verbose_name': 'due',
+                'verbose_name_plural': 'dues',
+                'ordering': ['-period_start', 'club__name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='DuePayment',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, validators=[django.core.validators.MinValueValidator(Decimal('0.01'))], verbose_name='amount')),
+                ('method', models.CharField(choices=[('bank_transfer', 'bank transfer'), ('card', 'card'), ('cash', 'cash'), ('other', 'other')], default='bank_transfer', max_length=20, verbose_name='method')),
+                ('reference', models.CharField(blank=True, help_text='Bank reference, transaction id — whatever lets you find this again.', max_length=255, verbose_name='reference')),
+                ('paid_at', models.DateTimeField(default=django.utils.timezone.now, verbose_name='paid at')),
+                ('note', models.TextField(blank=True, verbose_name='note')),
+                ('due', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='payments', to='billing.due', verbose_name='due')),
+                ('recorded_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='recorded_due_payments', to=settings.AUTH_USER_MODEL, verbose_name='recorded by')),
+            ],
+            options={
+                'verbose_name': 'due payment',
+                'verbose_name_plural': 'due payments',
+                'ordering': ['-paid_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Invoice',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('number', models.CharField(blank=True, max_length=32, unique=True, verbose_name='number')),
+                ('issued_at', models.DateTimeField(default=django.utils.timezone.now, verbose_name='issued at')),
+                ('due', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, related_name='invoice', to='billing.due', verbose_name='due')),
+            ],
+            options={
+                'verbose_name': 'invoice',
+                'verbose_name_plural': 'invoices',
+                'ordering': ['-issued_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Subscription',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('auto_archive', models.BooleanField(default=True, help_text='Archive this club when a period goes unpaid past its grace period.', verbose_name='auto archive')),
+                ('notes', models.TextField(blank=True, verbose_name='notes')),
+                ('club', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, related_name='subscription', to='club.club', verbose_name='club')),
+                ('tier', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='subscriptions', to='billing.tier', verbose_name='tier')),
+            ],
+            options={
+                'verbose_name': 'subscription',
+                'verbose_name_plural': 'subscriptions',
+                'ordering': ['club__name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='TierPrice',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('active_from', models.DateField(help_text='Periods opening on or after this date are billed at this amount.', verbose_name='active from')),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, validators=[django.core.validators.MinValueValidator(Decimal('0.00'))], verbose_name='amount')),
+                ('tier', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='prices', to='billing.tier', verbose_name='tier')),
+            ],
+            options={
+                'verbose_name': 'tier price',
+                'verbose_name_plural': 'tier prices',
+                'ordering': ['tier__name', '-active_from'],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='due',
+            constraint=models.UniqueConstraint(fields=('club', 'period_start'), name='unique_due_per_club_per_period'),
+        ),
+        migrations.AddConstraint(
+            model_name='tierprice',
+            constraint=models.UniqueConstraint(fields=('tier', 'active_from'), name='unique_tier_price_per_start_date'),
+        ),
+    ]
diff --git a/billing/migrations/0002_subscription_auto_renew.py b/billing/migrations/0002_subscription_auto_renew.py
new file mode 100644
index 0000000..4746ac6
--- /dev/null
+++ b/billing/migrations/0002_subscription_auto_renew.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-14 22:35
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billing', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='subscription',
+            name='auto_renew',
+            field=models.BooleanField(default=True, help_text='Issue the next period automatically before this one ends. Off means you invoice this club by hand.', verbose_name='auto renew'),
+        ),
+    ]
diff --git a/billing/migrations/0003_due_is_trial_subscription_post_trial_tier_and_more.py b/billing/migrations/0003_due_is_trial_subscription_post_trial_tier_and_more.py
new file mode 100644
index 0000000..5871aba
--- /dev/null
+++ b/billing/migrations/0003_due_is_trial_subscription_post_trial_tier_and_more.py
@@ -0,0 +1,34 @@
+# Generated by Django 6.0.6 on 2026-08-04 10:10
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billing', '0002_subscription_auto_renew'),
+        ('club', '0017_club_season_duration_months_club_season_start'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='due',
+            name='is_trial',
+            field=models.BooleanField(default=False, help_text="This period was opened as a trial. A durable marker on the row itself -- the subscription's own trial fields are cleared once it converts.", verbose_name='trial period'),
+        ),
+        migrations.AddField(
+            model_name='subscription',
+            name='post_trial_tier',
+            field=models.ForeignKey(blank=True, help_text='The plan this club switches to automatically once its trial ends.', null=True, on_delete=django.db.models.deletion.PROTECT, related_name='+', to='billing.tier', verbose_name='post-trial tier'),
+        ),
+        migrations.AddField(
+            model_name='subscription',
+            name='trial_ends_at',
+            field=models.DateField(blank=True, help_text='Set while this club is on a trial. The tier switches to post_trial_tier the next time a period is opened after this date.', null=True, verbose_name='trial ends at'),
+        ),
+        migrations.AddConstraint(
+            model_name='subscription',
+            constraint=models.CheckConstraint(condition=models.Q(models.Q(('post_trial_tier__isnull', True), ('trial_ends_at__isnull', True)), models.Q(('post_trial_tier__isnull', False), ('trial_ends_at__isnull', False)), _connector='OR'), name='trial_fields_set_together'),
+        ),
+    ]
diff --git a/billing/migrations/__init__.py b/billing/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/billing/models.py b/billing/models.py
new file mode 100644
index 0000000..b00866d
--- /dev/null
+++ b/billing/models.py
@@ -0,0 +1,267 @@
+"""What the platform charges a club.
+
+Deliberately NOT club-scoped. `shop` is a club charging its members — tenant data, owned by
+the club. This is RosterChief charging the club: platform-owned, and no club user ever sees
+it. Nothing here inherits ClubScopedModel: these rows reference a Club, they are not owned
+by one, and a tenant-scoped manager would be exactly the wrong default.
+"""
+
+from datetime import date, timedelta
+from decimal import Decimal
+
+from dateutil import relativedelta
+from django.conf import settings
+from django.core.validators import MinValueValidator
+from django.db import models
+from django.db.models import Q
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from rosterchief.base import UUIDModel, unique_slugify
+
+ZERO = Decimal("0.00")
+
+# A club stays live for six weeks past the end of an unpaid period before it is archived.
+GRACE_DAYS = 45
+
+# The next period is issued this long before the current one ends, so the invoice reaches the
+# club — and can be paid — before the old period lapses. Grace then only matters for genuine
+# non-payers, rather than for everyone who takes a fortnight to pay a bank transfer.
+RENEWAL_LEAD_DAYS = 30
+
+
+def add_one_year(day: date) -> date:
+    return day + relativedelta.relativedelta(years=1)
+
+
+def add_months(day: date, months: int) -> date:
+    return day + relativedelta.relativedelta(months=months)
+
+
+class Tier(UUIDModel):
+    """A price band. The price itself lives in TierPrice, which is dated."""
+
+    name = models.CharField(_("name"), max_length=255)
+    slug = models.SlugField(_("slug"), max_length=255, unique=True, blank=True)
+    description = models.TextField(_("description"), blank=True)
+    is_active = models.BooleanField(_("active"), default=True, help_text=_("Inactive tiers keep billing existing subscriptions but cannot be chosen for new ones."))
+
+    class Meta:
+        verbose_name = _("tier")
+        verbose_name_plural = _("tiers")
+        ordering = ["name"]
+
+    def __str__(self):
+        return self.name
+
+    def save(self, *args, **kwargs):
+        if not self.slug:
+            self.slug = unique_slugify(self, self.name)
+        super().save(*args, **kwargs)
+
+    def price_on(self, day: date | None = None) -> Decimal | None:
+        """The price in force on ``day`` — the latest one that had started by then.
+
+        None means the tier had no price yet on that date. Callers must treat that as
+        "cannot bill", never as free.
+        """
+        day = day or timezone.localdate()
+        price = self.prices.filter(active_from__lte=day).order_by("-active_from").first()
+
+        return price.amount if price else None
+
+
+class TierPrice(UUIDModel):
+    """A dated price for a tier.
+
+    Dated rather than keyed by year: a rate change is one new row with a future
+    ``active_from``, and every period already opened keeps the amount it was billed at.
+    """
+
+    tier = models.ForeignKey(Tier, on_delete=models.CASCADE, related_name="prices", verbose_name=_("tier"))
+    active_from = models.DateField(_("active from"), help_text=_("Periods opening on or after this date are billed at this amount."))
+    amount = models.DecimalField(_("amount"), max_digits=10, decimal_places=2, validators=[MinValueValidator(ZERO)])
+
+    class Meta:
+        verbose_name = _("tier price")
+        verbose_name_plural = _("tier prices")
+        ordering = ["tier__name", "-active_from"]
+        constraints = [
+            models.UniqueConstraint(fields=["tier", "active_from"], name="unique_tier_price_per_start_date"),
+        ]
+
+    def __str__(self):
+        return f"{self.tier} — {self.amount} from {self.active_from}"
+
+
+class Subscription(UUIDModel):
+    """A club's current plan. The periods it is billed for are Dues."""
+
+    club = models.OneToOneField("club.Club", on_delete=models.CASCADE, related_name="subscription", verbose_name=_("club"))
+    tier = models.ForeignKey(Tier, on_delete=models.PROTECT, related_name="subscriptions", verbose_name=_("tier"))
+    auto_renew = models.BooleanField(_("auto renew"), default=True, help_text=_("Issue the next period automatically before this one ends. Off means you invoice this club by hand."))
+    auto_archive = models.BooleanField(_("auto archive"), default=True, help_text=_("Archive this club when a period goes unpaid past its grace period."))
+    notes = models.TextField(_("notes"), blank=True)
+
+    trial_ends_at = models.DateField(_("trial ends at"), null=True, blank=True, help_text=_("Set while this club is on a trial. The tier switches to post_trial_tier the next time a period is opened after this date."))
+    post_trial_tier = models.ForeignKey(Tier, on_delete=models.PROTECT, null=True, blank=True, related_name="+", verbose_name=_("post-trial tier"), help_text=_("The plan this club switches to automatically once its trial ends."))
+
+    class Meta:
+        verbose_name = _("subscription")
+        verbose_name_plural = _("subscriptions")
+        ordering = ["club__name"]
+        constraints = [
+            # Both set together or neither -- a trial with no target plan (or a target
+            # plan with no trial end date) is a half-configured state nothing should read.
+            models.CheckConstraint(
+                condition=Q(trial_ends_at__isnull=True, post_trial_tier__isnull=True) | Q(trial_ends_at__isnull=False, post_trial_tier__isnull=False),
+                name="trial_fields_set_together",
+            ),
+        ]
+
+    def __str__(self):
+        return f"{self.club} — {self.tier}"
+
+
+class Due(UUIDModel):
+    """One billing period for one club.
+
+    ``tier`` and ``amount`` are snapshots taken when the period opens, never read back
+    through the tier at display time: raise the price and last year's period must still say
+    what was actually charged. A live lookup would rewrite financial history.
+    """
+
+    class Status(models.TextChoices):
+        UNPAID = "unpaid", _("unpaid")
+        PARTIAL = "partial", _("partially paid")
+        PAID = "paid", _("paid")
+        WAIVED = "waived", _("waived")
+        CANCELLED = "cancelled", _("cancelled")
+
+    #: Statuses that still owe money.
+    OWING = (Status.UNPAID, Status.PARTIAL)
+
+    club = models.ForeignKey("club.Club", on_delete=models.CASCADE, related_name="dues", verbose_name=_("club"))
+    tier = models.ForeignKey(Tier, on_delete=models.PROTECT, related_name="dues", verbose_name=_("tier"))
+
+    amount = models.DecimalField(_("amount"), max_digits=10, decimal_places=2, validators=[MinValueValidator(ZERO)])
+    amount_paid = models.DecimalField(_("amount paid"), max_digits=10, decimal_places=2, default=ZERO, help_text=_("Kept in step with the payments by the billing service."))
+
+    period_start = models.DateField(_("period start"))
+    period_end = models.DateField(_("period end"), blank=True)
+    grace_until = models.DateField(_("grace until"), blank=True, help_text=_("Past this date an unpaid club is archived."))
+
+    status = models.CharField(_("status"), max_length=20, choices=Status.choices, default=Status.UNPAID)
+    paid_at = models.DateTimeField(_("paid at"), null=True, blank=True)
+
+    is_trial = models.BooleanField(_("trial period"), default=False, help_text=_("This period was opened as a trial. A durable marker on the row itself -- the subscription's own trial fields are cleared once it converts."))
+
+    class Meta:
+        verbose_name = _("due")
+        verbose_name_plural = _("dues")
+        ordering = ["-period_start", "club__name"]
+        constraints = [
+            models.UniqueConstraint(fields=["club", "period_start"], name="unique_due_per_club_per_period"),
+        ]
+
+    def __str__(self):
+        return f"{self.club} — {self.period_start} to {self.period_end}"
+
+    def save(self, *args, **kwargs):
+        # A period runs a rolling year from its start and the grace hangs off its end.
+        # Derived here so no caller can open a period without them.
+        if not self.period_end:
+            self.period_end = add_one_year(self.period_start) - timedelta(days=1)
+        if not self.grace_until:
+            self.grace_until = self.period_end + timedelta(days=GRACE_DAYS)
+        super().save(*args, **kwargs)
+
+    @property
+    def balance(self) -> Decimal:
+        return self.amount - self.amount_paid
+
+    @property
+    def is_owing(self) -> bool:
+        return self.status in self.OWING
+
+    def is_in_grace(self, today: date | None = None) -> bool:
+        """The period has ended unpaid, but the club is not archivable yet."""
+        today = today or timezone.localdate()
+
+        return self.is_owing and self.period_end < today <= self.grace_until
+
+    def is_overdue(self, today: date | None = None) -> bool:
+        """Unpaid past grace — this is what makes a club archivable."""
+        today = today or timezone.localdate()
+
+        return self.is_owing and self.grace_until < today
+
+
+class DuePayment(UUIDModel):
+    """Money received against a due.
+
+    Several may land on one due: a club that pays in two transfers must not read as unpaid,
+    and the half that did arrive has to be recorded somewhere.
+    """
+
+    class Method(models.TextChoices):
+        BANK_TRANSFER = "bank_transfer", _("bank transfer")
+        CARD = "card", _("card")
+        CASH = "cash", _("cash")
+        OTHER = "other", _("other")
+
+    due = models.ForeignKey(Due, on_delete=models.CASCADE, related_name="payments", verbose_name=_("due"))
+    amount = models.DecimalField(_("amount"), max_digits=10, decimal_places=2, validators=[MinValueValidator(Decimal("0.01"))])
+    method = models.CharField(_("method"), max_length=20, choices=Method.choices, default=Method.BANK_TRANSFER)
+    reference = models.CharField(_("reference"), max_length=255, blank=True, help_text=_("Bank reference, transaction id — whatever lets you find this again."))
+    paid_at = models.DateTimeField(_("paid at"), default=timezone.now)
+    note = models.TextField(_("note"), blank=True)
+    recorded_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True, related_name="recorded_due_payments", verbose_name=_("recorded by"))
+
+    class Meta:
+        verbose_name = _("due payment")
+        verbose_name_plural = _("due payments")
+        ordering = ["-paid_at"]
+
+    def __str__(self):
+        return f"{self.amount} — {self.due}"
+
+
+class Invoice(UUIDModel):
+    """The bill for one period.
+
+    Only the number and the issue date are stored: the money, the tier and the dates are
+    already frozen on the Due, so the PDF is rendered from those snapshots on demand. The
+    number, though, must be stable and gapless — it is the thing an accountant reconciles
+    against, so it is allocated once and never recomputed.
+    """
+
+    due = models.OneToOneField(Due, on_delete=models.CASCADE, related_name="invoice", verbose_name=_("due"))
+    number = models.CharField(_("number"), max_length=32, unique=True, blank=True)
+    issued_at = models.DateTimeField(_("issued at"), default=timezone.now)
+
+    class Meta:
+        verbose_name = _("invoice")
+        verbose_name_plural = _("invoices")
+        ordering = ["-issued_at"]
+
+    def __str__(self):
+        return self.number
+
+    def save(self, *args, **kwargs):
+        if not self.number:
+            self.number = self.next_number(self.issued_at.year)
+        super().save(*args, **kwargs)
+
+    @classmethod
+    def next_number(cls, year: int) -> str:
+        """INV-2026-00001, restarting each year.
+
+        Platform-wide, unlike the shop's order numbers, which are per club: these are OUR
+        invoices, and one sequence has to cover every club we bill.
+        """
+        prefix = f"INV-{year}-"
+        last = cls.objects.filter(number__startswith=prefix).order_by("-number").first()
+        sequence = int(last.number.removeprefix(prefix)) + 1 if last else 1
+
+        return f"{prefix}{sequence:05d}"
diff --git a/billing/services/__init__.py b/billing/services/__init__.py
new file mode 100644
index 0000000..b96f3b2
--- /dev/null
+++ b/billing/services/__init__.py
@@ -0,0 +1,6 @@
+class BillingError(Exception):
+    """A billing action that must not silently half-happen.
+
+    Lives here rather than in dues.py so invoices.py can raise it without the two modules
+    importing each other in a circle.
+    """
diff --git a/billing/services/dues.py b/billing/services/dues.py
new file mode 100644
index 0000000..d60367e
--- /dev/null
+++ b/billing/services/dues.py
@@ -0,0 +1,219 @@
+"""The billing lifecycle. Views and the archive command go through here, never through the
+models directly — a Due whose amount_paid disagrees with its payments is a wrong invoice.
+"""
+
+from datetime import date, timedelta
+from decimal import Decimal
+
+from django.db import transaction
+from django.db.models import DateField, OuterRef, Subquery, Sum
+from django.utils import timezone
+
+from billing.models import RENEWAL_LEAD_DAYS, ZERO, Due, DuePayment, Subscription, Tier, add_months
+from billing.services import BillingError
+from billing.services.invoices import issue_invoice
+
+
+def subscribe(club, tier: Tier, *, start: date | None = None, auto_archive: bool = True, auto_renew: bool = True) -> Subscription:
+    """Put a club on a tier and open its first period."""
+    subscription, _created = Subscription.objects.update_or_create(club=club, defaults={"tier": tier, "auto_archive": auto_archive, "auto_renew": auto_renew})
+    open_period(club, start=start)
+
+    return subscription
+
+
+@transaction.atomic
+def start_trial(club, trial_tier: Tier, *, post_trial_tier: Tier, trial_months: int, start: date | None = None, auto_renew: bool = True, auto_archive: bool = True) -> Due:
+    """Put a club on a short trial that switches itself to ``post_trial_tier`` the moment
+    the trial period is renewed -- see open_period()'s trial-conversion check.
+
+    Only for a club with no subscription yet -- converting an existing paying subscription
+    into a trial is a different, deliberately unsupported operation for now.
+    """
+    if trial_months <= 0:
+        raise BillingError("Trial length must be at least 1 month.")
+    if getattr(club, "subscription", None) is not None:
+        raise BillingError(f"{club} is already subscribed -- use Change plan instead.")
+
+    start = start or next_period_start(club)
+    trial_end = add_months(start, trial_months) - timedelta(days=1)
+
+    Subscription.objects.create(club=club, tier=trial_tier, trial_ends_at=trial_end, post_trial_tier=post_trial_tier, auto_renew=auto_renew, auto_archive=auto_archive)
+
+    return open_period(club, start=start, period_end=trial_end, is_trial=True)
+
+
+def next_period_start(club, today: date | None = None) -> date:
+    """Where the club's next period begins.
+
+    The day after the last one ended — not today. A club that pays two months late has still
+    used those two months, and restarting the clock at the payment date would quietly gift
+    them away. Callers can override; that is what the start field on the renew form is for.
+    """
+    today = today or timezone.localdate()
+    last = club.dues.exclude(status=Due.Status.CANCELLED).order_by("-period_end").first()
+
+    return last.period_end + timedelta(days=1) if last else today
+
+
+@transaction.atomic
+def open_period(club, *, start: date | None = None, tier: Tier | None = None, period_end: date | None = None, is_trial: bool = False) -> Due:
+    """Issue the next due for a club, snapshotting the tier and the price of the day."""
+    subscription = getattr(club, "subscription", None)
+    if tier is None:
+        if subscription is None:
+            raise BillingError(f"{club} has no tier: put it on a subscription before billing it.")
+        # A trial that has run its course: swap onto the pre-selected plan before billing
+        # the next period, rather than silently renewing the trial tier forever. Checked
+        # here (not in renew()) so it fires whether this period was opened by the renewal
+        # command or by a platform admin clicking "Open period"/"Reactivate" by hand --
+        # both call open_period() directly.
+        if subscription.trial_ends_at is not None and (start or next_period_start(club)) > subscription.trial_ends_at:
+            subscription.tier = subscription.post_trial_tier
+            subscription.trial_ends_at = None
+            subscription.post_trial_tier = None
+            subscription.save(update_fields=["tier", "trial_ends_at", "post_trial_tier"])
+        tier = subscription.tier
+
+    start = start or next_period_start(club)
+
+    amount = tier.price_on(start)
+    if amount is None:
+        raise BillingError(f"{tier} has no price in force on {start:%d %b %Y}. Add one before opening the period.")
+
+    if club.dues.filter(period_start=start).exists():
+        raise BillingError(f"{club} is already billed for a period starting {start:%d %b %Y}.")
+
+    due = Due.objects.create(club=club, tier=tier, amount=amount, period_start=start, period_end=period_end, is_trial=is_trial)
+    if amount == ZERO:
+        # Nothing is actually owed -- left at the default UNPAID, this would eventually
+        # trip is_overdue() and get a free club archived for non-payment of nothing.
+        due.status = Due.Status.PAID
+        due.paid_at = timezone.now()
+        due.save(update_fields=["status", "paid_at"])
+    issue_invoice(due)  # every period is billable the moment it opens
+
+    return due
+
+
+@transaction.atomic
+def record_payment(due: Due, amount: Decimal, *, method=DuePayment.Method.BANK_TRANSFER, reference: str = "", paid_at=None, note: str = "", user=None) -> DuePayment:
+    """Log money against a due and re-derive its status from the payments."""
+    if due.status in (Due.Status.WAIVED, Due.Status.CANCELLED):
+        raise BillingError(f"This period is {due.get_status_display()}; it cannot take a payment.")
+    if amount <= ZERO:
+        raise BillingError("A payment must be for a positive amount.")
+
+    payment = DuePayment.objects.create(due=due, amount=amount, method=method, reference=reference, paid_at=paid_at or timezone.now(), note=note, recorded_by=user)
+    _resettle(due)
+
+    return payment
+
+
+@transaction.atomic
+def remove_payment(payment: DuePayment) -> None:
+    """Undo a mis-keyed payment, then re-derive the due from what is left."""
+    due = payment.due
+    payment.delete()
+    _resettle(due)
+
+
+def _resettle(due: Due) -> None:
+    """Recompute amount_paid and status from the payments on record.
+
+    Summed from the payments rather than incremented: an increment drifts the moment a
+    payment is edited or deleted, and the drift is invisible — the number still looks like
+    money.
+    """
+    paid = due.payments.aggregate(total=Sum("amount"))["total"] or ZERO
+
+    due.amount_paid = paid
+    if paid >= due.amount:
+        due.status = Due.Status.PAID
+        due.paid_at = due.payments.order_by("-paid_at").first().paid_at
+    elif paid > ZERO:
+        due.status = Due.Status.PARTIAL
+        due.paid_at = None
+    else:
+        due.status = Due.Status.UNPAID
+        due.paid_at = None
+    due.save(update_fields=["amount_paid", "status", "paid_at", "modified"])
+
+
+@transaction.atomic
+def waive(due: Due, *, note: str = "") -> Due:
+    """Write a period off. It stops owing, and stops counting towards archiving."""
+    if due.payments.exists():
+        raise BillingError("This period has payments against it; remove them before waiving it.")
+
+    due.status = Due.Status.WAIVED
+    due.save(update_fields=["status", "modified"])
+
+    return due
+
+
+def owing_dues():
+    return Due.objects.filter(status__in=Due.OWING)
+
+
+def dues_in_grace(today: date | None = None):
+    """Period over, unpaid, not yet archivable."""
+    today = today or timezone.localdate()
+
+    return owing_dues().filter(period_end__lt=today, grace_until__gte=today)
+
+
+def dues_overdue(today: date | None = None):
+    """Past grace: these are the clubs the archive command would take down."""
+    today = today or timezone.localdate()
+
+    return owing_dues().filter(grace_until__lt=today)
+
+
+def archivable_clubs(today: date | None = None):
+    """Clubs the archive command would act on: overdue, still live, and opted in.
+
+    A club with auto_archive off is deliberately spared — that flag is how you keep a club
+    you are negotiating with from being switched off overnight.
+    """
+    return dues_overdue(today).filter(club__archived_at__isnull=True, club__subscription__auto_archive=True).select_related("club", "tier").order_by("club__name")
+
+
+@transaction.atomic
+def reactivate(club, *, start: date | None = None) -> Due:
+    """Bring an archived club back and bill it again.
+
+    The new period defaults to continuing from the last one, so a lapsed year is still owed.
+    Pass ``start`` to forgive the gap and begin today instead.
+    """
+    club.restore()
+
+    return open_period(club, start=start)
+
+
+def subscriptions_due_for_renewal(today: date | None = None, lead_days: int = RENEWAL_LEAD_DAYS):
+    """Clubs whose next period should be issued now.
+
+    Idempotent by construction: a club that has just been renewed has a latest period ending a
+    year out, which is past the horizon, so it cannot be picked up twice. Running the job twice
+    a day is harmless.
+
+    A subscription with no period at all (its only due was cancelled) counts too — a club on a
+    plan and billed for nothing is the leak this whole job exists to close.
+    """
+    today = today or timezone.localdate()
+    horizon = today + timedelta(days=lead_days)
+
+    latest_period_end = Subquery(
+        Due.objects.filter(club=OuterRef("club")).exclude(status=Due.Status.CANCELLED).order_by("-period_end").values("period_end")[:1],
+        output_field=DateField(),
+    )
+
+    subscriptions = Subscription.objects.filter(auto_renew=True, club__archived_at__isnull=True).select_related("club", "tier").annotate(latest_period_end=latest_period_end).order_by("club__name")
+
+    return [subscription for subscription in subscriptions if subscription.latest_period_end is None or subscription.latest_period_end <= horizon]
+
+
+def renew(subscription: Subscription) -> Due:
+    """Open the club's next period, continuing from the last one."""
+    return open_period(subscription.club)
diff --git a/billing/services/invoices.py b/billing/services/invoices.py
new file mode 100644
index 0000000..18cde7a
--- /dev/null
+++ b/billing/services/invoices.py
@@ -0,0 +1,40 @@
+"""Invoice PDFs.
+
+The PDF is rendered on demand from the Due's frozen snapshot (tier, amount, dates), so it
+carries no state of its own beyond the number. Only the number is stored — an accountant
+reconciles against it, so it is allocated once, never recomputed.
+"""
+
+from django.template.loader import render_to_string
+
+from billing.models import Due, Invoice
+from billing.services import BillingError
+
+
+def issue_invoice(due: Due) -> Invoice:
+    """One invoice per due, allocated once. Re-issuing returns the existing one rather than
+    burning a number — a gap in an invoice series is a question you do not want to answer."""
+    invoice, _created = Invoice.objects.get_or_create(due=due)
+
+    return invoice
+
+
+def render_pdf(html: str) -> bytes:
+    """HTML to PDF.
+
+    WeasyPrint is imported here, not at module scope: it binds to native pango/cairo
+    libraries, and a machine without them must still be able to run the app, the tests and
+    every other page — it should only fail when someone actually asks for a PDF, and say why.
+    """
+    try:
+        from weasyprint import HTML
+    except (ImportError, OSError) as error:
+        raise BillingError("PDF rendering needs the native pango/cairo libraries (on macOS: brew install pango).") from error
+
+    return HTML(string=html).write_pdf()
+
+
+def invoice_pdf(invoice: Invoice, base_url: str | None = None) -> bytes:
+    html = render_to_string("billing/invoice.html", {"invoice": invoice, "due": invoice.due, "club": invoice.due.club, "payments": invoice.due.payments.all()})
+
+    return render_pdf(html)
diff --git a/billing/templates/billing/invoice.html b/billing/templates/billing/invoice.html
new file mode 100644
index 0000000..e4f98fe
--- /dev/null
+++ b/billing/templates/billing/invoice.html
@@ -0,0 +1,106 @@
+{% load static %}
+
+{% comment %}
+    Rendered by WeasyPrint, not by a browser: this is a standalone document with its own
+    print stylesheet. It deliberately does NOT pull in app.css — daisyUI is built for a
+    screen, and half of it (dark theme, flex layouts) means nothing on paper.
+{% endcomment %}
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <title>{{ invoice.number }}</title>
+        <style>
+            @page {
+                size: A4;
+                margin: 20mm;
+                @bottom-center {
+                    content: "RosterChief — invoice {{ invoice.number }} — page " counter(page) " of " counter(pages);
+                    font-size: 8pt;
+                    color: #666;
+                }
+            }
+            body { font-family: sans-serif; font-size: 10pt; color: #111; }
+            h1 { font-size: 20pt; margin: 0 0 2mm; }
+            .muted { color: #666; }
+            .header { display: flex; justify-content: space-between; margin-bottom: 12mm; }
+            .parties { display: flex; justify-content: space-between; margin-bottom: 10mm; }
+            .parties h2 { font-size: 9pt; text-transform: uppercase; letter-spacing: 0.5pt; color: #666; margin: 0 0 2mm; }
+            table { width: 100%; border-collapse: collapse; margin-bottom: 6mm; }
+            th { text-align: left; font-size: 9pt; text-transform: uppercase; letter-spacing: 0.5pt; color: #666; border-bottom: 1px solid #ccc; padding: 2mm 0; }
+            td { padding: 2mm 0; border-bottom: 1px solid #eee; }
+            .right { text-align: right; }
+            .total td { font-weight: bold; border-bottom: 2px solid #111; border-top: 1px solid #111; }
+            .balance { font-size: 12pt; font-weight: bold; }
+            .paid { color: #15803d; }
+            .owed { color: #b91c1c; }
+        </style>
+    </head>
+    <body>
+        <div class="header">
+            <div>
+                <h1>RosterChief</h1>
+                <div class="muted">Club &amp; team management</div>
+            </div>
+            <div class="right">
+                <h1>Invoice</h1>
+                <div><strong>{{ invoice.number }}</strong></div>
+                <div class="muted">Issued {{ invoice.issued_at|date:"j F Y" }}</div>
+            </div>
+        </div>
+
+        <div class="parties">
+            <div>
+                <h2>Billed to</h2>
+                <div><strong>{{ club.name }}</strong></div>
+                <div class="muted">{{ club.slug }}.rosterchief.app</div>
+            </div>
+            <div class="right">
+                <h2>Period</h2>
+                <div>{{ due.period_start|date:"j F Y" }} — {{ due.period_end|date:"j F Y" }}</div>
+                <div class="muted">Payable by {{ due.grace_until|date:"j F Y" }}</div>
+            </div>
+        </div>
+
+        <table>
+            <thead>
+                <tr>
+                    <th>Description</th>
+                    <th class="right">Amount</th>
+                </tr>
+            </thead>
+            <tbody>
+                <tr>
+                    <td>
+                        <strong>{{ due.tier.name }}</strong> — platform subscription
+                        <div class="muted">{{ due.period_start|date:"j M Y" }} to {{ due.period_end|date:"j M Y" }}</div>
+                    </td>
+                    <td class="right">€{{ due.amount|floatformat:2 }}</td>
+                </tr>
+                {% for payment in payments %}
+                    <tr>
+                        <td class="muted">
+                            Payment received {{ payment.paid_at|date:"j M Y" }} ({{ payment.get_method_display }}{% if payment.reference %}, {{ payment.reference }}{% endif %})
+                        </td>
+                        <td class="right muted">−€{{ payment.amount|floatformat:2 }}</td>
+                    </tr>
+                {% endfor %}
+                <tr class="total">
+                    <td>Balance due</td>
+                    <td class="right balance {% if due.balance > 0 %}owed{% else %}paid{% endif %}">€{{ due.balance|floatformat:2 }}</td>
+                </tr>
+            </tbody>
+        </table>
+
+        {% if due.status == "paid" %}
+            <p class="paid"><strong>Paid in full.</strong> Thank you.</p>
+        {% elif due.status == "waived" %}
+            <p class="muted"><strong>Waived.</strong> Nothing is owed for this period.</p>
+        {% else %}
+            <p class="muted">
+                Payable by <strong>{{ due.grace_until|date:"j F Y" }}</strong>. Unpaid past that date the club is archived: its
+                subdomain stops resolving, though nothing is deleted.
+            </p>
+        {% endif %}
+    </body>
+</html>
diff --git a/billing/tests.py b/billing/tests.py
new file mode 100644
index 0000000..b00d53f
--- /dev/null
+++ b/billing/tests.py
@@ -0,0 +1,563 @@
+import datetime
+import sys
+from decimal import Decimal
+from io import StringIO
+from unittest import mock
+
+from django.core.management import call_command
+from django.core.management.base import CommandError
+from django.test import TestCase
+from django.utils import timezone
+
+from club.models import Club
+
+from .models import GRACE_DAYS, Due, Invoice, Subscription, Tier, TierPrice, add_one_year
+from .services import BillingError
+from .services.dues import archivable_clubs, dues_in_grace, dues_overdue, next_period_start, open_period, reactivate, record_payment, remove_payment, renew, start_trial, subscribe, subscriptions_due_for_renewal, waive
+from .services.invoices import invoice_pdf, issue_invoice, render_pdf
+
+
+class BillingTestBase(TestCase):
+    def setUp(self):
+        self.today = timezone.localdate()
+        self.club = Club.objects.create(name="Ajax United")
+        self.tier = Tier.objects.create(name="Standard")
+        # Priced well back, so a backdated (lapsed) period still has a price in force —
+        # opening one before any price existed is refused, and rightly so.
+        TierPrice.objects.create(tier=self.tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def bill(self, start=None, club=None):
+        return open_period(club or self.club, start=start, tier=self.tier)
+
+
+class TierPriceTests(BillingTestBase):
+    def test_the_price_in_force_is_the_latest_one_that_has_started(self):
+        TierPrice.objects.create(tier=self.tier, active_from=self.today, amount=Decimal("600.00"))
+
+        self.assertEqual(self.tier.price_on(self.today - datetime.timedelta(days=1)), Decimal("500.00"))
+        self.assertEqual(self.tier.price_on(self.today), Decimal("600.00"))
+
+    def test_a_future_price_does_not_apply_yet(self):
+        TierPrice.objects.create(tier=self.tier, active_from=self.today + datetime.timedelta(days=30), amount=Decimal("600.00"))
+
+        self.assertEqual(self.tier.price_on(self.today), Decimal("500.00"))
+
+    def test_a_tier_with_no_price_yet_cannot_be_billed(self):
+        # None must never be read as free.
+        empty = Tier.objects.create(name="Enterprise")
+
+        self.assertIsNone(empty.price_on(self.today))
+
+        with self.assertRaises(BillingError):
+            open_period(self.club, tier=empty)
+
+
+class PeriodTests(BillingTestBase):
+    def test_a_period_runs_a_rolling_year_with_a_grace_tail(self):
+        due = self.bill(start=datetime.date(2026, 3, 1))
+
+        self.assertEqual(due.period_end, datetime.date(2027, 2, 28))
+        self.assertEqual(due.grace_until, due.period_end + datetime.timedelta(days=GRACE_DAYS))
+
+    def test_a_leap_day_period_does_not_explode(self):
+        # 29 February has no counterpart in a common year.
+        self.assertEqual(add_one_year(datetime.date(2028, 2, 29)), datetime.date(2029, 2, 28))
+
+    def test_the_next_period_continues_from_the_last_one(self):
+        # Not from today: a club that pays two months late has still used those two months,
+        # and restarting the clock at the payment date would quietly gift them away.
+        first = self.bill(start=self.today - datetime.timedelta(days=400))
+
+        self.assertEqual(next_period_start(self.club), first.period_end + datetime.timedelta(days=1))
+
+    def test_a_first_period_starts_today(self):
+        self.assertEqual(next_period_start(self.club), self.today)
+
+    def test_the_amount_is_snapshotted_at_the_price_of_the_day(self):
+        due = self.bill()
+        TierPrice.objects.create(tier=self.tier, active_from=self.today + datetime.timedelta(days=1), amount=Decimal("900.00"))
+        due.refresh_from_db()
+
+        # Raising the rate must not rewrite what was already billed.
+        self.assertEqual(due.amount, Decimal("500.00"))
+
+    def test_a_club_cannot_be_billed_twice_for_one_period(self):
+        self.bill(start=self.today)
+
+        with self.assertRaises(BillingError):
+            self.bill(start=self.today)
+
+    def test_a_club_with_no_tier_cannot_be_billed(self):
+        with self.assertRaises(BillingError):
+            open_period(Club.objects.create(name="Feyenoord"))
+
+    def test_subscribing_puts_a_club_on_a_tier_and_opens_a_period(self):
+        club = Club.objects.create(name="Feyenoord")
+
+        subscribe(club, self.tier)
+
+        self.assertEqual(Subscription.objects.get(club=club).tier, self.tier)
+        self.assertEqual(club.dues.count(), 1)
+
+
+class PaymentTests(BillingTestBase):
+    def setUp(self):
+        super().setUp()
+        self.due = self.bill()
+
+    def test_a_part_payment_leaves_the_due_partially_paid(self):
+        record_payment(self.due, Decimal("200.00"))
+        self.due.refresh_from_db()
+
+        self.assertEqual(self.due.status, Due.Status.PARTIAL)
+        self.assertEqual(self.due.balance, Decimal("300.00"))
+        self.assertIsNone(self.due.paid_at)
+
+    def test_payments_accumulate_until_the_due_is_settled(self):
+        record_payment(self.due, Decimal("200.00"))
+        record_payment(self.due, Decimal("300.00"))
+        self.due.refresh_from_db()
+
+        self.assertEqual(self.due.status, Due.Status.PAID)
+        self.assertEqual(self.due.balance, Decimal("0.00"))
+        self.assertIsNotNone(self.due.paid_at)
+
+    def test_an_overpayment_still_settles_the_due(self):
+        record_payment(self.due, Decimal("600.00"))
+        self.due.refresh_from_db()
+
+        self.assertEqual(self.due.status, Due.Status.PAID)
+
+    def test_removing_a_payment_re_derives_the_due(self):
+        # amount_paid is summed from the payments, never incremented: an increment drifts the
+        # moment one is deleted, and the drift still looks like money.
+        first = record_payment(self.due, Decimal("200.00"))
+        record_payment(self.due, Decimal("300.00"))
+
+        remove_payment(first)
+        self.due.refresh_from_db()
+
+        self.assertEqual(self.due.amount_paid, Decimal("300.00"))
+        self.assertEqual(self.due.status, Due.Status.PARTIAL)
+
+    def test_removing_the_only_payment_puts_the_due_back_to_unpaid(self):
+        payment = record_payment(self.due, Decimal("500.00"))
+
+        remove_payment(payment)
+        self.due.refresh_from_db()
+
+        self.assertEqual(self.due.status, Due.Status.UNPAID)
+        self.assertEqual(self.due.amount_paid, Decimal("0.00"))
+        self.assertIsNone(self.due.paid_at)
+
+    def test_a_zero_payment_is_refused(self):
+        with self.assertRaises(BillingError):
+            record_payment(self.due, Decimal("0.00"))
+
+    def test_a_waived_period_cannot_take_a_payment(self):
+        waive(self.due)
+
+        with self.assertRaises(BillingError):
+            record_payment(self.due, Decimal("100.00"))
+
+    def test_a_period_with_payments_cannot_be_waived(self):
+        record_payment(self.due, Decimal("100.00"))
+
+        with self.assertRaises(BillingError):
+            waive(self.due)
+
+    def test_a_waived_period_owes_nothing_and_never_archives_a_club(self):
+        waive(self.due)
+        self.due.refresh_from_db()
+
+        self.assertFalse(self.due.is_owing)
+        self.assertFalse(self.due.is_overdue(self.due.grace_until + datetime.timedelta(days=1)))
+
+
+class GraceAndArchiveTests(BillingTestBase):
+    LAPSED = 365 + GRACE_DAYS + 10
+
+    def test_a_period_past_its_end_but_inside_grace_is_in_grace(self):
+        due = self.bill(start=self.today - datetime.timedelta(days=370))
+
+        self.assertTrue(due.is_in_grace(self.today))
+        self.assertFalse(due.is_overdue(self.today))
+        self.assertIn(due, dues_in_grace(self.today))
+
+    def test_a_period_past_grace_is_overdue(self):
+        due = self.bill(start=self.today - datetime.timedelta(days=self.LAPSED))
+
+        self.assertTrue(due.is_overdue(self.today))
+        self.assertFalse(due.is_in_grace(self.today))
+        self.assertIn(due, dues_overdue(self.today))
+
+    def test_a_paid_period_is_never_overdue(self):
+        due = self.bill(start=self.today - datetime.timedelta(days=self.LAPSED))
+        record_payment(due, Decimal("500.00"))
+        due.refresh_from_db()
+
+        self.assertFalse(due.is_overdue(self.today))
+        self.assertNotIn(due, dues_overdue(self.today))
+
+    def test_an_overdue_club_is_archivable(self):
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=self.LAPSED))
+
+        self.assertEqual(archivable_clubs(self.today).count(), 1)
+
+    def test_a_club_that_opted_out_is_never_archived(self):
+        # auto_archive off is how you stop a club you are negotiating with from being
+        # switched off overnight.
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=self.LAPSED), auto_archive=False)
+
+        self.assertEqual(archivable_clubs(self.today).count(), 0)
+
+    def test_an_already_archived_club_is_not_archived_again(self):
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=self.LAPSED))
+        self.club.archive()
+
+        self.assertEqual(archivable_clubs(self.today).count(), 0)
+
+
+class ArchiveCommandTests(BillingTestBase):
+    def setUp(self):
+        super().setUp()
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=365 + GRACE_DAYS + 10))
+
+    def run_command(self, *args):
+        out = StringIO()
+        call_command("archive_overdue_clubs", *args, stdout=out)
+        return out.getvalue()
+
+    def test_it_reports_without_archiving_by_default(self):
+        # The asymmetry is the point: this switches off paying customers, so a cron
+        # misconfiguration or a clock skew must cost an email, not a morning of angry clubs.
+        output = self.run_command()
+
+        self.club.refresh_from_db()
+        self.assertFalse(self.club.is_archived)
+        self.assertIn("Dry run", output)
+        self.assertIn("Ajax United", output)
+
+    def test_it_archives_with_commit(self):
+        self.run_command("--commit")
+
+        self.club.refresh_from_db()
+        self.assertTrue(self.club.is_archived)
+
+    def test_it_says_so_when_nothing_is_overdue(self):
+        record_payment(self.club.dues.first(), Decimal("500.00"))
+
+        self.assertIn("Nothing overdue", self.run_command())
+
+
+class ReactivationTests(BillingTestBase):
+    def setUp(self):
+        super().setUp()
+        # Through subscribe(), not open_period(): reactivating reads the club's tier off its
+        # subscription, and a club billed without one cannot be re-billed later.
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=400))
+        self.first = self.club.dues.first()
+        self.club.archive()
+
+    def test_reactivating_continues_from_the_lapsed_period_by_default(self):
+        due = reactivate(self.club)
+
+        self.club.refresh_from_db()
+        self.assertFalse(self.club.is_archived)
+        self.assertEqual(due.period_start, self.first.period_end + datetime.timedelta(days=1))
+
+    def test_a_chosen_start_forgives_the_gap(self):
+        due = reactivate(self.club, start=self.today)
+
+        self.assertEqual(due.period_start, self.today)
+
+
+class InvoiceTests(BillingTestBase):
+    def test_every_period_is_invoiced_when_it_opens(self):
+        due = self.bill()
+
+        self.assertTrue(Invoice.objects.filter(due=due).exists())
+
+    def test_numbers_run_in_one_platform_wide_series(self):
+        # Unlike the shop's per-club order numbers: these are OUR invoices, and one sequence
+        # covers every club we bill.
+        first = self.bill(start=self.today).invoice
+        second = open_period(Club.objects.create(name="Feyenoord"), tier=self.tier).invoice
+
+        year = timezone.now().year
+        self.assertEqual(first.number, f"INV-{year}-00001")
+        self.assertEqual(second.number, f"INV-{year}-00002")
+
+    def test_re_issuing_does_not_burn_a_number(self):
+        # A gap in an invoice series is a question you do not want to have to answer.
+        due = self.bill()
+
+        self.assertEqual(issue_invoice(due), due.invoice)
+        self.assertEqual(Invoice.objects.count(), 1)
+
+    def test_the_invoice_renders_the_frozen_snapshot(self):
+        due = self.bill()
+        record_payment(due, Decimal("200.00"), reference="TRX-9")
+        due.refresh_from_db()
+
+        with mock.patch("billing.services.invoices.render_pdf", return_value=b"%PDF-fake") as renderer:
+            invoice_pdf(due.invoice)
+
+        html = renderer.call_args.args[0]
+        self.assertIn("INV-", html)
+        self.assertIn("Ajax United", html)
+        self.assertIn("500.00", html)  # billed
+        self.assertIn("200.00", html)  # paid
+        self.assertIn("300.00", html)  # balance
+
+    def test_the_pdf_library_is_only_needed_when_a_pdf_is_asked_for(self):
+        # WeasyPrint binds to native pango/cairo. The app, the tests and every other page must
+        # run without them; only this call may fail.
+        with mock.patch.dict(sys.modules, {"weasyprint": mock.MagicMock()}):
+            sys.modules["weasyprint"].HTML.return_value.write_pdf.return_value = b"%PDF-1.7"
+
+            self.assertEqual(render_pdf("<p>hi</p>"), b"%PDF-1.7")
+
+    def test_a_missing_pdf_library_says_what_is_missing(self):
+        with mock.patch.dict(sys.modules, {"weasyprint": None}), self.assertRaises(BillingError) as caught:
+            render_pdf("<p>hi</p>")
+
+        self.assertIn("pango", str(caught.exception))
+
+
+class ModelStringTests(BillingTestBase):
+    def test_models_describe_themselves(self):
+        due = self.bill()
+        payment = record_payment(due, Decimal("10.00"))
+
+        self.assertEqual(str(self.tier), "Standard")
+        self.assertIn("500.00", str(self.tier.prices.first()))
+        self.assertIn("Ajax United", str(due))
+        self.assertIn("10.00", str(payment))
+        self.assertIn("INV-", str(due.invoice))
+        self.assertIn("Standard", str(subscribe(Club.objects.create(name="PSV"), self.tier)))
+
+
+class RenewalTests(BillingTestBase):
+    """The leak this closes: a club whose period lapses with its last due PAID owes nothing,
+    so dues_overdue() is empty, so archive_overdue_clubs never fires — and the club keeps
+    using the platform for free while every number on the dashboard stays green."""
+
+    def ending_in(self, days, **kwargs):
+        """A club whose current period ends `days` from now."""
+        club = Club.objects.create(name=f"Club {days}")
+        subscribe(club, self.tier, start=self.today - datetime.timedelta(days=365 - days), **kwargs)
+        return club
+
+    def test_a_club_nearing_its_end_date_is_picked_up(self):
+        club = self.ending_in(20)
+
+        due = [s.club for s in subscriptions_due_for_renewal()]
+
+        self.assertIn(club, due)
+
+    def test_a_club_with_a_period_beyond_the_horizon_is_left_alone(self):
+        club = self.ending_in(200)
+
+        self.assertNotIn(club, [s.club for s in subscriptions_due_for_renewal()])
+
+    def test_renewing_continues_from_the_last_period(self):
+        club = self.ending_in(20)
+        first = club.dues.first()
+
+        renew(club.subscription)
+
+        latest = club.dues.order_by("-period_start").first()
+        self.assertEqual(latest.period_start, first.period_end + datetime.timedelta(days=1))
+        self.assertEqual(club.dues.count(), 2)
+
+    def test_running_twice_does_not_bill_twice(self):
+        # Idempotent by construction: once renewed, the club's latest period ends a year out,
+        # which is past the horizon.
+        club = self.ending_in(20)
+
+        call_command("renew_subscriptions", stdout=StringIO())
+        call_command("renew_subscriptions", stdout=StringIO())
+
+        self.assertEqual(club.dues.count(), 2)
+
+    def test_a_club_that_opted_out_is_not_renewed(self):
+        club = self.ending_in(20, auto_renew=False)
+
+        self.assertNotIn(club, [s.club for s in subscriptions_due_for_renewal()])
+
+    def test_an_archived_club_is_not_renewed(self):
+        # Reactivation is the way back, and it opens a period of its own.
+        club = self.ending_in(20)
+        club.archive()
+
+        self.assertNotIn(club, [s.club for s in subscriptions_due_for_renewal()])
+
+    def test_the_new_period_is_billed_at_the_price_in_force_then(self):
+        club = self.ending_in(20)
+        TierPrice.objects.create(tier=self.tier, active_from=self.today, amount=Decimal("900.00"))
+
+        due = renew(club.subscription)
+
+        self.assertEqual(due.amount, Decimal("900.00"))  # the new rate
+        self.assertEqual(club.dues.order_by("period_start").first().amount, Decimal("500.00"))  # the old one, untouched
+
+    def test_the_new_period_is_invoiced(self):
+        club = self.ending_in(20)
+
+        due = renew(club.subscription)
+
+        self.assertTrue(due.invoice.number.startswith("INV-"))
+
+    def test_a_dry_run_issues_nothing(self):
+        club = self.ending_in(20)
+        out = StringIO()
+
+        call_command("renew_subscriptions", "--dry-run", stdout=out)
+
+        self.assertEqual(club.dues.count(), 1)
+        self.assertIn("would renew", out.getvalue())
+
+    def test_the_command_issues_by_default(self):
+        # The opposite asymmetry to archiving: NOT acting is the expensive failure here,
+        # because a club that is never billed is never chased either.
+        club = self.ending_in(20)
+
+        call_command("renew_subscriptions", stdout=StringIO())
+
+        self.assertEqual(club.dues.count(), 2)
+
+    def test_an_unpriced_tier_fails_loudly_without_stopping_the_others(self):
+        priced = self.ending_in(20)
+        broken = Club.objects.create(name="Unpriced FC")
+        subscribe(broken, self.tier, start=self.today - datetime.timedelta(days=350))
+        # Its next period starts beyond the last price... by removing every price, it cannot bill.
+        TierPrice.objects.all().delete()
+        cheap = Tier.objects.create(name="Cheap")
+        TierPrice.objects.create(tier=cheap, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("100.00"))
+        priced.subscription.tier = cheap
+        priced.subscription.save()
+
+        with self.assertRaises(CommandError):
+            call_command("renew_subscriptions", stdout=StringIO(), stderr=StringIO())
+
+        # ...and the club that COULD be billed still was.
+        self.assertEqual(priced.dues.count(), 2)
+
+    def test_a_subscription_with_no_period_at_all_is_renewed(self):
+        club = Club.objects.create(name="Orphan FC")
+        Subscription.objects.create(club=club, tier=self.tier)
+
+        self.assertIn(club, [s.club for s in subscriptions_due_for_renewal()])
+
+    def test_it_says_so_when_there_is_nothing_to_renew(self):
+        self.assertIn("Nothing to renew", self.run_renewal())
+
+    def run_renewal(self, *args):
+        out = StringIO()
+        call_command("renew_subscriptions", *args, stdout=out)
+        return out.getvalue()
+
+
+class RenewedButUnpaidTests(BillingTestBase):
+    """A club auto-renewed that never pays the new fee flows through the ordinary
+    unpaid -> grace -> overdue -> archive path. Renewal creates a normal Due; it does not
+    create a special case, and the safety net that the never-billed club slipped past now
+    fires, because there IS an unpaid due."""
+
+    def lapsed_club(self):
+        """A club on its first, PAID period — far enough back that a renewal from its end is
+        itself already past grace, so only the renewal's payment state decides the outcome."""
+        club = Club.objects.create(name="Renewed FC")
+        subscribe(club, self.tier, start=self.today - datetime.timedelta(days=800))
+        first = club.dues.first()
+        record_payment(first, first.amount)  # the FIRST period is settled; only the renewal is in question
+        return club
+
+    def test_an_unpaid_renewal_becomes_overdue_and_archivable(self):
+        club = self.lapsed_club()
+        renewed = renew(club.subscription)  # continues from the first period's end, unpaid
+
+        self.assertTrue(renewed.is_overdue(self.today))
+        self.assertIn(renewed, dues_overdue(self.today))
+        self.assertIn(club, [d.club for d in archivable_clubs(self.today)])
+
+    def test_a_paid_renewal_is_not_chased(self):
+        club = self.lapsed_club()
+        renewed = renew(club.subscription)
+        record_payment(renewed, renewed.amount)
+
+        self.assertNotIn(club, [d.club for d in archivable_clubs(self.today)])
+
+
+class TrialTests(BillingTestBase):
+    """A club with no subscription yet can be started on a short trial that switches
+    itself to a pre-selected plan automatically once the trial period is renewed --
+    see billing.services.dues.start_trial and the trial-conversion check in
+    open_period()."""
+
+    def setUp(self):
+        super().setUp()
+        self.trial_tier = Tier.objects.create(name="Trial")
+        TierPrice.objects.create(tier=self.trial_tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("50.00"))
+
+    def test_start_trial_creates_a_short_trial_period(self):
+        due = start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=2)
+
+        subscription = self.club.subscription
+        self.assertEqual(subscription.tier, self.trial_tier)
+        self.assertEqual(subscription.post_trial_tier, self.tier)
+        self.assertEqual(subscription.trial_ends_at, due.period_end)
+        self.assertTrue(due.is_trial)
+        # Roughly 2 months, nowhere near the standard ~1-year period.
+        self.assertLess((due.period_end - due.period_start).days, 65)
+
+    def test_start_trial_refuses_if_already_subscribed(self):
+        subscribe(self.club, self.tier)
+
+        with self.assertRaises(BillingError):
+            start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=2)
+
+    def test_start_trial_refuses_a_non_positive_length(self):
+        with self.assertRaises(BillingError):
+            start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=0)
+
+    def test_renewing_after_the_trial_switches_to_the_post_trial_tier(self):
+        start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=2)
+
+        due = renew(self.club.subscription)
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.subscription.tier, self.tier)
+        self.assertIsNone(self.club.subscription.trial_ends_at)
+        self.assertIsNone(self.club.subscription.post_trial_tier)
+        self.assertEqual(due.tier, self.tier)
+        self.assertFalse(due.is_trial)
+        self.assertEqual(due.amount, Decimal("500.00"))
+
+    def test_manually_opening_the_next_period_also_switches_tier(self):
+        # Same conversion must fire via the control panel's "Open period" button, which
+        # calls open_period() directly rather than renew().
+        start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=2)
+
+        open_period(self.club)
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.subscription.tier, self.tier)
+
+    def test_a_trial_nearing_its_end_is_picked_up_for_renewal(self):
+        start_trial(self.club, self.trial_tier, post_trial_tier=self.tier, trial_months=2, start=self.today - datetime.timedelta(days=50))
+
+        self.assertIn(self.club, [s.club for s in subscriptions_due_for_renewal()])
+
+    def test_a_zero_amount_trial_is_created_already_paid(self):
+        free_tier = Tier.objects.create(name="Free Trial")
+        TierPrice.objects.create(tier=free_tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("0.00"))
+
+        due = start_trial(self.club, free_tier, post_trial_tier=self.tier, trial_months=2)
+
+        self.assertEqual(due.status, Due.Status.PAID)
+        self.assertIsNotNone(due.paid_at)
+        far_future = due.grace_until + datetime.timedelta(days=100)
+        self.assertNotIn(due, dues_overdue(far_future))
+        self.assertNotIn(self.club, [d.club for d in archivable_clubs(far_future)])
diff --git a/club/__init__.py b/club/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/club/admin.py b/club/admin.py
new file mode 100644
index 0000000..6579f44
--- /dev/null
+++ b/club/admin.py
@@ -0,0 +1,65 @@
+from django.contrib import admin
+from django.utils.translation import gettext_lazy as _
+
+from .models import Club, ClubMembership, ClubRole, FeePayment, Season, Sponsor
+
+
+@admin.register(Club)
+class ClubAdmin(admin.ModelAdmin):
+    list_display = ["name", "slug", "sport_type"]
+    list_filter = ["sport_type"]
+    search_fields = ["name", "slug"]
+    prepopulated_fields = {"slug": ["name"]}
+    ordering = ["name"]
+
+
+@admin.register(Sponsor)
+class SponsorAdmin(admin.ModelAdmin):
+    list_display = ["name", "club", "start_date", "end_date"]
+    list_filter = ["club"]
+    search_fields = ["name"]
+
+
+@admin.register(Season)
+class SeasonAdmin(admin.ModelAdmin):
+    list_display = ["__str__", "club", "start_date", "end_date"]
+    list_filter = ["club"]
+    search_fields = ["club__name"]
+    ordering = ["club", "-start_date"]
+
+
+class FeePaymentInline(admin.TabularInline):
+    model = FeePayment
+    extra = 0
+    readonly_fields = ["recorded_by"]
+
+
+@admin.register(ClubMembership)
+class ClubMembershipAdmin(admin.ModelAdmin):
+    list_display = ["club__name", "member__last_name", "member__first_name", "season", "status", "fee_status", "fee_amount", "amount_paid", "license"]
+    search_fields = ["club__name", "member__last_name", "member__first_name", "license"]
+    list_filter = ["club", "season", "status", "fee_status"]
+    raw_id_fields = ["member"]
+    # Money is settled by club.services.fees, which re-derives fee_status from the payments.
+    readonly_fields = ["amount_paid", "fee_status"]
+    fieldsets = [
+        [None, {"fields": ["club", "season", "member"]}],
+        [_("Membership"), {"fields": ["license", "status", "fee_status", "fee_amount", "amount_paid"]}],
+        [_("Dates"), {"fields": ["signed_up_at", "activated_at"]}],
+    ]
+    inlines = [FeePaymentInline]
+
+
+@admin.register(FeePayment)
+class FeePaymentAdmin(admin.ModelAdmin):
+    list_display = ["membership", "amount", "method", "paid_at", "recorded_by"]
+    list_filter = ["method"]
+    search_fields = ["membership__club__name", "membership__member__last_name", "reference"]
+
+
+@admin.register(ClubRole)
+class ClubRoleAdmin(admin.ModelAdmin):
+    list_display = ["club__name", "member__last_name", "member__first_name", "role"]
+    search_fields = ["club__name", "member__last_name", "member__first_name"]
+    list_filter = ["club", "role"]
+    raw_id_fields = ["member"]
diff --git a/club/api.py b/club/api.py
new file mode 100644
index 0000000..71e2e28
--- /dev/null
+++ b/club/api.py
@@ -0,0 +1,58 @@
+"""Public read-only sponsors endpoint -- see api/urls.py for how this is
+mounted.
+"""
+
+import random
+import uuid
+from datetime import date
+
+from django.db.models import Q
+from django.utils import timezone
+from ninja import Router, Schema
+
+from api.errors import require_club
+
+from .models import Sponsor
+
+router = Router(tags=["sponsors"])
+
+
+class SponsorOut(Schema):
+    id: uuid.UUID
+    name: str
+    logo_url: str | None
+    url: str | None
+    start_date: date
+    end_date: date | None
+
+
+def _to_sponsor_out(sponsor, request) -> SponsorOut:
+    return SponsorOut(
+        id=sponsor.pk,
+        name=sponsor.name,
+        logo_url=request.build_absolute_uri(sponsor.logo.url) if sponsor.logo else None,
+        url=sponsor.url or None,
+        start_date=sponsor.start_date,
+        end_date=sponsor.end_date,
+    )
+
+
+@router.get("/", response=list[SponsorOut], summary="Active sponsors")
+def list_sponsors(request, randomize: bool = False):
+    """Sponsors currently "live": start_date has passed and either there's no
+    end_date (runs indefinitely once started) or it hasn't passed yet. Both
+    bounds are inclusive of today.
+
+    `randomize=true` shuffles the result (e.g. for a sponsor strip that
+    shouldn't always lead with the same one) -- shuffled in Python after a
+    stable-ordered fetch rather than an ORDER BY RANDOM(), which sponsor
+    counts are far too small to need and which SQLite/Postgres don't even
+    express the same way."""
+    club = require_club(request)
+    today = timezone.localdate()
+
+    sponsors = list(Sponsor.objects.filter(club=club, start_date__lte=today).filter(Q(end_date__isnull=True) | Q(end_date__gte=today)).order_by("name"))
+    if randomize:
+        random.shuffle(sponsors)
+
+    return [_to_sponsor_out(sponsor, request) for sponsor in sponsors]
diff --git a/club/apps.py b/club/apps.py
new file mode 100644
index 0000000..48e3b96
--- /dev/null
+++ b/club/apps.py
@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class ClubConfig(AppConfig):
+    name = "club"
+
+    def ready(self):
+        from . import signals  # noqa: F401
diff --git a/club/context_processors.py b/club/context_processors.py
new file mode 100644
index 0000000..8d2f0bc
--- /dev/null
+++ b/club/context_processors.py
@@ -0,0 +1,23 @@
+"""Tenant-aware page branding.
+
+Every page inherits its chrome from ``base_template``. On a club subdomain that
+resolves to the club-branded skin, on the base domain to the RosterChief one, so
+the auth screens (login, password reset, MFA, passkeys — anything allauth ships,
+now or later) follow the tenant without a single template of their own knowing
+that clubs exist.
+
+The control panel deliberately does *not* use this: it hardcodes the platform
+base, so no branding bug can ever dress the platform panel up as a club.
+"""
+
+PLATFORM_BASE_TEMPLATE = "_platform_base.html"
+CLUB_BASE_TEMPLATE = "_club_base.html"
+
+
+def branding(request):
+    club = getattr(request, "club", None)  # set by ClubTenantMiddleware
+
+    return {
+        "club": club,
+        "base_template": CLUB_BASE_TEMPLATE if club else PLATFORM_BASE_TEMPLATE,
+    }
diff --git a/club/management/__init__.py b/club/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/club/management/commands/__init__.py b/club/management/commands/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/club/management/commands/generate_seasons.py b/club/management/commands/generate_seasons.py
new file mode 100644
index 0000000..0f679db
--- /dev/null
+++ b/club/management/commands/generate_seasons.py
@@ -0,0 +1,57 @@
+"""Generate seasons ahead of time for every active club.
+
+Meant to run on a schedule (cron): safe to call repeatedly, since generate_seasons
+skips whatever already exists. No --dry-run/--commit gate on generation itself --
+unlike archiving a club or billing it, creating a future season row is additive
+and idempotent, same reasoning as extend_event_series (materialising occurrences).
+
+--resync is different: it can delete rows (any season that doesn't match a
+club's *current* season_start/season_duration_months, and isn't referenced by a
+membership), so it defaults to reporting only -- pass --commit alongside it to
+actually remove anything.
+"""
+
+from dateutil.relativedelta import relativedelta
+from django.utils import timezone
+
+from club.models import Club
+from club.services.seasons import generate_seasons, resync_seasons
+from features.commands import MaintenanceAwareCommand
+
+
+class Command(MaintenanceAwareCommand):
+    help = "Generate seasons up to N years ahead for every active club (default 2)."
+
+    def add_arguments(self, parser):
+        parser.add_argument("--years", type=int, default=2, help="How many years ahead to generate seasons for (default 2).")
+        parser.add_argument("--resync", action="store_true", help="Before generating, remove any existing seasons that don't match the club's current settings (skips any still referenced by a membership).")
+        parser.add_argument("--commit", action="store_true", help="With --resync, actually delete the seasons found to be wrong. Without it, --resync only reports what it would remove.")
+
+    def handle(self, *args, **options):
+        until = timezone.localdate() + relativedelta(years=options["years"])
+        clubs = Club.objects.active()
+
+        if options["resync"]:
+            total_removed, total_kept = 0, 0
+            for club in clubs:
+                removed, kept = resync_seasons(club, until, commit=options["commit"])
+                total_removed += len(removed)
+                total_kept += len(kept)
+                if removed:
+                    verb = "Removed" if options["commit"] else "Would remove"
+                    self.stdout.write(f"{club}: {verb} {len(removed)} season(s) that no longer match its settings.")
+                if kept:
+                    self.stdout.write(self.style.WARNING(f"{club}: {len(kept)} season(s) don't match its settings but are still in use, left alone."))
+
+            if not options["commit"] and total_removed:
+                self.stdout.write(self.style.WARNING("Dry run -- pass --commit to actually delete these."))
+            self.stdout.write(self.style.SUCCESS(f"Resync: {total_removed} season(s) {'removed' if options['commit'] else 'to remove'}, {total_kept} kept (in use)."))
+
+        total = 0
+        for club in clubs:
+            created = generate_seasons(club, until)
+            total += len(created)
+            if created:
+                self.stdout.write(f"{club}: generated {len(created)} season(s).")
+
+        self.stdout.write(self.style.SUCCESS(f"Done. Generated {total} season(s) across {clubs.count()} club(s)."))
diff --git a/club/migrations/0001_initial.py b/club/migrations/0001_initial.py
new file mode 100644
index 0000000..139ad1e
--- /dev/null
+++ b/club/migrations/0001_initial.py
@@ -0,0 +1,36 @@
+# Generated by Django 6.0.6 on 2026-07-02 14:24
+
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Club',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255)),
+            ],
+            options={
+                'verbose_name': 'club',
+                'verbose_name_plural': 'clubs',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='ClubMembership',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+    ]
diff --git a/club/migrations/0002_clubmembership_club_clubmembership_license_and_more.py b/club/migrations/0002_clubmembership_club_clubmembership_license_and_more.py
new file mode 100644
index 0000000..cb993cf
--- /dev/null
+++ b/club/migrations/0002_clubmembership_club_clubmembership_license_and_more.py
@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-07-05 13:50
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0003_alter_family_name_alter_familymembership_family_and_more'),
+        ('club', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='clubmembership',
+            name='club',
+            field=models.ForeignKey(default=1, on_delete=django.db.models.deletion.CASCADE, related_name='members', to='club.club'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='license',
+            field=models.CharField(default=1, max_length=250),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='member',
+            field=models.ForeignKey(default=1, on_delete=django.db.models.deletion.CASCADE, related_name='member_of', to='authentication.member'),
+            preserve_default=False,
+        ),
+    ]
diff --git a/club/migrations/0003_alter_clubmembership_options_alter_club_name_and_more.py b/club/migrations/0003_alter_clubmembership_options_alter_club_name_and_more.py
new file mode 100644
index 0000000..d909263
--- /dev/null
+++ b/club/migrations/0003_alter_clubmembership_options_alter_club_name_and_more.py
@@ -0,0 +1,43 @@
+# Generated by Django 6.0.6 on 2026-07-05 20:51
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0003_alter_family_name_alter_familymembership_family_and_more'),
+        ('club', '0002_clubmembership_club_clubmembership_license_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='clubmembership',
+            options={'ordering': ['club', 'member__last_name', 'member__first_name'], 'verbose_name': 'club membership', 'verbose_name_plural': 'club memberships'},
+        ),
+        migrations.AlterField(
+            model_name='club',
+            name='name',
+            field=models.CharField(max_length=255, verbose_name='name'),
+        ),
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='club',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='members', to='club.club', verbose_name='club'),
+        ),
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='license',
+            field=models.CharField(max_length=250, verbose_name='license'),
+        ),
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='member',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='member_of', to='authentication.member', verbose_name='member'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='clubmembership',
+            unique_together={('club', 'member')},
+        ),
+    ]
diff --git a/club/migrations/0004_alter_clubmembership_license.py b/club/migrations/0004_alter_clubmembership_license.py
new file mode 100644
index 0000000..87ffff5
--- /dev/null
+++ b/club/migrations/0004_alter_clubmembership_license.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-05 20:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0003_alter_clubmembership_options_alter_club_name_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='license',
+            field=models.CharField(blank=True, max_length=250, verbose_name='license'),
+        ),
+    ]
diff --git a/club/migrations/0005_alter_clubmembership_member.py b/club/migrations/0005_alter_clubmembership_member.py
new file mode 100644
index 0000000..34d2657
--- /dev/null
+++ b/club/migrations/0005_alter_clubmembership_member.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-11 22:09
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0004_alter_clubmembership_license'),
+        ('members', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='member',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='member_of', to='members.member', verbose_name='member'),
+        ),
+    ]
diff --git a/club/migrations/0006_club_slug_season.py b/club/migrations/0006_club_slug_season.py
new file mode 100644
index 0000000..ddb6cdb
--- /dev/null
+++ b/club/migrations/0006_club_slug_season.py
@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-07-12 13:11
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0005_alter_clubmembership_member'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='slug',
+            field=models.SlugField(blank=True, help_text='Drives subdomain / path resolution (e.g. ajax-united.clubmanager.app).', max_length=255, unique=True, verbose_name='slug'),
+        ),
+        migrations.CreateModel(
+            name='Season',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('start_date', models.DateField(verbose_name='start date')),
+                ('end_date', models.DateField(verbose_name='end date')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'season',
+                'verbose_name_plural': 'seasons',
+            },
+        ),
+    ]
diff --git a/club/migrations/0007_clubmembership_season_alter_clubmembership_club.py b/club/migrations/0007_clubmembership_season_alter_clubmembership_club.py
new file mode 100644
index 0000000..425d503
--- /dev/null
+++ b/club/migrations/0007_clubmembership_season_alter_clubmembership_club.py
@@ -0,0 +1,25 @@
+# Generated by Django 6.0.6 on 2026-07-12 13:43
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0006_club_slug_season'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='clubmembership',
+            name='season',
+            field=models.ForeignKey(default=1, on_delete=django.db.models.deletion.PROTECT, related_name='memberships', to='club.season', verbose_name='season'),
+            preserve_default=False,
+        ),
+        migrations.AlterField(
+            model_name='clubmembership',
+            name='club',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club'),
+        ),
+    ]
diff --git a/club/migrations/0008_alter_clubmembership_unique_together_and_more.py b/club/migrations/0008_alter_clubmembership_unique_together_and_more.py
new file mode 100644
index 0000000..24e8130
--- /dev/null
+++ b/club/migrations/0008_alter_clubmembership_unique_together_and_more.py
@@ -0,0 +1,46 @@
+# Generated by Django 6.0.6 on 2026-07-12 14:12
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0007_clubmembership_season_alter_clubmembership_club'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='clubmembership',
+            unique_together=set(),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='activated_at',
+            field=models.DateField(blank=True, null=True, verbose_name='activated at'),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='fee_status',
+            field=models.CharField(choices=[('unpaid', 'unpaid'), ('paid', 'paid'), ('partially_paid', 'partially paid'), ('waived', 'waived')], default='unpaid', max_length=250, verbose_name='fee status'),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='signed_up_at',
+            field=models.DateField(blank=True, null=True, verbose_name='signed up at'),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='status',
+            field=models.CharField(choices=[('active', 'active'), ('pending', 'pending'), ('lapsed', 'lapsed'), ('cancelled', 'cancelled')], default='pending', max_length=250, verbose_name='status'),
+        ),
+        migrations.AddConstraint(
+            model_name='clubmembership',
+            constraint=models.UniqueConstraint(fields=('club', 'member', 'season'), name='unique_member_per_club_per_season'),
+        ),
+        migrations.AddConstraint(
+            model_name='season',
+            constraint=models.UniqueConstraint(fields=('club', 'start_date', 'end_date'), name='unique_season_dates_per_club'),
+        ),
+    ]
diff --git a/club/migrations/0009_clubrole.py b/club/migrations/0009_clubrole.py
new file mode 100644
index 0000000..1c1d660
--- /dev/null
+++ b/club/migrations/0009_clubrole.py
@@ -0,0 +1,31 @@
+# Generated by Django 6.0.6 on 2026-07-12 21:43
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ClubRole',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('role', models.CharField(choices=[('admin', 'admin'), ('member', 'member'), ('editor', 'editor')], default='member', max_length=250, verbose_name='role')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='roles', to='members.member', verbose_name='member')),
+            ],
+            options={
+                'verbose_name': 'club role',
+                'verbose_name_plural': 'club roles',
+                'ordering': ['club', 'member__last_name', 'member__first_name'],
+                'constraints': [models.UniqueConstraint(fields=('club', 'member'), name='unique_member_per_club')],
+            },
+        ),
+    ]
diff --git a/club/migrations/0010_club_archived_at.py b/club/migrations/0010_club_archived_at.py
new file mode 100644
index 0000000..a07d5ec
--- /dev/null
+++ b/club/migrations/0010_club_archived_at.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-13 13:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0009_clubrole'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='archived_at',
+            field=models.DateTimeField(blank=True, help_text='Archived clubs stop resolving on their subdomain, but their data is retained.', null=True, verbose_name='archived at'),
+        ),
+    ]
diff --git a/club/migrations/0011_alter_club_slug.py b/club/migrations/0011_alter_club_slug.py
new file mode 100644
index 0000000..f00b4e8
--- /dev/null
+++ b/club/migrations/0011_alter_club_slug.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-13 13:39
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0010_club_archived_at'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='club',
+            name='slug',
+            field=models.SlugField(blank=True, help_text='Drives subdomain / path resolution (e.g. ajax-united.rosterchief.app).', max_length=255, unique=True, verbose_name='slug'),
+        ),
+    ]
diff --git a/club/migrations/0012_club_logo_club_primary_color.py b/club/migrations/0012_club_logo_club_primary_color.py
new file mode 100644
index 0000000..90a7b79
--- /dev/null
+++ b/club/migrations/0012_club_logo_club_primary_color.py
@@ -0,0 +1,25 @@
+# Generated by Django 6.0.6 on 2026-07-13 17:33
+
+import club.models
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0011_alter_club_slug'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='logo',
+            field=models.ImageField(blank=True, help_text="Shown on the club's own pages. Without one, the club's initials are used.", upload_to=club.models.club_logo_path, verbose_name='logo'),
+        ),
+        migrations.AddField(
+            model_name='club',
+            name='primary_color',
+            field=models.CharField(blank=True, help_text="Hex colour for buttons and links on the club's pages, e.g. #1e40af.", max_length=7, validators=[django.core.validators.RegexValidator('^#[0-9a-fA-F]{6}$', 'Enter a colour as a hex value, e.g. #1e40af.')], verbose_name='primary colour'),
+        ),
+    ]
diff --git a/club/migrations/0013_club_created_club_modified_clubmembership_created_and_more.py b/club/migrations/0013_club_created_club_modified_clubmembership_created_and_more.py
new file mode 100644
index 0000000..fcc113a
--- /dev/null
+++ b/club/migrations/0013_club_created_club_modified_clubmembership_created_and_more.py
@@ -0,0 +1,58 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0012_club_logo_club_primary_color'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565739, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='club',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565911, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='clubrole',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565939, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='clubrole',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='season',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565961, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='season',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+    ]
diff --git a/club/migrations/0014_club_secondary_color.py b/club/migrations/0014_club_secondary_color.py
new file mode 100644
index 0000000..8829a7b
--- /dev/null
+++ b/club/migrations/0014_club_secondary_color.py
@@ -0,0 +1,19 @@
+# Generated by Django 6.0.6 on 2026-07-24 16:30
+
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0013_club_created_club_modified_clubmembership_created_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='secondary_color',
+            field=models.CharField(blank=True, help_text="Hex colour for highlights on the club's pages, e.g. avatar initials. Defaults to the theme's secondary colour.", max_length=7, validators=[django.core.validators.RegexValidator('^#[0-9a-fA-F]{6}$', 'Enter a colour as a hex value, e.g. #be185d.')], verbose_name='secondary colour'),
+        ),
+    ]
diff --git a/club/migrations/0015_alter_club_logo.py b/club/migrations/0015_alter_club_logo.py
new file mode 100644
index 0000000..8c68c38
--- /dev/null
+++ b/club/migrations/0015_alter_club_logo.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-24 16:40
+
+import club.models
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0014_club_secondary_color'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='club',
+            name='logo',
+            field=models.FileField(blank=True, help_text="Shown on the club's own pages. Without one, the club's initials are used.", upload_to=club.models.club_logo_path, validators=[django.core.validators.FileExtensionValidator(allowed_extensions=['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg'])], verbose_name='logo'),
+        ),
+    ]
diff --git a/club/migrations/0016_clubmembership_amount_paid_clubmembership_fee_amount_and_more.py b/club/migrations/0016_clubmembership_amount_paid_clubmembership_fee_amount_and_more.py
new file mode 100644
index 0000000..eb2056a
--- /dev/null
+++ b/club/migrations/0016_clubmembership_amount_paid_clubmembership_fee_amount_and_more.py
@@ -0,0 +1,50 @@
+# Generated by Django 6.0.6 on 2026-08-03 11:22
+
+import django.core.validators
+import django.db.models.deletion
+import django.utils.timezone
+import uuid
+from decimal import Decimal
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0015_alter_club_logo'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='clubmembership',
+            name='amount_paid',
+            field=models.DecimalField(blank=True, decimal_places=2, default=Decimal('0.00'), help_text='Kept in step with payments by the fee service; not hand-edited.', max_digits=10, verbose_name='amount paid'),
+        ),
+        migrations.AddField(
+            model_name='clubmembership',
+            name='fee_amount',
+            field=models.DecimalField(blank=True, decimal_places=2, default=Decimal('0.00'), max_digits=10, verbose_name='fee amount'),
+        ),
+        migrations.CreateModel(
+            name='FeePayment',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, validators=[django.core.validators.MinValueValidator(Decimal('0.01'))], verbose_name='amount')),
+                ('method', models.CharField(choices=[('bank_transfer', 'bank transfer'), ('cash', 'cash'), ('card', 'card'), ('other', 'other')], default='bank_transfer', max_length=20, verbose_name='method')),
+                ('reference', models.CharField(blank=True, help_text='Bank reference, transaction id — whatever lets you find this again.', max_length=255, verbose_name='reference')),
+                ('paid_at', models.DateTimeField(default=django.utils.timezone.now, verbose_name='paid at')),
+                ('note', models.TextField(blank=True, verbose_name='note')),
+                ('membership', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='payments', to='club.clubmembership', verbose_name='membership')),
+                ('recorded_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='recorded_fee_payments', to=settings.AUTH_USER_MODEL, verbose_name='recorded by')),
+            ],
+            options={
+                'verbose_name': 'fee payment',
+                'verbose_name_plural': 'fee payments',
+                'ordering': ['-paid_at'],
+            },
+        ),
+    ]
diff --git a/club/migrations/0017_club_season_duration_months_club_season_start.py b/club/migrations/0017_club_season_duration_months_club_season_start.py
new file mode 100644
index 0000000..3f17ec9
--- /dev/null
+++ b/club/migrations/0017_club_season_duration_months_club_season_start.py
@@ -0,0 +1,25 @@
+# Generated by Django 6.0.6 on 2026-08-03 14:30
+
+import datetime
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0016_clubmembership_amount_paid_clubmembership_fee_amount_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='season_duration_months',
+            field=models.PositiveSmallIntegerField(default=12, help_text='How many months a season lasts, counted from its start date.', validators=[django.core.validators.MinValueValidator(1), django.core.validators.MaxValueValidator(24)], verbose_name='season duration (months)'),
+        ),
+        migrations.AddField(
+            model_name='club',
+            name='season_start',
+            field=models.DateField(default=datetime.date(2000, 8, 1), help_text='Which day of the year a season begins — only the month and day are used, the year is ignored.', verbose_name='season start'),
+        ),
+    ]
diff --git a/club/migrations/0018_club_sport_type.py b/club/migrations/0018_club_sport_type.py
new file mode 100644
index 0000000..8be9640
--- /dev/null
+++ b/club/migrations/0018_club_sport_type.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-08-04 22:09
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0017_club_season_duration_months_club_season_start'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='club',
+            name='sport_type',
+            field=models.CharField(choices=[('ice_hockey', 'Ice hockey'), ('other', 'Other')], default='other', help_text='Which sport this club plays -- determines which competitions and score fetchers are relevant to it.', max_length=20, verbose_name='sport'),
+        ),
+    ]
diff --git a/club/migrations/0019_sponsor.py b/club/migrations/0019_sponsor.py
new file mode 100644
index 0000000..d5191f7
--- /dev/null
+++ b/club/migrations/0019_sponsor.py
@@ -0,0 +1,36 @@
+# Generated by Django 6.0.6 on 2026-08-06 15:02
+
+import club.models
+import django.core.validators
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0018_club_sport_type'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Sponsor',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('logo', models.FileField(blank=True, upload_to=club.models.sponsor_logo_path, validators=[django.core.validators.FileExtensionValidator(allowed_extensions=['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg'])], verbose_name='logo')),
+                ('url', models.URLField(blank=True, help_text="The sponsor's own website, if they have one.", verbose_name='URL')),
+                ('start_date', models.DateField(verbose_name='start date')),
+                ('end_date', models.DateField(blank=True, help_text='Leave blank to keep this sponsor active indefinitely once it starts.', null=True, verbose_name='end date')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'sponsor',
+                'verbose_name_plural': 'sponsors',
+                'ordering': ['name'],
+            },
+        ),
+    ]
diff --git a/club/migrations/__init__.py b/club/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/club/mixins.py b/club/mixins.py
new file mode 100644
index 0000000..6e83a16
--- /dev/null
+++ b/club/mixins.py
@@ -0,0 +1,128 @@
+from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.http import Http404
+from waffle import flag_is_active
+
+from .services.access import can_add_news, can_edit_news, can_publish_news, has_management_access, is_club_admin, is_coach_manager, teams_managed_by
+
+
+class ClubStaffRequiredMixin(LoginRequiredMixin, UserPassesTestMixin):
+    """Gate for the club-facing management UI.
+
+    Two rules, the mirror image of ``controlpanel.mixins.PlatformStaffRequiredMixin``:
+
+    * **Club subdomain only.** This UI manages *one* club, so it doesn't exist on the
+      base domain — same reasoning as the control panel refusing to exist on a club
+      subdomain, just inverted.
+    * **Staff only.** ADMIN/EDITOR, or a current-season ``StaffAssignment`` (coach,
+      team manager, ...) — see ``has_management_access``. The plain MEMBER role every
+      active player/club member holds automatically does *not* count: a club member
+      with neither is a player/parent, and belongs in the separate app that serves
+      them.
+    """
+
+    def dispatch(self, request, *args, **kwargs):
+        if getattr(request, "club", None) is None:
+            raise Http404("The management app is not available on the base domain.")
+        return super().dispatch(request, *args, **kwargs)
+
+    def test_func(self):
+        return has_management_access(self.request.user, self.request.club)
+
+
+class ClubAdminRequiredMixin(ClubStaffRequiredMixin):
+    """ADMIN role only — club-wide settings that aren't scoped to a single team:
+    seasons, positions, roles, shop configuration."""
+
+    def test_func(self):
+        return is_club_admin(self.request.user, self.request.club)
+
+
+class FeatureRequiredMixin(ClubAdminRequiredMixin):
+    """Gate for a whole management section (shop, forms, ...) this club doesn't
+    have at all unless its waffle Flag (see the ``features`` app, set per-club
+    from the control panel's Features page) is active for it. Checked before
+    the admin-only test below and as a plain 404 rather than folded into
+    ``test_func``'s 403: a club with the feature off doesn't have a permissions
+    problem, the section just doesn't exist there, same reasoning as
+    ``ClubStaffRequiredMixin`` 404ing the whole app off the base domain.
+
+    Subclasses set ``feature_flag`` to the Flag's name, e.g. ``"shop"``.
+    """
+
+    feature_flag: str = ""
+
+    def dispatch(self, request, *args, **kwargs):
+        club = getattr(request, "club", None)
+        if club is not None and not flag_is_active(request, self.feature_flag):
+            raise Http404(f"The “{self.feature_flag}” feature isn't enabled for this club.")
+        return super().dispatch(request, *args, **kwargs)
+
+
+class TeamManagerRequiredMixin(ClubStaffRequiredMixin):
+    """A manager of *this* team, or a club ADMIN. ``self.get_team()`` must return the
+    ``Team`` the view acts on (e.g. from the URL's ``pk``) before ``test_func`` runs.
+    """
+
+    def get_team(self):
+        raise NotImplementedError("Subclasses must return the Team this view acts on.")
+
+    def test_func(self):
+        user, club = self.request.user, self.request.club
+        if is_club_admin(user, club):
+            return True
+        return teams_managed_by(user, club).filter(pk=self.get_team().pk).exists()
+
+
+class EventManagerRequiredMixin(ClubStaffRequiredMixin):
+    """Admin, or a manager of at least one of this event's/series' *current*
+    teams. ``self.get_teams()`` must return the Team queryset/iterable the
+    view acts on (e.g. ``self.get_object().teams.all()``) before ``test_func``
+    runs. Events/series aren't single-team like a roster entry -- ``teams`` is
+    M2M, so authority is "manages at least one", not "manages the one"."""
+
+    def get_teams(self):
+        raise NotImplementedError("Subclasses must return the Teams this view acts on.")
+
+    def test_func(self):
+        user, club = self.request.user, self.request.club
+        if is_club_admin(user, club):
+            return True
+        return teams_managed_by(user, club).filter(pk__in=self.get_teams().values_list("pk", flat=True)).exists()
+
+
+class ManagementPositionRequiredMixin(ClubStaffRequiredMixin):
+    """ADMIN, or anyone with a current-season *management*-position
+    StaffAssignment on any team -- unlike ``TeamManagerRequiredMixin``, the
+    entity here (Location, Opponent, ...) isn't scoped to one team, so "manager
+    of this team" doesn't apply; any management position qualifies."""
+
+    def test_func(self):
+        return is_club_admin(self.request.user, self.request.club) or is_coach_manager(self.request.user, self.request.club)
+
+
+class NewsAuthorRequiredMixin(ClubStaffRequiredMixin):
+    """ADMIN, EDITOR, or a current-season coach_manager -- who's trusted to
+    author club content in the first place (creating a draft)."""
+
+    def test_func(self):
+        return can_add_news(self.request.user, self.request.club)
+
+
+class NewsPublisherRequiredMixin(ClubStaffRequiredMixin):
+    """ADMIN/EDITOR only -- the release-flow gate for pushing a news item live
+    (or pulling it back)."""
+
+    def test_func(self):
+        return can_publish_news(self.request.user, self.request.club)
+
+
+class NewsEditRequiredMixin(ClubStaffRequiredMixin):
+    """Whoever may edit *this* news item right now: broad while it's a draft,
+    editor/admin-only once published. ``self.get_news_item()`` must return the
+    News the view acts on before ``test_func`` runs."""
+
+    def get_news_item(self):
+        raise NotImplementedError("Subclasses must return the News item this view acts on.")
+
+    def test_func(self):
+        return can_edit_news(self.request.user, self.get_news_item())
diff --git a/club/models.py b/club/models.py
new file mode 100644
index 0000000..4123466
--- /dev/null
+++ b/club/models.py
@@ -0,0 +1,322 @@
+import datetime
+from decimal import Decimal
+
+from django.conf import settings
+from django.core.exceptions import ValidationError
+from django.core.validators import FileExtensionValidator, MaxValueValidator, MinValueValidator, RegexValidator
+from django.db import models
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel, unique_slugify, validate_club_scope
+
+
+class ClubManager(models.Manager):
+    def current(self):
+        """Return the club for the active tenant context, if any."""
+        from .tenancy import get_current_club
+
+        return get_current_club()
+
+    def active(self):
+        return self.filter(archived_at__isnull=True)
+
+    def archived(self):
+        return self.filter(archived_at__isnull=False)
+
+
+def club_logo_path(instance: Club, filename: str) -> str:
+    return f"clubs/{instance.slug}/{filename}"
+
+
+class Club(UUIDModel):
+    class SportType(models.TextChoices):
+        """Which sport this club plays. Only two options for now -- expand this as
+        more sport-specific competition fetchers (see events.competition) are added."""
+
+        ICE_HOCKEY = "ice_hockey", _("Ice hockey")
+        OTHER = "other", _("Other")
+
+    name = models.CharField(_("name"), max_length=255)
+    slug = models.SlugField(_("slug"), max_length=255, unique=True, blank=True, help_text=_("Drives subdomain / path resolution (e.g. ajax-united.rosterchief.app)."))
+
+    logo = models.FileField(
+        _("logo"),
+        upload_to=club_logo_path,
+        blank=True,
+        # A plain FileField, not ImageField: Pillow (which ImageField validates through)
+        # cannot read SVGs, and club crests are commonly vector logos.
+        validators=[FileExtensionValidator(allowed_extensions=["png", "jpg", "jpeg", "gif", "webp", "svg"])],
+        help_text=_("Shown on the club's own pages. Without one, the club's initials are used."),
+    )
+    primary_color = models.CharField(
+        _("primary colour"),
+        max_length=7,
+        blank=True,
+        validators=[RegexValidator(r"^#[0-9a-fA-F]{6}$", _("Enter a colour as a hex value, e.g. #1e40af."))],
+        help_text=_("Hex colour for buttons and links on the club's pages, e.g. #1e40af."),
+    )
+
+    secondary_color = models.CharField(
+        _("secondary colour"),
+        max_length=7,
+        blank=True,
+        validators=[RegexValidator(r"^#[0-9a-fA-F]{6}$", _("Enter a colour as a hex value, e.g. #be185d."))],
+        help_text=_("Hex colour for highlights on the club's pages, e.g. avatar initials. Defaults to the theme's secondary colour."),
+    )
+
+    sport_type = models.CharField(
+        _("sport"),
+        max_length=20,
+        choices=SportType.choices,
+        default=SportType.OTHER,
+        help_text=_("Which sport this club plays -- determines which competitions and score fetchers are relevant to it."),
+    )
+
+    archived_at = models.DateTimeField(_("archived at"), null=True, blank=True, help_text=_("Archived clubs stop resolving on their subdomain, but their data is retained."))
+
+    season_start = models.DateField(
+        _("season start"),
+        default=datetime.date(2000, 8, 1),
+        help_text=_("Which day of the year a season begins — only the month and day are used, the year is ignored."),
+    )
+    season_duration_months = models.PositiveSmallIntegerField(
+        _("season duration (months)"),
+        default=12,
+        validators=[MinValueValidator(1), MaxValueValidator(24)],
+        help_text=_("How many months a season lasts, counted from its start date."),
+    )
+
+    objects = ClubManager()
+
+    class Meta:
+        verbose_name = _("club")
+        verbose_name_plural = _("clubs")
+        ordering = ["name"]
+
+    def __str__(self):
+        return self.name
+
+    def save(self, *args, **kwargs):
+        if not self.slug:
+            self.slug = unique_slugify(self, self.name)
+        super().save(*args, **kwargs)
+
+    @property
+    def is_archived(self) -> bool:
+        return self.archived_at is not None
+
+    @property
+    def initials(self) -> str:
+        """Stand-in for a missing logo. Never the RosterChief mark — that would
+        pass our branding off as the club's own."""
+        return "".join(word[0] for word in self.name.split()[:2]).upper()
+
+    @property
+    def primary_content_color(self) -> str:
+        """Readable text colour to sit *on* ``primary_color``. See ``_content_color_for``."""
+        return self._content_color_for(self.primary_color)
+
+    @property
+    def secondary_content_color(self) -> str:
+        """Readable text colour to sit *on* ``secondary_color``. See ``_content_color_for``."""
+        return self._content_color_for(self.secondary_color)
+
+    @staticmethod
+    def _content_color_for(hex_color: str) -> str:
+        """Black or white, whichever reads on ``hex_color``.
+
+        A club picking a pale yellow would otherwise get white-on-yellow buttons.
+        Relative luminance per WCAG, with its 0.179 threshold for black vs white.
+        """
+        if not hex_color:
+            return ""
+
+        def channel(value: int) -> float:
+            fraction = value / 255
+            return fraction / 12.92 if fraction <= 0.04045 else ((fraction + 0.055) / 1.055) ** 2.4
+
+        red, green, blue = (channel(int(hex_color[index : index + 2], 16)) for index in (1, 3, 5))
+        luminance = 0.2126 * red + 0.7152 * green + 0.0722 * blue
+
+        return "#000000" if luminance > 0.179 else "#ffffff"
+
+    def archive(self):
+        """Soft-delete: the club stops resolving, but nothing is destroyed.
+
+        Clubs are never hard-deleted — a club with any data cannot be removed
+        anyway (ClubMembership PROTECTs its Season), and financial records must
+        be retained.
+        """
+        if not self.is_archived:
+            self.archived_at = timezone.now()
+            self.save(update_fields=["archived_at"])
+
+    def restore(self):
+        if self.is_archived:
+            self.archived_at = None
+            self.save(update_fields=["archived_at"])
+
+
+def sponsor_logo_path(instance: Sponsor, filename: str) -> str:
+    return f"clubs/{instance.club.slug}/sponsors/{instance.pk}/{filename}"
+
+
+class Sponsor(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    logo = models.FileField(
+        _("logo"),
+        upload_to=sponsor_logo_path,
+        blank=True,
+        # A plain FileField, not ImageField: same reasoning as Club.logo -- a
+        # sponsor's own logo is just as commonly a vector file, and ImageField's
+        # Pillow validation can't read those.
+        validators=[FileExtensionValidator(allowed_extensions=["png", "jpg", "jpeg", "gif", "webp", "svg"])],
+    )
+    url = models.URLField(_("URL"), blank=True, help_text=_("The sponsor's own website, if they have one."))
+
+    start_date = models.DateField(_("start date"))
+    end_date = models.DateField(_("end date"), null=True, blank=True, help_text=_("Leave blank to keep this sponsor active indefinitely once it starts."))
+
+    class Meta:
+        verbose_name = _("sponsor")
+        verbose_name_plural = _("sponsors")
+        ordering = ["name"]
+
+    def __str__(self):
+        return self.name
+
+    def clean(self):
+        if self.end_date is not None and self.start_date is not None and self.end_date < self.start_date:
+            raise ValidationError({"end_date": _("End date can't be before the start date.")})
+
+
+class Season(ClubScopedModel):
+    start_date = models.DateField(_("start date"))
+    end_date = models.DateField(_("end date"))
+
+    def __str__(self):
+        return self.name
+
+    class Meta:
+        verbose_name = _("season")
+        verbose_name_plural = _("seasons")
+        constraints = [
+            models.UniqueConstraint(fields=["club", "start_date", "end_date"], name="unique_season_dates_per_club"),
+        ]
+
+    @property
+    def name(self):
+        """Short label built from the start/end years, e.g. "25-26"."""
+        return f"{self.start_date:%y}-{self.end_date:%y}"
+
+    @classmethod
+    def get_current(cls, date: datetime.date | None = None):
+        """Return the current club's season covering ``date`` (today by default)."""
+        if date is None:
+            date = timezone.now().date()
+
+        return cls.objects.current_club().filter(start_date__lte=date, end_date__gte=date).first()
+
+    @classmethod
+    def covering(cls, club, date: datetime.date):
+        """Return ``club``'s season covering ``date`` (no tenant context needed)."""
+        return cls.objects.filter(club=club, start_date__lte=date, end_date__gte=date).first()
+
+    @classmethod
+    def next_after(cls, club, date: datetime.date):
+        """Return ``club``'s soonest season starting after ``date`` (no tenant
+        context needed) -- the season that follows the one covering ``date``."""
+        return cls.objects.filter(club=club, start_date__gt=date).order_by("start_date").first()
+
+
+class ClubMembership(ClubScopedModel):
+    class StatusChoices(models.TextChoices):
+        ACTIVE = "active", _("active")
+        PENDING = "pending", _("pending")
+        LAPSED = "lapsed", _("lapsed")
+        CANCELLED = "cancelled", _("cancelled")
+
+    class FeeStatus(models.TextChoices):
+        UNPAID = "unpaid", _("unpaid")
+        PAID = "paid", _("paid")
+        PARTIALLY_PAID = "partially_paid", _("partially paid")
+        WAIVED = "waived", _("waived")
+
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="member_of", verbose_name=_("member"))
+    season = models.ForeignKey(Season, on_delete=models.PROTECT, related_name="memberships", verbose_name=_("season"))
+
+    license = models.CharField(_("license"), max_length=250, blank=True)
+    status = models.CharField(_("status"), max_length=250, choices=StatusChoices.choices, default=StatusChoices.PENDING)
+    fee_status = models.CharField(_("fee status"), max_length=250, choices=FeeStatus.choices, default=FeeStatus.UNPAID)
+
+    fee_amount = models.DecimalField(_("fee amount"), max_digits=10, decimal_places=2, default=Decimal("0.00"), blank=True)
+    amount_paid = models.DecimalField(_("amount paid"), max_digits=10, decimal_places=2, default=Decimal("0.00"), blank=True, help_text=_("Kept in step with payments by the fee service; not hand-edited."))
+
+    signed_up_at = models.DateField(_("signed up at"), blank=True, null=True)
+    activated_at = models.DateField(_("activated at"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("club membership")
+        verbose_name_plural = _("club memberships")
+        ordering = ["club", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["club", "member", "season"], name="unique_member_per_club_per_season"),
+        ]
+
+    def __str__(self):
+        return f"{self.club} - {self.member}"
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("season",))
+
+
+class FeePayment(UUIDModel):
+    """Money received against one membership's fee. Several may land on one
+    membership: a family paying in two installments must not read as unpaid, and
+    the part that did arrive has to be recorded somewhere. Not itself club-scoped
+    -- its club is reached through ``membership``, same as DuePayment/Due."""
+
+    class Method(models.TextChoices):
+        BANK_TRANSFER = "bank_transfer", _("bank transfer")
+        CASH = "cash", _("cash")
+        CARD = "card", _("card")
+        OTHER = "other", _("other")
+
+    membership = models.ForeignKey(ClubMembership, on_delete=models.CASCADE, related_name="payments", verbose_name=_("membership"))
+    amount = models.DecimalField(_("amount"), max_digits=10, decimal_places=2, validators=[MinValueValidator(Decimal("0.01"))])
+    method = models.CharField(_("method"), max_length=20, choices=Method.choices, default=Method.BANK_TRANSFER)
+    reference = models.CharField(_("reference"), max_length=255, blank=True, help_text=_("Bank reference, transaction id — whatever lets you find this again."))
+    paid_at = models.DateTimeField(_("paid at"), default=timezone.now)
+    note = models.TextField(_("note"), blank=True)
+    recorded_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True, related_name="recorded_fee_payments", verbose_name=_("recorded by"))
+
+    class Meta:
+        verbose_name = _("fee payment")
+        verbose_name_plural = _("fee payments")
+        ordering = ["-paid_at"]
+
+    def __str__(self):
+        return f"{self.membership} — {self.amount}"
+
+
+class ClubRole(ClubScopedModel):
+    class Roles(models.TextChoices):
+        ADMIN = "admin", _("admin")
+        MEMBER = "member", _("member")
+        EDITOR = "editor", _("editor")
+
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="roles", verbose_name=_("member"))
+    role = models.CharField(_("role"), max_length=250, choices=Roles.choices, default=Roles.MEMBER)
+
+    class Meta:
+        verbose_name = _("club role")
+        verbose_name_plural = _("club roles")
+        ordering = ["club", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["club", "member"], name="unique_member_per_club"),
+        ]
+
+    def __str__(self):
+        return f"{self.club} - {self.member}"
diff --git a/club/services/__init__.py b/club/services/__init__.py
new file mode 100644
index 0000000..0c594c5
--- /dev/null
+++ b/club/services/__init__.py
@@ -0,0 +1,10 @@
+from .access import can_edit_event, can_manage_shop, has_club_role, members_visible_to, roles_in_club, teams_managed_by
+
+__all__ = [
+    "can_edit_event",
+    "can_manage_shop",
+    "has_club_role",
+    "members_visible_to",
+    "roles_in_club",
+    "teams_managed_by",
+]
diff --git a/club/services/access.py b/club/services/access.py
new file mode 100644
index 0000000..c5e68b6
--- /dev/null
+++ b/club/services/access.py
@@ -0,0 +1,172 @@
+"""Per-club access decisions.
+
+All authorisation goes through this module (ARCHITECTURE §3): stored
+``ClubRole`` rows plus object-scoped facts — coach/manager is *derived* from
+``StaffAssignment`` (never a ClubRole), and parent/guardian from the family
+graph. ADMIN is the club-wide override.
+
+Two axes, deliberately separate:
+
+* **Authority** (``teams_managed_by``, ``can_edit_event``) requires a
+  *management* position, and only for the **current season** — a StaffAssignment
+  is per-season, so a former coach's authority expires with it. (A ``ClubRole``,
+  by contrast, is permanent and survives a lapsed membership.)
+* **Visibility** (``teams_staffed_by`` → ``members_visible_to``) covers *any*
+  staff position, so support staff (physio, kit manager) can see the roster they
+  work with without gaining any authority over it.
+"""
+
+from django.db.models import Q, QuerySet
+from django.utils import timezone
+
+from authentication.models import User
+from club.models import Club, ClubRole, Season
+from events.models import Event
+from members.models import FamilyMembership, Member
+from teams.models import StaffAssignment, Team
+
+#: Derived (never stored) roles.
+COACH = "coach"
+MANAGER = "manager"
+COACH_MANAGER = "coach_manager"
+
+
+def current_season(club: Club) -> Season | None:
+    """The club's season covering today. Staff authority is scoped to it."""
+    return Season.covering(club, timezone.localdate())
+
+
+def event_season(event: Event) -> Season | None:
+    """The season an event belongs to (explicit, else derived from its start)."""
+    return event.season or Season.covering(event.club, event.start.date())
+
+
+def has_club_role(user: User, club: Club, role: ClubRole.Roles) -> bool:
+    return ClubRole.objects.filter(member__user=user, club=club, role=role).exists()
+
+
+def is_club_admin(user: User, club: Club) -> bool:
+    return has_club_role(user, club, ClubRole.Roles.ADMIN)
+
+
+def has_management_access(user: User, club: Club) -> bool:
+    """Anyone with real authority in the club: ADMIN/EDITOR, or *any* current-season
+    staff assignment (coach, team manager, physio, ...).
+
+    Deliberately excludes the plain MEMBER role -- every signed-up player (or club
+    member generally) holds that automatically the moment their ClubMembership goes
+    active (club/signals.py), so it says nothing about whether someone is staff.
+    """
+    elevated = ClubRole.objects.filter(member__user=user, club=club, role__in=(ClubRole.Roles.ADMIN, ClubRole.Roles.EDITOR)).exists()
+    return elevated or teams_staffed_by(user, club).exists()
+
+
+def is_coach_manager(user: User, club: Club) -> bool:
+    """Derived from a current-season StaffAssignment in a *management* position."""
+    return StaffAssignment.objects.filter(
+        member__user=user,
+        team__club=club,
+        position__management_position=True,
+        season=current_season(club),
+    ).exists()
+
+
+def roles_in_club(user: User, club: Club) -> set[str]:
+    """The user's roles in ``club``, including the derived COACH_MANAGER role."""
+    roles = set(ClubRole.objects.filter(member__user=user, club=club).values_list("role", flat=True))
+    if is_coach_manager(user, club):
+        roles.add(COACH_MANAGER)
+    return roles
+
+
+def teams_managed_by(user: User, club: Club) -> QuerySet[Team]:
+    """Teams the user has authority over: all for an ADMIN, else the ones they
+    manage *this season* (management position only)."""
+    if is_club_admin(user, club):
+        return Team.objects.filter(club=club)
+    return Team.objects.filter(
+        club=club,
+        staff_assignments__member__user=user,
+        staff_assignments__position__management_position=True,
+        staff_assignments__season=current_season(club),
+    ).distinct()
+
+
+def teams_staffed_by(user: User, club: Club) -> QuerySet[Team]:
+    """Teams the user is on the staff of this season, management or not.
+
+    Visibility only — being a team's physio grants sight of the roster, never
+    authority over it.
+    """
+    return Team.objects.filter(
+        club=club,
+        staff_assignments__member__user=user,
+        staff_assignments__season=current_season(club),
+    ).distinct()
+
+
+def members_visible_to(user: User, club: Club) -> QuerySet[Member]:
+    """Members the user may see.
+
+    ADMIN: everyone linked to the club (membership, roster, staff or role).
+    Otherwise: themselves, their children, and the current-season players *and*
+    staff of every team they're staffed on.
+    """
+    if is_club_admin(user, club):
+        return Member.objects.filter(Q(member_of__club=club) | Q(team_memberships__team__club=club) | Q(staff_assignments__team__club=club) | Q(roles__club=club)).distinct()
+
+    me = Member.objects.filter(user=user).first()
+    if me is None:
+        return Member.objects.none()
+
+    children = Member.objects.filter(
+        family_memberships__role=FamilyMembership.FamilyRole.CHILD,
+        family_memberships__family__memberships__member=me,
+        family_memberships__family__memberships__role__in=[FamilyMembership.FamilyRole.PARENT, FamilyMembership.FamilyRole.GUARDIAN],
+    )
+
+    season = current_season(club)
+    teams = teams_staffed_by(user, club)
+    roster = Member.objects.filter(Q(team_memberships__team__in=teams, team_memberships__season=season) | Q(staff_assignments__team__in=teams, staff_assignments__season=season))
+
+    visible = {me.pk} | set(children.values_list("pk", flat=True)) | set(roster.values_list("pk", flat=True))
+    return Member.objects.filter(pk__in=visible)
+
+
+def can_edit_event(user: User, event: Event) -> bool:
+    """ADMIN/EDITOR in the club, the event's owner, or a manager of one of its
+    teams *for that event's season*."""
+    club = event.club
+    if is_club_admin(user, club) or has_club_role(user, club, ClubRole.Roles.EDITOR):
+        return True
+    if event.created_by_id is not None and event.created_by.user_id == user.pk:
+        return True
+    return StaffAssignment.objects.filter(
+        member__user=user,
+        team__in=event.teams.all(),
+        position__management_position=True,
+        season=event_season(event),
+    ).exists()
+
+
+def can_manage_shop(user: User, club: Club) -> bool:
+    return is_club_admin(user, club)
+
+
+def can_add_news(user: User, club: Club) -> bool:
+    """ADMIN, EDITOR, or a current-season coach_manager -- who's trusted to
+    author club content, not just anyone on staff (a physio shouldn't post news)."""
+    return is_club_admin(user, club) or has_club_role(user, club, ClubRole.Roles.EDITOR) or is_coach_manager(user, club)
+
+
+def can_publish_news(user: User, club: Club) -> bool:
+    """Only ADMIN/EDITOR may push a news item live -- the release-flow gate."""
+    return is_club_admin(user, club) or has_club_role(user, club, ClubRole.Roles.EDITOR)
+
+
+def can_edit_news(user: User, news_item) -> bool:
+    """Broad while it's a draft (anyone who could create one); editor/admin-only
+    once published -- an editor is accountable for what's actually live."""
+    if news_item.status == news_item.Status.PUBLISHED:
+        return can_publish_news(user, news_item.club)
+    return can_add_news(user, news_item.club)
diff --git a/club/services/fees.py b/club/services/fees.py
new file mode 100644
index 0000000..5974410
--- /dev/null
+++ b/club/services/fees.py
@@ -0,0 +1,69 @@
+"""Recording money received against a membership's fee.
+
+Mirrors billing.services.dues.record_payment for a different kind of money: a
+member's own club fee, not the club's platform subscription. amount_paid is kept in
+step here, never recomputed by re-aggregating FeePayment on every read.
+"""
+
+from decimal import Decimal
+
+from django.db.models import F
+from django.utils import timezone
+
+from club.models import ClubMembership, FeePayment
+
+
+def remaining_balance(membership):
+    return max(membership.fee_amount - membership.amount_paid, Decimal("0.00"))
+
+
+def record_payment(membership, *, amount, method=FeePayment.Method.BANK_TRANSFER, reference="", note="", recorded_by=None):
+    """Record money received against one membership's fee. Several payments may
+    land on one membership -- a family paying in two installments must not read as
+    unpaid. Updates amount_paid and re-syncs fee_status/status to match."""
+    payment = FeePayment.objects.create(membership=membership, amount=amount, method=method, reference=reference, note=note, recorded_by=recorded_by)
+
+    membership.amount_paid = F("amount_paid") + amount
+    membership.save(update_fields=["amount_paid"])
+    membership.refresh_from_db(fields=["amount_paid"])
+    _sync_fee_status(membership)
+
+    return payment
+
+
+def mark_as_paid(membership, *, recorded_by=None):
+    """The "settle this one" action behind both the per-row and bulk buttons. If
+    there's a real remaining balance, records it as a payment (auditable, shows up
+    in history); if fee_amount was never priced (remaining is 0), just flips the
+    flags directly -- there's no real transaction to log."""
+    remaining = remaining_balance(membership)
+    if remaining > 0:
+        record_payment(membership, amount=remaining, method=FeePayment.Method.OTHER, note="Marked as paid", recorded_by=recorded_by)
+    else:
+        _sync_fee_status(membership, force_paid=True)
+
+
+def _sync_fee_status(membership, *, force_paid=False):
+    if membership.fee_status == ClubMembership.FeeStatus.WAIVED:
+        return  # manual, independent of payments -- this never overrides it
+
+    if force_paid or (membership.fee_amount > 0 and membership.amount_paid >= membership.fee_amount):
+        new_status = ClubMembership.FeeStatus.PAID
+    elif membership.amount_paid > 0:
+        new_status = ClubMembership.FeeStatus.PARTIALLY_PAID
+    else:
+        new_status = ClubMembership.FeeStatus.UNPAID
+
+    membership.fee_status = new_status
+    update_fields = ["fee_status"]
+
+    # Same "become a full member" behavior the bulk action already had: settling
+    # the fee in full also activates the membership, once, first time only.
+    if new_status == ClubMembership.FeeStatus.PAID:
+        membership.status = ClubMembership.StatusChoices.ACTIVE
+        update_fields.append("status")
+        if membership.activated_at is None:
+            membership.activated_at = timezone.localdate()
+            update_fields.append("activated_at")
+
+    membership.save(update_fields=update_fields)
diff --git a/club/services/seasons.py b/club/services/seasons.py
new file mode 100644
index 0000000..fb31fa1
--- /dev/null
+++ b/club/services/seasons.py
@@ -0,0 +1,104 @@
+"""Generating a club's seasons ahead of time.
+
+Season (club/models.py) has no stored notion of "when a season starts" -- that
+lives on Club instead (season_start, season_duration_months), since different
+clubs run their year on different cycles. Same shape as
+events/services/recurrence.py's generate_occurrences: materialise missing rows
+up to a horizon, get_or_create per row, safe to call repeatedly.
+"""
+
+import datetime
+
+from dateutil.relativedelta import relativedelta
+from django.db.models import ProtectedError
+from django.db.models.deletion import Collector
+from django.utils import timezone
+
+from club.models import Season
+
+
+def _initial_season_start(club, today):
+    """The most recent occurrence of the club's configured season_start that is
+    not later than ``today`` -- so a club with no seasons yet gets one covering
+    "now" (or the most recently completed one), not an arbitrary future year."""
+    anchor = club.season_start
+    start = datetime.date(today.year, anchor.month, anchor.day)
+    if start > today:
+        start = datetime.date(today.year - 1, anchor.month, anchor.day)
+    return start
+
+
+def _season_end(start, club):
+    return start + relativedelta(months=club.season_duration_months) - datetime.timedelta(days=1)
+
+
+def generate_seasons(club, until):
+    """Materialise seasons for ``club`` from wherever it last left off -- the day
+    after its latest season's end_date, or its configured season_start if it has
+    none yet -- through ``until``. get_or_create per row (matches the
+    unique_season_dates_per_club constraint exactly), safe to call repeatedly.
+    """
+    latest = Season.objects.filter(club=club).order_by("-end_date").first()
+    start = latest.end_date + datetime.timedelta(days=1) if latest else _initial_season_start(club, timezone.localdate())
+
+    created = []
+    while start <= until:
+        end = _season_end(start, club)
+        season, was_created = Season.objects.get_or_create(club=club, start_date=start, end_date=end)
+        if was_created:
+            created.append(season)
+        start = end + datetime.timedelta(days=1)
+
+    return created
+
+
+def _expected_season_dates(club, until):
+    """The (start_date, end_date) pairs generate_seasons would produce for
+    ``club`` from scratch, ignoring whatever already exists -- used by
+    resync_seasons to tell "matches the club's current settings" from "doesn't"."""
+    start = _initial_season_start(club, timezone.localdate())
+    expected = set()
+    while start <= until:
+        end = _season_end(start, club)
+        expected.add((start, end))
+        start = end + datetime.timedelta(days=1)
+    return expected
+
+
+def _is_referenced(season):
+    """Whether deleting ``season`` would hit a PROTECT on any of its relations
+    (ClubMembership, StaffAssignment, TeamMembership, Event, ...) without
+    actually deleting anything."""
+    collector = Collector(using=season._state.db)
+    try:
+        collector.collect([season])
+    except ProtectedError:
+        return True
+    return False
+
+
+def resync_seasons(club, until, *, commit=False):
+    """Find seasons for ``club`` that don't match what its *current*
+    season_start/season_duration_months would produce (e.g. left over from a
+    different rule, or from before those settings were changed), within the
+    same horizon generate_seasons would cover.
+
+    A season is only ever removed if nothing references it through a PROTECTed
+    relation -- a season already in use is reported as kept, never silently
+    dropped. With commit=False (the default) nothing is deleted; the caller
+    gets back what *would* happen.
+    """
+    expected = _expected_season_dates(club, until)
+
+    removed, kept = [], []
+    for season in Season.objects.filter(club=club):
+        if (season.start_date, season.end_date) in expected:
+            continue
+        if _is_referenced(season):
+            kept.append(season)
+        else:
+            removed.append(season)
+            if commit:
+                season.delete()
+
+    return removed, kept
diff --git a/club/signals.py b/club/signals.py
new file mode 100644
index 0000000..6a142d6
--- /dev/null
+++ b/club/signals.py
@@ -0,0 +1,39 @@
+"""Keep ClubRole in sync with membership status.
+
+An **active** ClubMembership grants the member a ``MEMBER`` ClubRole; when no
+active membership remains in that club (status changed away from active, or the
+membership was deleted), the ``MEMBER`` role is withdrawn.
+
+A member holds at most one ClubRole per club (``unique_member_per_club``), so an
+elevated role (ADMIN / EDITOR) is never downgraded or removed by this sync — it
+simply takes precedence.
+"""
+
+from django.db.models.signals import post_delete, post_save
+from django.dispatch import receiver
+
+from .models import ClubMembership, ClubRole
+
+
+@receiver(post_save, sender=ClubMembership)
+@receiver(post_delete, sender=ClubMembership)
+def sync_member_role(sender, instance, **kwargs):
+    has_active = ClubMembership.objects.filter(
+        club_id=instance.club_id,
+        member_id=instance.member_id,
+        status=ClubMembership.StatusChoices.ACTIVE,
+    ).exists()
+
+    if has_active:
+        # get_or_create keeps an existing ADMIN/EDITOR role untouched.
+        ClubRole.objects.get_or_create(
+            club_id=instance.club_id,
+            member_id=instance.member_id,
+            defaults={"role": ClubRole.Roles.MEMBER},
+        )
+    else:
+        ClubRole.objects.filter(
+            club_id=instance.club_id,
+            member_id=instance.member_id,
+            role=ClubRole.Roles.MEMBER,
+        ).delete()
diff --git a/club/templates/club/home.html b/club/templates/club/home.html
new file mode 100644
index 0000000..f6ce595
--- /dev/null
+++ b/club/templates/club/home.html
@@ -0,0 +1,18 @@
+{% extends "_club_base.html" %}
+{% load lucide %}
+
+{% block head_title %}Home{% endblock head_title %}
+
+{% block main %}
+    <div class="flex justify-center">
+        <div class="card w-full max-w-xl bg-base-100 shadow">
+            <div class="card-body">
+                <h1 class="card-title">{% lucide "party-popper" size=20 %} Welcome to {{ club.name }}</h1>
+                <p>
+                    You are signed in as <span class="font-semibold">{{ user.get_full_name|default:user.email }}</span>.
+                </p>
+                <p class="text-sm opacity-70">The club site lands here. For now this page exists so signing in has somewhere to go.</p>
+            </div>
+        </div>
+    </div>
+{% endblock main %}
diff --git a/club/tenancy.py b/club/tenancy.py
new file mode 100644
index 0000000..94f0e0b
--- /dev/null
+++ b/club/tenancy.py
@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from contextvars import ContextVar, Token
+from typing import TYPE_CHECKING
+
+from django.conf import settings
+
+if TYPE_CHECKING:
+    from .models import Club
+
+__current_club: ContextVar = ContextVar("current_club", default=None)
+
+
+def set_current_club(club: Club | None) -> Token:
+    """Bind ``club`` to the current context and return a reset token."""
+    return __current_club.set(club)
+
+
+def reset_current_club(token: Token) -> None:
+    """Restore the club that was active before ``set_current_club``."""
+    __current_club.reset(token)
+
+
+def get_current_club() -> Club | None:
+    return __current_club.get()
+
+
+def require_current_club() -> Club:
+    club = get_current_club()
+
+    if club is None:
+        raise RuntimeError("No active club in context.")
+
+    return club
+
+
+class ClubTenantMiddleware:
+    """Resolve the active club from the request's subdomain.
+
+    The club whose ``slug`` matches the left-most host label (below the
+    configured base domain) is stored on ``request.club`` and pushed onto the
+    ``current_club`` context variable for the duration of the request, so
+    service-layer code and managers can read it via ``get_current_club()``.
+    Requests that don't map to a club (bare base domain, ``www``, localhost,
+    an unknown slug) get ``request.club = None``.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        club = self.get_club(request)
+        request.club = club
+        token = set_current_club(club)
+        try:
+            return self.get_response(request)
+        finally:
+            reset_current_club(token)
+
+    def get_club(self, request) -> Club | None:
+        # Imported lazily: club.models imports rosterchief.base, which imports
+        # this module, so a top-level import would be circular.
+        from .models import Club
+
+        subdomain = self.get_subdomain(request)
+
+        if not subdomain:
+            return None
+
+        # Archived clubs stop resolving: their subdomain behaves as unknown.
+        return Club.objects.active().filter(slug=subdomain).first()
+
+    @staticmethod
+    def get_subdomain(request) -> str | None:
+        """Extract the tenant slug from the request host, or ``None``."""
+        host = request.get_host().split(":")[0].lower().rstrip(".")
+
+        if not host:
+            return None
+
+        base_domain = getattr(settings, "ROSTERCHIEF_BASE_DOMAIN", "").lower().strip(".")
+
+        if base_domain:
+            # Only hosts under the configured base domain carry a tenant slug.
+            if host == base_domain:
+                return None
+            suffix = f".{base_domain}"
+            if not host.endswith(suffix):
+                return None
+            label = host[: -len(suffix)]
+        else:
+            # No base domain configured: treat "slug.example.com" style hosts
+            # (3+ labels) as tenant-bearing; leave bare/localhost hosts alone.
+            labels = host.split(".")
+            if len(labels) < 3:
+                return None
+            label = ".".join(labels[:-2])
+
+        # Use the left-most label only; ignore the marketing/www host.
+        subdomain = label.split(".")[0]
+        if subdomain in ("", "www"):
+            return None
+
+        return subdomain
diff --git a/club/tests.py b/club/tests.py
new file mode 100644
index 0000000..e2c4a8e
--- /dev/null
+++ b/club/tests.py
@@ -0,0 +1,1517 @@
+import datetime
+import uuid
+from contextlib import contextmanager
+from decimal import Decimal
+from io import StringIO
+
+from allauth.mfa.models import Authenticator
+from dateutil.relativedelta import relativedelta
+from django.contrib import admin as django_admin
+from django.contrib.auth import get_user_model
+from django.core.exceptions import ValidationError
+from django.core.management import call_command
+from django.db import IntegrityError
+from django.db.models import ProtectedError
+from django.test import RequestFactory, TestCase, override_settings
+from django.urls import reverse
+from django.utils import timezone
+
+from events.models import Event
+from members.models import Family, FamilyMembership, Member
+from teams.models import Position, StaffAssignment, Team, TeamMembership
+
+from .models import Club, ClubMembership, ClubRole, FeePayment, Season, Sponsor, club_logo_path
+from .services.access import (
+    COACH_MANAGER,
+    can_edit_event,
+    can_manage_shop,
+    has_club_role,
+    members_visible_to,
+    roles_in_club,
+    teams_managed_by,
+    teams_staffed_by,
+)
+from .services.fees import mark_as_paid, record_payment, remaining_balance
+from .services.seasons import _initial_season_start, _season_end, generate_seasons, resync_seasons
+from .tenancy import (
+    ClubTenantMiddleware,
+    get_current_club,
+    require_current_club,
+    reset_current_club,
+    set_current_club,
+)
+
+
+@contextmanager
+def with_club(club):
+    """Bind ``club`` as the active tenant for the duration of the block."""
+    token = set_current_club(club)
+    try:
+        yield club
+    finally:
+        reset_current_club(token)
+
+
+class ClubModelTests(TestCase):
+    def test_str_returns_name(self):
+        club = Club.objects.create(name="City Swim Club")
+
+        self.assertEqual(str(club), "City Swim Club")
+
+    def test_pk_is_uuid(self):
+        club = Club.objects.create(name="City Swim Club")
+
+        self.assertIsInstance(club.pk, uuid.UUID)
+
+    def test_clubs_are_ordered_by_name(self):
+        Club.objects.create(name="Zulu Club")
+        Club.objects.create(name="Alpha Club")
+        Club.objects.create(name="Middle Club")
+
+        self.assertEqual(
+            list(Club.objects.values_list("name", flat=True)),
+            ["Alpha Club", "Middle Club", "Zulu Club"],
+        )
+
+    def test_verbose_names(self):
+        self.assertEqual(Club._meta.verbose_name, "club")
+        self.assertEqual(Club._meta.verbose_name_plural, "clubs")
+
+
+def make_season(club, start_year=2026):
+    return Season.objects.create(
+        club=club,
+        start_date=datetime.date(start_year, 8, 1),
+        end_date=datetime.date(start_year + 1, 5, 31),
+    )
+
+
+class ClubMembershipModelTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="City Swim Club")
+        self.season = make_season(self.club)
+        self.member = Member.objects.create(
+            first_name="Jane",
+            last_name="Doe",
+            email="jane@example.com",
+        )
+
+    def test_str_returns_club_and_member(self):
+        membership = ClubMembership.objects.create(club=self.club, season=self.season, member=self.member, license="LIC-001")
+
+        self.assertEqual(str(membership), "City Swim Club - Jane Doe")
+
+    def test_defaults_are_pending_and_unpaid(self):
+        membership = ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        self.assertEqual(membership.status, ClubMembership.StatusChoices.PENDING)
+        self.assertEqual(membership.fee_status, ClubMembership.FeeStatus.UNPAID)
+        self.assertEqual(membership.license, "")
+        self.assertIsNone(membership.signed_up_at)
+
+    def test_pk_is_uuid(self):
+        membership = ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        self.assertIsInstance(membership.pk, uuid.UUID)
+
+    def test_club_is_filled_from_active_tenant(self):
+        with with_club(self.club):
+            membership = ClubMembership.objects.create(season=self.season, member=self.member)
+
+        self.assertEqual(membership.club, self.club)
+
+    def test_member_is_unique_per_club_and_season(self):
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        with self.assertRaises(IntegrityError):
+            ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+    def test_same_member_can_join_consecutive_seasons(self):
+        next_season = make_season(self.club, start_year=2027)
+
+        first = ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+        second = ClubMembership.objects.create(club=self.club, season=next_season, member=self.member)
+
+        self.assertEqual(self.member.member_of.count(), 2)
+        self.assertNotEqual(first.season, second.season)
+
+    def test_same_member_can_join_different_clubs(self):
+        other_club = Club.objects.create(name="Other Swim Club")
+        other_season = make_season(other_club)
+
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+        ClubMembership.objects.create(club=other_club, season=other_season, member=self.member)
+
+        self.assertEqual(self.member.member_of.count(), 2)
+
+    def test_deleting_club_is_blocked_while_a_season_has_memberships(self):
+        # Club -> Season is CASCADE, but ClubMembership -> Season is PROTECT, so
+        # the club can't be deleted while one of its seasons is still referenced.
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        with self.assertRaises(ProtectedError):
+            self.club.delete()
+
+        self.assertTrue(ClubMembership.objects.exists())
+
+    def test_deleting_empty_club_cascades_to_its_seasons(self):
+        self.club.delete()
+
+        self.assertFalse(Club.objects.filter(pk=self.club.pk).exists())
+        self.assertFalse(Season.objects.filter(pk=self.season.pk).exists())
+
+    def test_deleting_member_deletes_membership_but_keeps_club(self):
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        self.member.delete()
+
+        self.assertFalse(ClubMembership.objects.exists())
+        self.assertTrue(Club.objects.filter(pk=self.club.pk).exists())
+
+    def test_season_is_protected_while_referenced(self):
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        with self.assertRaises(ProtectedError):
+            self.season.delete()
+
+    def test_memberships_are_ordered_by_club_then_member_name(self):
+        alpha_club = Club.objects.create(name="Alpha Club")
+        zulu_club = Club.objects.create(name="Zulu Club")
+        alpha_season = make_season(alpha_club)
+        zulu_season = make_season(zulu_club)
+
+        jane = Member.objects.create(first_name="Jane", last_name="Doe")
+        alice = Member.objects.create(first_name="Alice", last_name="Smith")
+        bob = Member.objects.create(first_name="Bob", last_name="Smith")
+
+        ClubMembership.objects.create(club=zulu_club, season=zulu_season, member=bob)
+        ClubMembership.objects.create(club=alpha_club, season=alpha_season, member=bob)
+        ClubMembership.objects.create(club=alpha_club, season=alpha_season, member=alice)
+        ClubMembership.objects.create(club=alpha_club, season=alpha_season, member=jane)
+
+        self.assertEqual(
+            [(membership.club.name, membership.member.last_name, membership.member.first_name) for membership in ClubMembership.objects.all()],
+            [
+                ("Alpha Club", "Doe", "Jane"),
+                ("Alpha Club", "Smith", "Alice"),
+                ("Alpha Club", "Smith", "Bob"),
+                ("Zulu Club", "Smith", "Bob"),
+            ],
+        )
+
+    def test_reverse_relations(self):
+        membership = ClubMembership.objects.create(club=self.club, season=self.season, member=self.member)
+
+        self.assertEqual(list(self.club.clubmemberships.all()), [membership])
+        self.assertEqual(list(self.member.member_of.all()), [membership])
+        self.assertEqual(list(self.season.memberships.all()), [membership])
+
+    def test_verbose_names(self):
+        self.assertEqual(ClubMembership._meta.verbose_name, "club membership")
+        self.assertEqual(ClubMembership._meta.verbose_name_plural, "club memberships")
+
+
+class ClubSlugTests(TestCase):
+    def test_slug_is_derived_from_name(self):
+        club = Club.objects.create(name="City Swim Club")
+
+        self.assertEqual(club.slug, "city-swim-club")
+
+    def test_explicit_slug_is_kept(self):
+        club = Club.objects.create(name="City Swim Club", slug="ajax-united")
+
+        self.assertEqual(club.slug, "ajax-united")
+
+    def test_derived_slugs_are_made_unique(self):
+        first = Club.objects.create(name="City Swim Club")
+        second = Club.objects.create(name="City Swim Club")
+
+        self.assertEqual(first.slug, "city-swim-club")
+        self.assertEqual(second.slug, "city-swim-club-2")
+
+    def test_slug_is_unique(self):
+        Club.objects.create(name="First", slug="shared")
+
+        with self.assertRaises(IntegrityError):
+            Club.objects.create(name="Second", slug="shared")
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=[".rosterchief.app", ".example.com", ".example.org"],
+)
+class ClubTenantMiddlewareTests(TestCase):
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.captured = {}
+        self.middleware = ClubTenantMiddleware(self._capture)
+
+    def _capture(self, request):
+        # Runs inside the middleware, while the context var is set.
+        self.captured["context_club"] = get_current_club()
+        return "response"
+
+    def _run(self, host):
+        request = self.factory.get("/", HTTP_HOST=host)
+        response = self.middleware(request)
+        return request, response
+
+    def test_subdomain_resolves_to_club(self):
+        request, response = self._run("ajax-united.rosterchief.app")
+
+        self.assertEqual(response, "response")
+        self.assertEqual(request.club, self.club)
+        self.assertEqual(self.captured["context_club"], self.club)
+
+    def test_subdomain_resolution_ignores_port(self):
+        request, _ = self._run("ajax-united.rosterchief.app:8000")
+
+        self.assertEqual(request.club, self.club)
+
+    def test_unknown_subdomain_sets_none(self):
+        request, _ = self._run("unknown-club.rosterchief.app")
+
+        self.assertIsNone(request.club)
+
+    def test_bare_base_domain_has_no_club(self):
+        request, _ = self._run("rosterchief.app")
+
+        self.assertIsNone(request.club)
+
+    def test_www_is_treated_as_no_club(self):
+        request, _ = self._run("www.rosterchief.app")
+
+        self.assertIsNone(request.club)
+
+    def test_foreign_domain_has_no_club(self):
+        request, _ = self._run("ajax-united.example.org")
+
+        self.assertIsNone(request.club)
+
+    def test_context_var_is_reset_after_request(self):
+        self._run("ajax-united.rosterchief.app")
+
+        self.assertIsNone(get_current_club())
+
+    @override_settings(ROSTERCHIEF_BASE_DOMAIN="")
+    def test_generic_host_resolution_without_base_domain(self):
+        request, _ = self._run("ajax-united.example.com")
+
+        self.assertEqual(request.club, self.club)
+
+    @override_settings(ROSTERCHIEF_BASE_DOMAIN="")
+    def test_two_label_host_has_no_club_without_base_domain(self):
+        request, _ = self._run("example.com")
+
+        self.assertIsNone(request.club)
+
+
+class _FakeRequest:
+    def __init__(self, host):
+        self._host = host
+
+    def get_host(self):
+        return self._host
+
+
+@override_settings(ROSTERCHIEF_BASE_DOMAIN="rosterchief.app")
+class GetSubdomainTests(TestCase):
+    def subdomain(self, host):
+        return ClubTenantMiddleware.get_subdomain(_FakeRequest(host))
+
+    def test_empty_host_returns_none(self):
+        self.assertIsNone(self.subdomain(""))
+
+    def test_trailing_dot_is_stripped(self):
+        self.assertEqual(self.subdomain("ajax-united.rosterchief.app."), "ajax-united")
+
+    def test_nested_subdomain_uses_leftmost_label(self):
+        self.assertEqual(self.subdomain("a.b.rosterchief.app"), "a")
+
+
+class TenantContextTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_require_current_club_returns_active_club(self):
+        with with_club(self.club):
+            self.assertEqual(require_current_club(), self.club)
+
+    def test_require_current_club_raises_without_context(self):
+        with self.assertRaises(RuntimeError):
+            require_current_club()
+
+    def test_club_manager_current_returns_active_club(self):
+        with with_club(self.club):
+            self.assertEqual(Club.objects.current(), self.club)
+
+    def test_club_manager_current_is_none_without_context(self):
+        self.assertIsNone(Club.objects.current())
+
+
+class TenantScopedModelTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.dates = {
+            "start_date": datetime.date(2026, 8, 1),
+            "end_date": datetime.date(2027, 5, 31),
+        }
+
+    def test_save_keeps_explicit_club(self):
+        season = Season.objects.create(club=self.club, **self.dates)
+
+        self.assertEqual(season.club, self.club)
+
+    def test_save_fills_club_from_context(self):
+        with with_club(self.club):
+            season = Season.objects.create(**self.dates)
+
+        self.assertEqual(season.club, self.club)
+
+    def test_save_without_club_or_context_raises(self):
+        with self.assertRaises(RuntimeError):
+            Season.objects.create(**self.dates)
+
+    def test_for_club_filters_by_club(self):
+        mine = Season.objects.create(club=self.club, **self.dates)
+        Season.objects.create(club=self.other, **self.dates)
+
+        self.assertEqual(list(Season.objects.for_club(self.club)), [mine])
+
+    def test_current_club_filters_by_active_club(self):
+        mine = Season.objects.create(club=self.club, **self.dates)
+        Season.objects.create(club=self.other, **self.dates)
+
+        with with_club(self.club):
+            self.assertEqual(list(Season.objects.current_club()), [mine])
+
+    def test_name_is_two_digit_year_range(self):
+        season = Season.objects.create(club=self.club, **self.dates)
+
+        self.assertEqual(season.name, "26-27")
+
+    def test_name_zero_pads_years(self):
+        season = Season.objects.create(
+            club=self.club,
+            start_date=datetime.date(2008, 8, 1),
+            end_date=datetime.date(2009, 5, 31),
+        )
+
+        self.assertEqual(season.name, "08-09")
+
+    def test_str_is_the_name(self):
+        season = Season.objects.create(club=self.club, **self.dates)
+
+        self.assertEqual(str(season), "26-27")
+
+
+class SeasonGetCurrentTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.season = Season.objects.create(
+            club=self.club,
+            start_date=datetime.date(2026, 8, 1),
+            end_date=datetime.date(2027, 5, 31),
+        )
+
+    def test_returns_season_covering_the_given_date(self):
+        with with_club(self.club):
+            found = Season.get_current(datetime.date(2026, 12, 25))
+
+        self.assertEqual(found, self.season)
+
+    def test_includes_boundary_dates(self):
+        with with_club(self.club):
+            self.assertEqual(Season.get_current(datetime.date(2026, 8, 1)), self.season)
+            self.assertEqual(Season.get_current(datetime.date(2027, 5, 31)), self.season)
+
+    def test_returns_none_when_no_season_covers_the_date(self):
+        with with_club(self.club):
+            self.assertIsNone(Season.get_current(datetime.date(2027, 7, 1)))
+
+    def test_is_scoped_to_the_active_club(self):
+        # The other club's season covers the same date but must not leak.
+        Season.objects.create(
+            club=self.other,
+            start_date=datetime.date(2026, 8, 1),
+            end_date=datetime.date(2027, 5, 31),
+        )
+
+        with with_club(self.other):
+            found = Season.get_current(datetime.date(2026, 12, 25))
+
+        self.assertEqual(found.club, self.other)
+
+    def test_defaults_to_today(self):
+        # self.other, not self.club -- setUp's self.season (2026-08-01 to 2027-05-31)
+        # would otherwise also cover "today" once real dates reach that window,
+        # colliding with the one created here.
+        today = timezone.now().date()
+        current = Season.objects.create(
+            club=self.other,
+            start_date=today - datetime.timedelta(days=10),
+            end_date=today + datetime.timedelta(days=10),
+        )
+
+        with with_club(self.other):
+            self.assertEqual(Season.get_current(), current)
+
+    def test_requires_an_active_club(self):
+        with self.assertRaises(RuntimeError):
+            Season.get_current(datetime.date(2026, 12, 25))
+
+
+class SeasonNextAfterTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.current = Season.objects.create(club=self.club, start_date=datetime.date(2026, 8, 1), end_date=datetime.date(2027, 5, 31))
+        self.next_season = Season.objects.create(club=self.club, start_date=datetime.date(2027, 8, 1), end_date=datetime.date(2028, 5, 31))
+
+    def test_returns_the_soonest_season_starting_after_the_date(self):
+        self.assertEqual(Season.next_after(self.club, datetime.date(2026, 12, 25)), self.next_season)
+
+    def test_returns_none_when_there_is_no_later_season(self):
+        self.assertIsNone(Season.next_after(self.club, datetime.date(2027, 12, 25)))
+
+    def test_is_scoped_to_the_given_club(self):
+        other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Season.objects.create(club=other, start_date=datetime.date(2027, 8, 1), end_date=datetime.date(2028, 5, 31))
+
+        self.assertEqual(Season.next_after(other, datetime.date(2026, 12, 25)).club, other)
+
+
+class SponsorModelTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_str_returns_name(self):
+        sponsor = Sponsor.objects.create(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+
+        self.assertEqual(str(sponsor), "Acme Corp")
+
+    def test_a_blank_end_date_is_valid(self):
+        sponsor = Sponsor(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+        sponsor.full_clean()
+
+    def test_an_end_date_on_the_same_day_as_start_is_valid(self):
+        sponsor = Sponsor(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1), end_date=datetime.date(2026, 1, 1))
+        sponsor.full_clean()
+
+    def test_an_end_date_before_start_is_rejected(self):
+        sponsor = Sponsor(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 6, 1), end_date=datetime.date(2026, 1, 1))
+
+        with self.assertRaises(ValidationError) as ctx:
+            sponsor.full_clean()
+        self.assertIn("end_date", ctx.exception.error_dict)
+
+    def test_sponsors_are_ordered_by_name(self):
+        Sponsor.objects.create(club=self.club, name="Zulu Corp", start_date=datetime.date(2026, 1, 1))
+        Sponsor.objects.create(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+
+        self.assertEqual(list(Sponsor.objects.values_list("name", flat=True)), ["Acme Corp", "Zulu Corp"])
+
+
+class AdminRegistrationSmokeTests(TestCase):
+    """Every registered model across all apps must have a working admin: load
+    each changelist and add page to catch bad list_display / search_fields /
+    fieldsets / autocomplete targets in any app's admin config."""
+
+    def setUp(self):
+        self.admin = get_user_model().objects.create_superuser(email="root@club.test", password="pw-secret-123")
+        # Staff must hold a second factor (RequireMFAMiddleware), else they are
+        # redirected to enrolment instead of reaching the admin.
+        Authenticator.objects.create(user=self.admin, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+        self.client.force_login(self.admin)
+
+    def test_every_model_is_registered_in_admin(self):
+        from django.apps import apps
+
+        registered = set(django_admin.site._registry)
+        # Concrete, non-auto-created models in these apps should all be registered.
+        project_apps = {"authentication", "club", "members", "teams", "events", "formbuilder", "shop"}
+        for model in apps.get_models():
+            if model._meta.app_label not in project_apps or model._meta.auto_created:
+                continue
+            with self.subTest(model=model.__name__):
+                self.assertIn(model, registered, f"{model.__name__} is not registered in the admin")
+
+    def test_all_changelists_load(self):
+        for model in django_admin.site._registry:
+            url = reverse(f"admin:{model._meta.app_label}_{model._meta.model_name}_changelist")
+            with self.subTest(model=model.__name__):
+                self.assertEqual(self.client.get(url).status_code, 200)
+
+    def test_all_add_pages_load(self):
+        for model in django_admin.site._registry:
+            url = reverse(f"admin:{model._meta.app_label}_{model._meta.model_name}_add")
+            with self.subTest(model=model.__name__):
+                self.assertEqual(self.client.get(url).status_code, 200)
+
+
+class ClubArchivingTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_a_new_club_is_active(self):
+        self.assertFalse(self.club.is_archived)
+        self.assertIn(self.club, Club.objects.active())
+        self.assertNotIn(self.club, Club.objects.archived())
+
+    def test_archive_and_restore(self):
+        self.club.archive()
+
+        self.assertTrue(self.club.is_archived)
+        self.assertIn(self.club, Club.objects.archived())
+        self.assertNotIn(self.club, Club.objects.active())
+
+        self.club.restore()
+
+        self.assertFalse(self.club.is_archived)
+        self.assertIn(self.club, Club.objects.active())
+
+    def test_archiving_twice_keeps_the_original_timestamp(self):
+        self.club.archive()
+        first = self.club.archived_at
+
+        self.club.archive()
+
+        self.assertEqual(self.club.archived_at, first)
+
+    def test_restoring_an_active_club_is_a_no_op(self):
+        self.club.restore()
+
+        self.assertFalse(self.club.is_archived)
+
+    def test_archiving_destroys_nothing(self):
+        season = make_season(self.club)
+        member = Member.objects.create(first_name="Jane", last_name="Doe")
+        ClubMembership.objects.create(club=self.club, member=member, season=season)
+
+        self.club.archive()
+
+        self.assertTrue(ClubMembership.objects.filter(club=self.club).exists())
+        self.assertTrue(Season.objects.filter(club=self.club).exists())
+
+
+@override_settings(ROSTERCHIEF_BASE_DOMAIN="rosterchief.app", ALLOWED_HOSTS=[".rosterchief.app"])
+class ArchivedClubTenancyTests(TestCase):
+    """An archived club's subdomain must stop resolving — that is what makes
+    archiving a real deactivation rather than a cosmetic flag."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.middleware = ClubTenantMiddleware(lambda request: "response")
+
+    def resolve(self):
+        request = RequestFactory().get("/", HTTP_HOST="ajax-united.rosterchief.app")
+        self.middleware(request)
+        return request.club
+
+    def test_active_club_resolves(self):
+        self.assertEqual(self.resolve(), self.club)
+
+    def test_archived_club_stops_resolving(self):
+        self.club.archive()
+
+        self.assertIsNone(self.resolve())
+
+    def test_restored_club_resolves_again(self):
+        self.club.archive()
+        self.club.restore()
+
+        self.assertEqual(self.resolve(), self.club)
+
+
+class ClubRoleTests(TestCase):
+    def test_str(self):
+        club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        member = Member.objects.create(first_name="Jane", last_name="Doe")
+        role = ClubRole.objects.create(club=club, member=member)
+
+        self.assertEqual(str(role), f"{club} - {member}")
+
+
+class ClubMembershipCleanTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today + datetime.timedelta(days=300))
+        self.other_season = Season.objects.create(club=self.other, start_date=today, end_date=today + datetime.timedelta(days=300))
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+
+    def test_rejects_cross_club_season(self):
+        membership = ClubMembership(club=self.club, member=self.member, season=self.other_season)
+        with self.assertRaises(ValidationError) as ctx:
+            membership.full_clean()
+        self.assertIn("season", ctx.exception.error_dict)
+
+    def test_accepts_same_club_season(self):
+        ClubMembership(club=self.club, member=self.member, season=self.season).full_clean()
+
+
+class AccessServiceTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today + datetime.timedelta(days=300))
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.second_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.forward = Position.objects.create(club=self.club, name="Forward", short_name="FW")
+        # Management staff (coach / team manager) vs. non-management staff (e.g. physio).
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+        self.physio_position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+
+    def make_user_member(self, email):
+        user = get_user_model().objects.create_user(email=email, password="pw")
+        member = Member.objects.create(user=user, first_name=email.split("@")[0].title(), last_name="Doe")
+        return user, member
+
+    def grant(self, member, role):
+        return ClubRole.objects.create(club=self.club, member=member, role=role)
+
+    def make_coach(self, member, team=None):
+        return StaffAssignment.objects.create(team=team or self.team, member=member, season=self.season, position=self.coach_position)
+
+    def make_support_staff(self, member, team=None):
+        """Staff on the team, but in a non-management position."""
+        return StaffAssignment.objects.create(team=team or self.team, member=member, season=self.season, position=self.physio_position)
+
+    def make_event(self, **kwargs):
+        kwargs.setdefault("club", self.club)
+        kwargs.setdefault("title", "Match")
+        kwargs.setdefault("start", timezone.now() + datetime.timedelta(days=1))
+        return Event.objects.create(**kwargs)
+
+    # --- has_club_role / roles_in_club ---
+    def test_has_club_role_is_scoped_to_role_and_club(self):
+        user, member = self.make_user_member("admin@example.com")
+        self.grant(member, ClubRole.Roles.ADMIN)
+
+        self.assertTrue(has_club_role(user, self.club, ClubRole.Roles.ADMIN))
+        self.assertFalse(has_club_role(user, self.club, ClubRole.Roles.EDITOR))
+        self.assertFalse(has_club_role(user, self.other_club, ClubRole.Roles.ADMIN))
+
+    def test_roles_in_club_includes_derived_coach_manager(self):
+        user, member = self.make_user_member("editor@example.com")
+        self.grant(member, ClubRole.Roles.EDITOR)
+        self.make_coach(member)
+
+        self.assertEqual(roles_in_club(user, self.club), {ClubRole.Roles.EDITOR, COACH_MANAGER})
+
+    def test_non_management_staff_gets_no_derived_role(self):
+        user, member = self.make_user_member("physio@example.com")
+        self.make_support_staff(member)
+
+        self.assertEqual(roles_in_club(user, self.club), set())
+
+    def test_roles_in_club_is_empty_for_outsider(self):
+        user, _ = self.make_user_member("nobody@example.com")
+
+        self.assertEqual(roles_in_club(user, self.club), set())
+
+    # --- teams_managed_by ---
+    def test_admin_manages_every_team(self):
+        user, member = self.make_user_member("admin@example.com")
+        self.grant(member, ClubRole.Roles.ADMIN)
+
+        self.assertEqual(set(teams_managed_by(user, self.club)), {self.team, self.second_team})
+
+    def test_coach_manages_only_their_team(self):
+        user, member = self.make_user_member("coach@example.com")
+        self.make_coach(member)
+
+        self.assertEqual(list(teams_managed_by(user, self.club)), [self.team])
+
+    def test_plain_member_manages_no_teams(self):
+        user, _ = self.make_user_member("plain@example.com")
+
+        self.assertEqual(list(teams_managed_by(user, self.club)), [])
+
+    def test_non_management_staff_manages_no_teams(self):
+        user, member = self.make_user_member("physio@example.com")
+        self.make_support_staff(member)
+
+        self.assertEqual(list(teams_managed_by(user, self.club)), [])
+
+    def test_non_management_staff_does_not_inherit_a_managers_team(self):
+        # The team has BOTH a manager and a non-management staffer. The staffer
+        # must not pick up the team just because *someone else* manages it.
+        _, manager = self.make_user_member("coach@example.com")
+        self.make_coach(manager)
+        physio_user, physio = self.make_user_member("physio@example.com")
+        self.make_support_staff(physio)
+
+        self.assertEqual(list(teams_managed_by(physio_user, self.club)), [])
+
+    def make_past_season(self):
+        return Season.objects.create(
+            club=self.club,
+            start_date=self.season.start_date - datetime.timedelta(days=400),
+            end_date=self.season.start_date - datetime.timedelta(days=1),
+        )
+
+    def test_a_former_seasons_coach_no_longer_manages_the_team(self):
+        # StaffAssignment is per-season: authority expires with it.
+        user, member = self.make_user_member("coach@example.com")
+        StaffAssignment.objects.create(team=self.team, member=member, season=self.make_past_season(), position=self.coach_position)
+
+        self.assertEqual(list(teams_managed_by(user, self.club)), [])
+        self.assertEqual(list(teams_staffed_by(user, self.club)), [])
+        self.assertFalse(roles_in_club(user, self.club))
+
+    def test_a_former_seasons_coach_cannot_edit_a_current_event(self):
+        user, member = self.make_user_member("coach@example.com")
+        StaffAssignment.objects.create(team=self.team, member=member, season=self.make_past_season(), position=self.coach_position)
+        event = self.make_event()
+        event.teams.add(self.team)
+
+        self.assertFalse(can_edit_event(user, event))
+
+    # --- members_visible_to ---
+    def test_admin_sees_all_club_members(self):
+        user, member = self.make_user_member("admin@example.com")
+        self.grant(member, ClubRole.Roles.ADMIN)
+        other = Member.objects.create(first_name="Other", last_name="Member")
+        ClubMembership.objects.create(club=self.club, member=member, season=self.season)
+        ClubMembership.objects.create(club=self.club, member=other, season=self.season)
+
+        self.assertEqual(set(members_visible_to(user, self.club)), {member, other})
+
+    def test_coach_sees_self_and_managed_roster(self):
+        user, member = self.make_user_member("coach@example.com")
+        self.make_coach(member)
+        player = Member.objects.create(first_name="Player", last_name="One")
+        TeamMembership.objects.create(team=self.team, member=player, season=self.season, position=self.forward)
+        unrelated = Member.objects.create(first_name="Un", last_name="Related")
+
+        visible = set(members_visible_to(user, self.club))
+
+        self.assertEqual(visible, {member, player})
+        self.assertNotIn(unrelated, visible)
+
+    def test_parent_sees_self_and_children(self):
+        user, parent = self.make_user_member("parent@example.com")
+        child = Member.objects.create(first_name="Kid", last_name="Doe")
+        family = Family.objects.create(name="Doe")
+        FamilyMembership.objects.create(family=family, member=parent, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family, member=child, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.assertEqual(set(members_visible_to(user, self.club)), {parent, child})
+
+    def test_user_without_a_member_sees_nobody(self):
+        user = get_user_model().objects.create_user(email="ghost@example.com", password="pw")
+
+        self.assertEqual(list(members_visible_to(user, self.club)), [])
+
+    def test_non_management_staff_sees_the_roster_but_holds_no_authority(self):
+        # A physio can see the team they work with, but manages nothing.
+        user, member = self.make_user_member("physio@example.com")
+        self.make_support_staff(member)
+        player = Member.objects.create(first_name="Player", last_name="One")
+        TeamMembership.objects.create(team=self.team, member=player, season=self.season, position=self.forward)
+
+        self.assertEqual(set(members_visible_to(user, self.club)), {member, player})
+        self.assertEqual(list(teams_managed_by(user, self.club)), [])
+        self.assertEqual(list(teams_staffed_by(user, self.club)), [self.team])
+
+    def test_manager_also_sees_the_teams_other_staff(self):
+        user, manager = self.make_user_member("coach@example.com")
+        self.make_coach(manager)
+        _, physio = self.make_user_member("physio@example.com")
+        self.make_support_staff(physio)
+
+        self.assertIn(physio, set(members_visible_to(user, self.club)))
+
+    def test_admin_sees_members_without_a_club_membership(self):
+        user, admin = self.make_user_member("admin@example.com")
+        self.grant(admin, ClubRole.Roles.ADMIN)
+        _, coach = self.make_user_member("coach@example.com")
+        self.make_coach(coach)  # staff, but no ClubMembership
+
+        visible = set(members_visible_to(user, self.club))
+
+        self.assertIn(coach, visible)
+        self.assertIn(admin, visible)  # the admin sees themselves via their ClubRole
+
+    def test_roster_visibility_is_scoped_to_the_current_season(self):
+        user, member = self.make_user_member("coach@example.com")
+        self.make_coach(member)
+        old_season = Season.objects.create(
+            club=self.club,
+            start_date=self.season.start_date - datetime.timedelta(days=400),
+            end_date=self.season.start_date - datetime.timedelta(days=1),
+        )
+        former_player = Member.objects.create(first_name="Former", last_name="Player")
+        TeamMembership.objects.create(team=self.team, member=former_player, season=old_season, position=self.forward)
+
+        self.assertNotIn(former_player, set(members_visible_to(user, self.club)))
+
+    # --- can_edit_event ---
+    def test_admin_can_edit_event(self):
+        user, member = self.make_user_member("admin@example.com")
+        self.grant(member, ClubRole.Roles.ADMIN)
+
+        self.assertTrue(can_edit_event(user, self.make_event()))
+
+    def test_editor_can_edit_event(self):
+        user, member = self.make_user_member("editor@example.com")
+        self.grant(member, ClubRole.Roles.EDITOR)
+
+        self.assertTrue(can_edit_event(user, self.make_event()))
+
+    def test_owner_can_edit_their_event(self):
+        user, member = self.make_user_member("owner@example.com")
+
+        self.assertTrue(can_edit_event(user, self.make_event(created_by=member)))
+
+    def test_coach_can_edit_their_teams_event(self):
+        user, member = self.make_user_member("coach@example.com")
+        self.make_coach(member)
+        event = self.make_event()
+        event.teams.add(self.team)
+
+        self.assertTrue(can_edit_event(user, event))
+
+    def test_coach_cannot_edit_another_teams_event(self):
+        user, member = self.make_user_member("coach@example.com")
+        self.make_coach(member)
+        event = self.make_event()
+        event.teams.add(self.second_team)
+
+        self.assertFalse(can_edit_event(user, event))
+
+    def test_plain_member_cannot_edit_event(self):
+        user, _ = self.make_user_member("plain@example.com")
+
+        self.assertFalse(can_edit_event(user, self.make_event()))
+
+    def test_non_management_staff_cannot_edit_their_teams_event(self):
+        user, member = self.make_user_member("physio@example.com")
+        self.make_support_staff(member)
+        event = self.make_event()
+        event.teams.add(self.team)
+
+        self.assertFalse(can_edit_event(user, event))
+
+    def test_non_management_staff_on_a_managed_team_cannot_edit_its_event(self):
+        # Same escalation shape as teams_managed_by: a manager exists on the team,
+        # but the physio must not inherit edit rights from them.
+        _, manager = self.make_user_member("coach@example.com")
+        self.make_coach(manager)
+        physio_user, physio = self.make_user_member("physio@example.com")
+        self.make_support_staff(physio)
+        event = self.make_event()
+        event.teams.add(self.team)
+
+        self.assertFalse(can_edit_event(physio_user, event))
+
+    # --- can_manage_shop ---
+    def test_only_admin_can_manage_shop(self):
+        admin_user, admin_member = self.make_user_member("admin@example.com")
+        self.grant(admin_member, ClubRole.Roles.ADMIN)
+        editor_user, editor_member = self.make_user_member("editor@example.com")
+        self.grant(editor_member, ClubRole.Roles.EDITOR)
+
+        self.assertTrue(can_manage_shop(admin_user, self.club))
+        self.assertFalse(can_manage_shop(editor_user, self.club))
+
+
+class ClubRoleStatusSyncTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today + datetime.timedelta(days=300))
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+
+    def roles(self):
+        return ClubRole.objects.filter(club=self.club, member=self.member)
+
+    def make_membership(self, status=ClubMembership.StatusChoices.ACTIVE):
+        return ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=status)
+
+    def test_active_membership_grants_member_role(self):
+        self.make_membership()
+
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.MEMBER)
+
+    def test_pending_membership_grants_no_role(self):
+        self.make_membership(status=ClubMembership.StatusChoices.PENDING)
+
+        self.assertFalse(self.roles().exists())
+
+    def test_deactivating_membership_withdraws_member_role(self):
+        membership = self.make_membership()
+        self.assertTrue(self.roles().exists())
+
+        membership.status = ClubMembership.StatusChoices.LAPSED
+        membership.save()
+
+        self.assertFalse(self.roles().exists())
+
+    def test_deleting_membership_withdraws_member_role(self):
+        membership = self.make_membership()
+
+        membership.delete()
+
+        self.assertFalse(self.roles().exists())
+
+    def test_elevated_role_is_never_downgraded_or_removed(self):
+        ClubRole.objects.create(club=self.club, member=self.member, role=ClubRole.Roles.ADMIN)
+
+        membership = self.make_membership()
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.ADMIN)
+
+        membership.status = ClubMembership.StatusChoices.CANCELLED
+        membership.save()
+
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.ADMIN)
+
+    def test_editor_role_survives_a_lapsed_membership(self):
+        ClubRole.objects.create(club=self.club, member=self.member, role=ClubRole.Roles.EDITOR)
+        membership = self.make_membership()
+
+        membership.status = ClubMembership.StatusChoices.LAPSED
+        membership.save()
+
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.EDITOR)
+
+    def test_elevated_role_survives_membership_deletion(self):
+        ClubRole.objects.create(club=self.club, member=self.member, role=ClubRole.Roles.ADMIN)
+        membership = self.make_membership()
+
+        membership.delete()
+
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.ADMIN)
+
+    def test_elevated_role_survives_a_season_rollover(self):
+        # Last season's membership lapses and the new season's is still pending:
+        # the admin must not lose their role in the gap.
+        ClubRole.objects.create(club=self.club, member=self.member, role=ClubRole.Roles.ADMIN)
+        last_season = self.make_membership()
+        next_season = Season.objects.create(
+            club=self.club,
+            start_date=self.season.end_date + datetime.timedelta(days=1),
+            end_date=self.season.end_date + datetime.timedelta(days=300),
+        )
+
+        last_season.status = ClubMembership.StatusChoices.LAPSED
+        last_season.save()
+        ClubMembership.objects.create(club=self.club, member=self.member, season=next_season, status=ClubMembership.StatusChoices.PENDING)
+
+        self.assertEqual(self.roles().get().role, ClubRole.Roles.ADMIN)
+
+    def test_elevated_access_and_login_survive_a_lapsed_membership(self):
+        # The whole point: a lapsed membership must not lock an admin out.
+        user = get_user_model().objects.create_user(email="admin@example.com", password="pw")
+        admin = Member.objects.create(user=user, first_name="Ada", last_name="Min")
+        ClubRole.objects.create(club=self.club, member=admin, role=ClubRole.Roles.ADMIN)
+        membership = ClubMembership.objects.create(club=self.club, member=admin, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        membership.status = ClubMembership.StatusChoices.CANCELLED
+        membership.save()
+
+        self.assertTrue(user.is_active)  # can still log in
+        self.assertIn(ClubRole.Roles.ADMIN, roles_in_club(user, self.club))
+        self.assertTrue(has_club_role(user, self.club, ClubRole.Roles.ADMIN))
+        self.assertTrue(can_manage_shop(user, self.club))
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "testserver"],
+)
+class BrandingTests(TestCase):
+    """The auth screens are shared; only the skin they inherit differs per tenant."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def login_page(self, host):
+        return self.client.get(reverse("account_login"), HTTP_HOST=host)
+
+    def test_the_base_domain_gets_the_platform_skin(self):
+        response = self.login_page("rosterchief.app")
+
+        self.assertTemplateUsed(response, "_platform_base.html")
+        self.assertTemplateNotUsed(response, "_club_base.html")
+        self.assertContains(response, "Club &amp; Team Management")
+        self.assertIsNone(response.context["club"])
+
+    def test_a_club_subdomain_gets_the_club_skin(self):
+        response = self.login_page("ajax-united.rosterchief.app")
+
+        self.assertTemplateUsed(response, "_club_base.html")
+        self.assertTemplateNotUsed(response, "_platform_base.html")
+        self.assertContains(response, "Ajax United")
+        self.assertEqual(response.context["club"], self.club)
+
+    def test_an_archived_club_falls_back_to_the_platform_skin(self):
+        # The subdomain stops resolving, so there is no club to brand with.
+        self.club.archive()
+
+        self.assertTemplateUsed(self.login_page("ajax-united.rosterchief.app"), "_platform_base.html")
+
+    def test_a_club_without_a_logo_shows_its_initials_not_our_mark(self):
+        response = self.login_page("ajax-united.rosterchief.app")
+
+        self.assertContains(response, "AU")
+        self.assertNotContains(response, "rosterchief-dark.svg")
+
+    def test_a_club_logo_is_rendered_when_set(self):
+        self.club.logo = "clubs/ajax-united/crest.png"
+        self.club.save()
+
+        self.assertContains(self.login_page("ajax-united.rosterchief.app"), "clubs/ajax-united/crest.png")
+
+    def test_a_club_logo_gets_a_primary_coloured_ring(self):
+        self.club.logo = "clubs/ajax-united/crest.png"
+        self.club.save()
+
+        self.assertContains(self.login_page("ajax-united.rosterchief.app"), "ring-primary")
+
+    def test_a_club_colour_overrides_the_theme(self):
+        self.club.primary_color = "#1e40af"
+        self.club.save()
+
+        self.assertContains(self.login_page("ajax-united.rosterchief.app"), "--color-primary: #1e40af")
+
+    def test_no_colour_means_no_override(self):
+        self.assertNotContains(self.login_page("ajax-united.rosterchief.app"), "--color-primary")
+
+    def test_a_club_secondary_colour_overrides_the_theme(self):
+        self.club.secondary_color = "#be185d"
+        self.club.save()
+
+        self.assertContains(self.login_page("ajax-united.rosterchief.app"), "--color-secondary: #be185d")
+
+    def test_no_secondary_colour_means_no_override(self):
+        self.assertNotContains(self.login_page("ajax-united.rosterchief.app"), "--color-secondary")
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "testserver"],
+)
+class Custom403PageTests(TestCase):
+    """Django's default 403 handler picks up templates/403.html automatically --
+    branded per tenant (base_template, same as maintenance.html) so a permission
+    error still looks like the app, not a bare Django error page, and the navbar
+    (sign out, theme toggle, home link) stays reachable."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_a_club_subdomain_403_gets_the_club_skin(self):
+        member = get_user_model().objects.create_user(email="member-403@example.com", password="pw-secret-123")
+        self.client.force_login(member)
+
+        response = self.client.get(reverse("management:position_list"), HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertEqual(response.status_code, 403)
+        self.assertContains(response, "Access denied", status_code=403)
+        self.assertContains(response, "Ajax United", status_code=403)
+        self.assertContains(response, "Sign out", status_code=403)
+
+    def test_the_base_domain_403_gets_the_platform_skin(self):
+        self.client.force_login(get_user_model().objects.create_user(email="platform-403@example.com", password="pw-secret-123"))
+
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        self.assertEqual(response.status_code, 403)
+        self.assertContains(response, "Access denied", status_code=403)
+        self.assertContains(response, "Club &amp; Team Management", status_code=403)
+
+
+class ClubBrandingModelTests(TestCase):
+    def test_initials_use_the_first_two_words(self):
+        self.assertEqual(Club(name="Ajax United Football Club").initials, "AU")
+        self.assertEqual(Club(name="Ajax").initials, "A")
+
+    def test_text_on_a_pale_colour_is_black_and_on_a_dark_one_white(self):
+        # A club picking pale yellow must not get white-on-yellow buttons.
+        self.assertEqual(Club(primary_color="#fef08a").primary_content_color, "#000000")
+        self.assertEqual(Club(primary_color="#1e40af").primary_content_color, "#ffffff")
+
+    def test_no_colour_means_no_contrast_colour(self):
+        self.assertEqual(Club(primary_color="").primary_content_color, "")
+
+    def test_a_colour_must_be_a_hex_value(self):
+        club = Club(name="Ajax United", primary_color="blue")
+
+        with self.assertRaises(ValidationError):
+            club.full_clean()
+
+    def test_logos_are_stored_per_club(self):
+        self.assertEqual(club_logo_path(Club(slug="ajax-united"), "crest.png"), "clubs/ajax-united/crest.png")
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "testserver"],
+)
+class RootViewTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.user = get_user_model().objects.create_user(email="member@example.com", password="pw-secret-123")
+
+    def test_the_base_domain_hands_off_to_the_control_panel(self):
+        response = self.client.get("/", HTTP_HOST="rosterchief.app")
+
+        self.assertRedirects(response, reverse("controlpanel:dashboard"), fetch_redirect_response=False)
+
+    def test_a_club_subdomain_lands_on_the_club_home(self):
+        self.client.force_login(self.user)
+
+        response = self.client.get("/", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertTemplateUsed(response, "club/home.html")
+        self.assertContains(response, "Ajax United")
+
+    def test_the_club_home_requires_a_login(self):
+        response = self.client.get("/", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertRedirects(response, f"{reverse('account_login')}?next=/", fetch_redirect_response=False)
+
+
+class FeeServiceTests(TestCase):
+    """club.services.fees -- record_payment/mark_as_paid/remaining_balance, the
+    service layer behind the Memberships page's per-row payment actions."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.season = make_season(self.club)
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+        self.membership = ClubMembership.objects.create(
+            club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.PENDING, fee_amount=Decimal("150.00")
+        )
+
+    def roles(self):
+        return ClubRole.objects.filter(club=self.club, member=self.member)
+
+    def test_remaining_balance_starts_at_the_full_fee(self):
+        self.assertEqual(remaining_balance(self.membership), Decimal("150.00"))
+
+    def test_remaining_balance_is_never_negative(self):
+        record_payment(self.membership, amount=Decimal("200.00"))
+
+        self.assertEqual(remaining_balance(self.membership), Decimal("0.00"))
+
+    def test_a_partial_payment_creates_a_record_and_updates_the_running_total(self):
+        payment = record_payment(self.membership, amount=Decimal("50.00"), method=FeePayment.Method.CASH, reference="R1", note="first installment")
+
+        self.assertEqual(payment.membership, self.membership)
+        self.assertEqual(payment.amount, Decimal("50.00"))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.amount_paid, Decimal("50.00"))
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PARTIALLY_PAID)
+        # Not yet settled -- status doesn't change on a partial payment.
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.PENDING)
+
+    def test_multiple_partial_payments_accumulate(self):
+        record_payment(self.membership, amount=Decimal("50.00"))
+        record_payment(self.membership, amount=Decimal("60.00"))
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.amount_paid, Decimal("110.00"))
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PARTIALLY_PAID)
+        self.assertEqual(FeePayment.objects.filter(membership=self.membership).count(), 2)
+
+    def test_reaching_the_full_amount_settles_and_activates(self):
+        record_payment(self.membership, amount=Decimal("100.00"))
+        record_payment(self.membership, amount=Decimal("50.00"))
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(self.membership.activated_at, timezone.localdate())
+        self.assertTrue(self.roles().filter(role=ClubRole.Roles.MEMBER).exists())
+
+    def test_settling_in_full_does_not_overwrite_an_earlier_activated_at(self):
+        earlier = datetime.date(2026, 1, 1)
+        self.membership.activated_at = earlier
+        self.membership.save()
+
+        record_payment(self.membership, amount=Decimal("150.00"))
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.activated_at, earlier)
+
+    def test_a_waived_membership_is_untouched_by_a_payment(self):
+        self.membership.fee_status = ClubMembership.FeeStatus.WAIVED
+        self.membership.save()
+
+        record_payment(self.membership, amount=Decimal("50.00"))
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.WAIVED)
+
+    def test_mark_as_paid_records_the_exact_remaining_balance(self):
+        record_payment(self.membership, amount=Decimal("100.00"))
+
+        mark_as_paid(self.membership)
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+        payment = FeePayment.objects.get(membership=self.membership, amount=Decimal("50.00"))
+        self.assertEqual(payment.note, "Marked as paid")
+
+    def test_mark_as_paid_with_no_fee_amount_set_skips_creating_a_zero_payment(self):
+        # FeePayment.amount has a MinValueValidator(0.01) -- a $0 "payment" isn't a
+        # real transaction, so this must flip the flags directly instead.
+        unpriced = ClubMembership.objects.create(club=self.club, member=Member.objects.create(first_name="No", last_name="Price"), season=self.season, status=ClubMembership.StatusChoices.PENDING)
+
+        mark_as_paid(unpriced)
+
+        unpriced.refresh_from_db()
+        self.assertEqual(unpriced.fee_status, ClubMembership.FeeStatus.PAID)
+        self.assertEqual(unpriced.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertFalse(FeePayment.objects.filter(membership=unpriced).exists())
+
+    def test_recorded_by_is_stored_on_the_payment(self):
+        user = get_user_model().objects.create_user(email="admin-fees@example.com", password="pw-secret-123")
+
+        payment = record_payment(self.membership, amount=Decimal("50.00"), recorded_by=user)
+
+        self.assertEqual(payment.recorded_by, user)
+
+
+class SeasonStartEndTests(TestCase):
+    """club.services.seasons._initial_season_start / _season_end -- the
+    per-club rules generate_seasons chains off, now that a club's own
+    season_start/season_duration_months drive them instead of a fixed Aug-May
+    window."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_a_date_past_this_years_anchor_uses_this_year(self):
+        self.club.season_start = datetime.date(2000, 8, 1)
+
+        start = _initial_season_start(self.club, datetime.date(2026, 8, 15))
+
+        self.assertEqual(start, datetime.date(2026, 8, 1))
+
+    def test_a_date_before_this_years_anchor_uses_last_year(self):
+        self.club.season_start = datetime.date(2000, 8, 1)
+
+        start = _initial_season_start(self.club, datetime.date(2027, 2, 1))
+
+        self.assertEqual(start, datetime.date(2026, 8, 1))
+
+    def test_the_anchor_date_itself_uses_this_year(self):
+        self.club.season_start = datetime.date(2000, 8, 1)
+
+        start = _initial_season_start(self.club, datetime.date(2026, 8, 1))
+
+        self.assertEqual(start, datetime.date(2026, 8, 1))
+
+    def test_season_end_is_the_day_before_the_start_plus_the_duration(self):
+        self.club.season_duration_months = 12
+
+        end = _season_end(datetime.date(2026, 8, 1), self.club)
+
+        self.assertEqual(end, datetime.date(2027, 7, 31))
+
+    def test_a_shorter_duration_produces_a_shorter_season(self):
+        self.club.season_duration_months = 6
+
+        end = _season_end(datetime.date(2026, 8, 1), self.club)
+
+        self.assertEqual(end, datetime.date(2027, 1, 31))
+
+
+class GenerateSeasonsTests(TestCase):
+    """club.services.seasons.generate_seasons -- the service behind the
+    generate_seasons management command."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_generates_a_season_covering_today(self):
+        today = timezone.localdate()
+
+        generate_seasons(self.club, today)
+
+        self.assertTrue(Season.objects.filter(club=self.club, start_date__lte=today, end_date__gte=today).exists())
+
+    def test_generates_every_window_through_the_horizon(self):
+        today = timezone.localdate()
+        until = today + relativedelta(years=2)
+
+        created = generate_seasons(self.club, until)
+
+        self.assertGreaterEqual(len(created), 2)
+        for season in created:
+            self.assertLessEqual(season.start_date, until)
+
+    def test_is_idempotent_on_a_second_run(self):
+        until = timezone.localdate() + relativedelta(years=2)
+        generate_seasons(self.club, until)
+        count_after_first = Season.objects.filter(club=self.club).count()
+
+        second_run = generate_seasons(self.club, until)
+
+        self.assertEqual(second_run, [])
+        self.assertEqual(Season.objects.filter(club=self.club).count(), count_after_first)
+
+    def test_a_new_season_starts_the_day_after_the_last_one_ends(self):
+        today = timezone.localdate()
+        generate_seasons(self.club, today)
+        latest = Season.objects.filter(club=self.club).order_by("-end_date").first()
+
+        generate_seasons(self.club, latest.end_date + relativedelta(months=self.club.season_duration_months))
+
+        next_season = Season.objects.filter(club=self.club, start_date=latest.end_date + datetime.timedelta(days=1)).first()
+        self.assertIsNotNone(next_season)
+
+    def test_changing_the_duration_only_affects_the_next_generated_season(self):
+        today = timezone.localdate()
+        generate_seasons(self.club, today)
+        first = Season.objects.filter(club=self.club).order_by("-end_date").first()
+
+        self.club.season_duration_months = 6
+        self.club.save()
+        generate_seasons(self.club, first.end_date + relativedelta(months=6))
+
+        first_end_before = first.end_date
+        first.refresh_from_db()
+        self.assertEqual(first.end_date, first_end_before)  # existing season untouched
+        second = Season.objects.get(club=self.club, start_date=first.end_date + datetime.timedelta(days=1))
+        self.assertEqual(second.end_date, second.start_date + relativedelta(months=6) - datetime.timedelta(days=1))
+
+    def test_does_not_disturb_a_pre_existing_irregular_season(self):
+        odd = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        generate_seasons(self.club, timezone.localdate())
+
+        odd.refresh_from_db()
+        self.assertEqual(odd.start_date, datetime.date(2020, 3, 1))
+        self.assertEqual(odd.end_date, datetime.date(2020, 9, 1))
+
+
+class ResyncSeasonsTests(TestCase):
+    """club.services.seasons.resync_seasons -- cleaning up seasons that don't
+    match a club's current settings (e.g. left over from a since-changed
+    season_start/season_duration_months)."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.until = timezone.localdate() + relativedelta(years=2)
+
+    def test_a_wrong_and_unreferenced_season_is_reported_as_removable(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        removed, kept = resync_seasons(self.club, self.until)
+
+        self.assertIn(wrong, removed)
+        self.assertEqual(kept, [])
+
+    def test_commit_actually_deletes_a_wrong_unreferenced_season(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        resync_seasons(self.club, self.until, commit=True)
+
+        self.assertFalse(Season.objects.filter(pk=wrong.pk).exists())
+
+    def test_without_commit_nothing_is_actually_deleted(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        resync_seasons(self.club, self.until, commit=False)
+
+        self.assertTrue(Season.objects.filter(pk=wrong.pk).exists())
+
+    def test_a_wrong_but_referenced_season_is_kept_not_removed(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+        member = Member.objects.create(first_name="Jane", last_name="Doe")
+        ClubMembership.objects.create(club=self.club, member=member, season=wrong)
+
+        removed, kept = resync_seasons(self.club, self.until, commit=True)
+
+        self.assertEqual(removed, [])
+        self.assertIn(wrong, kept)
+        self.assertTrue(Season.objects.filter(pk=wrong.pk).exists())
+
+    def test_a_season_matching_current_settings_is_left_alone(self):
+        generate_seasons(self.club, timezone.localdate())
+
+        removed, kept = resync_seasons(self.club, self.until)
+
+        self.assertEqual(removed, [])
+        self.assertEqual(kept, [])
+
+    def test_a_season_referenced_only_via_staff_assignment_is_kept_not_removed(self):
+        # Season is PROTECTed by more than just ClubMembership -- a season kept
+        # alive only through a StaffAssignment must not be silently deleted either.
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+        team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True)
+        member = Member.objects.create(first_name="Jane", last_name="Doe")
+        StaffAssignment.objects.create(team=team, member=member, season=wrong, position=position)
+
+        removed, kept = resync_seasons(self.club, self.until, commit=True)
+
+        self.assertEqual(removed, [])
+        self.assertIn(wrong, kept)
+        self.assertTrue(Season.objects.filter(pk=wrong.pk).exists())
+
+
+class GenerateSeasonsCommandTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_default_years_is_two(self):
+        call_command("generate_seasons", stdout=StringIO())
+
+        today = timezone.localdate()
+        until = today + relativedelta(years=2)
+        seasons = Season.objects.filter(club=self.club).order_by("start_date")
+        self.assertTrue(seasons.exists())
+        for season in seasons:
+            self.assertLessEqual(season.start_date, until)
+        self.assertTrue(seasons.filter(start_date__lte=today, end_date__gte=today).exists())
+
+    def test_years_argument_controls_the_horizon(self):
+        call_command("generate_seasons", "--years", "1", stdout=StringIO())
+
+        until = timezone.localdate() + relativedelta(years=1)
+        for season in Season.objects.filter(club=self.club):
+            self.assertLessEqual(season.start_date, until)
+
+    def test_archived_clubs_are_skipped(self):
+        self.club.archive()
+
+        call_command("generate_seasons", stdout=StringIO())
+
+        self.assertFalse(Season.objects.filter(club=self.club).exists())
+
+    def test_second_run_creates_nothing_new(self):
+        call_command("generate_seasons", stdout=StringIO())
+        count_after_first = Season.objects.filter(club=self.club).count()
+
+        out = StringIO()
+        call_command("generate_seasons", stdout=out)
+
+        self.assertEqual(Season.objects.filter(club=self.club).count(), count_after_first)
+        self.assertIn("Generated 0 season", out.getvalue())
+
+    def test_resync_without_commit_reports_but_does_not_delete(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        out = StringIO()
+        call_command("generate_seasons", "--resync", stdout=out)
+
+        self.assertTrue(Season.objects.filter(pk=wrong.pk).exists())
+        self.assertIn("Would remove", out.getvalue())
+
+    def test_resync_with_commit_deletes_the_wrong_season(self):
+        wrong = Season.objects.create(club=self.club, start_date=datetime.date(2020, 3, 1), end_date=datetime.date(2020, 9, 1))
+
+        call_command("generate_seasons", "--resync", "--commit", stdout=StringIO())
+
+        self.assertFalse(Season.objects.filter(pk=wrong.pk).exists())
+
diff --git a/club/views.py b/club/views.py
new file mode 100644
index 0000000..3a5a18b
--- /dev/null
+++ b/club/views.py
@@ -0,0 +1,23 @@
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.shortcuts import redirect
+from django.views.generic import TemplateView
+
+
+class ClubHomeView(LoginRequiredMixin, TemplateView):
+    """Placeholder landing page for a club subdomain — where members land after
+    signing in, until the club-facing site is built."""
+
+    template_name = "club/home.html"
+
+
+def root(request):
+    """``/`` means different things per tenant.
+
+    This is why allauth needs no login-redirect adapter: LOGIN_REDIRECT_URL is "/",
+    and "/" resolves itself — a club subdomain lands on the club, the base domain
+    hands off to the platform control panel.
+    """
+    if request.club is None:
+        return redirect("controlpanel:dashboard")
+
+    return ClubHomeView.as_view()(request)
diff --git a/clubmanager/settings.py b/clubmanager/settings.py
deleted file mode 100644
index af184fd..0000000
--- a/clubmanager/settings.py
+++ /dev/null
@@ -1,118 +0,0 @@
-"""
-Django settings for clubmanager project.
-
-Generated by 'django-admin startproject' using Django 6.0.6.
-
-For more information on this file, see
-https://docs.djangoproject.com/en/6.0/topics/settings/
-
-For the full list of settings and their values, see
-https://docs.djangoproject.com/en/6.0/ref/settings/
-"""
-
-from pathlib import Path
-
-# Build paths inside the project like this: BASE_DIR / 'subdir'.
-BASE_DIR = Path(__file__).resolve().parent.parent
-
-
-# Quick-start development settings - unsuitable for production
-# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
-
-# SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-dp#5%d=#&us!*zt&v(ve48!$wb4$%j$4lk8_jx#k8p!i2w^sut'
-
-# SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
-
-ALLOWED_HOSTS = []
-
-
-# Application definition
-
-INSTALLED_APPS = [
-    'django.contrib.admin',
-    'django.contrib.auth',
-    'django.contrib.contenttypes',
-    'django.contrib.sessions',
-    'django.contrib.messages',
-    'django.contrib.staticfiles',
-]
-
-MIDDLEWARE = [
-    'django.middleware.security.SecurityMiddleware',
-    'django.contrib.sessions.middleware.SessionMiddleware',
-    'django.middleware.common.CommonMiddleware',
-    'django.middleware.csrf.CsrfViewMiddleware',
-    'django.contrib.auth.middleware.AuthenticationMiddleware',
-    'django.contrib.messages.middleware.MessageMiddleware',
-    'django.middleware.clickjacking.XFrameOptionsMiddleware',
-]
-
-ROOT_URLCONF = 'clubmanager.urls'
-
-TEMPLATES = [
-    {
-        'BACKEND': 'django.template.backends.django.DjangoTemplates',
-        'DIRS': [BASE_DIR / 'templates']
-        ,
-        'APP_DIRS': True,
-        'OPTIONS': {
-            'context_processors': [
-                'django.template.context_processors.request',
-                'django.contrib.auth.context_processors.auth',
-                'django.contrib.messages.context_processors.messages',
-            ],
-        },
-    },
-]
-
-WSGI_APPLICATION = 'clubmanager.wsgi.application'
-
-
-# Database
-# https://docs.djangoproject.com/en/6.0/ref/settings/#databases
-
-DATABASES = {
-    'default': {
-        'ENGINE': 'django.db.backends.sqlite3',
-        'NAME': BASE_DIR / 'db.sqlite3',
-    }
-}
-
-
-# Password validation
-# https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
-
-AUTH_PASSWORD_VALIDATORS = [
-    {
-        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
-    },
-]
-
-
-# Internationalization
-# https://docs.djangoproject.com/en/6.0/topics/i18n/
-
-LANGUAGE_CODE = 'en-us'
-
-TIME_ZONE = 'UTC'
-
-USE_I18N = True
-
-USE_TZ = True
-
-
-# Static files (CSS, JavaScript, Images)
-# https://docs.djangoproject.com/en/6.0/howto/static-files/
-
-STATIC_URL = 'static/'
diff --git a/clubmanager/urls.py b/clubmanager/urls.py
deleted file mode 100644
index 1491602..0000000
--- a/clubmanager/urls.py
+++ /dev/null
@@ -1,22 +0,0 @@
-"""
-URL configuration for clubmanager project.
-
-The `urlpatterns` list routes URLs to views. For more information please see:
-    https://docs.djangoproject.com/en/6.0/topics/http/urls/
-Examples:
-Function views
-    1. Add an import:  from my_app import views
-    2. Add a URL to urlpatterns:  path('', views.home, name='home')
-Class-based views
-    1. Add an import:  from other_app.views import Home
-    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
-Including another URLconf
-    1. Import the include() function: from django.urls import include, path
-    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
-"""
-from django.contrib import admin
-from django.urls import path
-
-urlpatterns = [
-    path('admin/', admin.site.urls),
-]
diff --git a/compose.behind-proxy.yaml b/compose.behind-proxy.yaml
new file mode 100644
index 0000000..2b2f348
--- /dev/null
+++ b/compose.behind-proxy.yaml
@@ -0,0 +1,63 @@
+# A dev/test deployment on a server that ALREADY runs Caddy on :80/:443.
+#
+#   docker compose -f compose.behind-proxy.yaml up -d
+#
+# The difference from compose.yaml is only what listens on the network: no caddy service, and
+# web publishes on the loopback instead of the public interface. The host's Caddy reverse
+# proxies to it (see DEPLOYMENT.md, "Behind an existing Caddy").
+#
+# Publishing on 127.0.0.1 and not 0.0.0.0 is the point: bound to all interfaces, a test
+# instance is reachable on http://<server-ip>:8001 with no TLS, bypassing the proxy and every
+# security header with it.
+
+name: rosterchief-test
+
+services:
+  web:
+    build: .
+    restart: unless-stopped
+    env_file: .env.production
+    ports:
+      - "127.0.0.1:${WEB_PORT:-8001}:8000"
+    volumes:
+      # Uploaded club logos, while storage is local disk (see rosterchief/urls.py). Without
+      # this, a rebuild or recreate wipes MEDIA_ROOT even though the container itself keeps
+      # running fine in between.
+      - media_data:/app/media
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+  db:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-rosterchief}
+      POSTGRES_USER: ${POSTGRES_USER:-rosterchief}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set a database password}
+    # See compose.yaml for why these are trimmed from the defaults.
+    command: ["postgres", "-c", "shared_buffers=64MB", "-c", "max_connections=20"]
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-rosterchief}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--save", "", "--appendonly", "no", "--maxmemory", "32mb", "--maxmemory-policy", "allkeys-lru"]
+
+volumes:
+  pgdata:
+  media_data:
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..a38d681
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,88 @@
+# One server. The same image and the same environment variables run a multi-server
+# deployment: point DJANGO_DATABASE_URL / DJANGO_REDIS_URL at your central services, set a
+# bucket, drop the `db` and `redis` services, and run several `web` containers behind a load
+# balancer. Nothing in the code changes.
+
+name: rosterchief
+
+services:
+  caddy:
+    build:
+      context: ./deploy/caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"
+    environment:
+      # A wildcard certificate for *.rosterchief.app cannot be issued over HTTP-01 — Let's
+      # Encrypt only does wildcards via DNS-01. That is why Caddy needs a DNS API token, and
+      # why this image is built with the provider's DNS plugin rather than pulled as-is.
+      ROSTERCHIEF_BASE_DOMAIN: ${ROSTERCHIEF_BASE_DOMAIN:?set the base domain, e.g. rosterchief.app}
+      ACME_EMAIL: ${ACME_EMAIL:?set an email for Let's Encrypt}
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:?DNS-01 needs an API token with DNS:Edit on the zone}
+    volumes:
+      - ./deploy/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+      # Read-only: Caddy serves club logos straight off disk instead of round-tripping every
+      # image request through a gunicorn worker. Same volume `web` writes uploads into.
+      - media_data:/srv/media:ro
+    depends_on:
+      - web
+
+  web:
+    build: .
+    restart: unless-stopped
+    env_file: .env.production
+    volumes:
+      # Uploaded club logos, while storage is local disk (see rosterchief/urls.py). Without
+      # this, a rebuild or recreate wipes MEDIA_ROOT even though the container itself keeps
+      # running fine in between.
+      - media_data:/app/media
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+  db:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-rosterchief}
+      POSTGRES_USER: ${POSTGRES_USER:-rosterchief}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set a database password}
+    # shared_buffers/max_connections default to 128MB / 100 — sized for a much bigger database
+    # than this app's (DEPLOYMENT.md: ~0.2GB after 5 years). 20 connections is comfortably above
+    # 2 gunicorn workers x 4 threads plus the odd `manage.py` one-off; trimmed both for the box,
+    # not for the data.
+    command: ["postgres", "-c", "shared_buffers=64MB", "-c", "max_connections=20"]
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-rosterchief}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    # Cache only, so nothing here needs to survive a restart. It is not optional though: it
+    # is what keeps every gunicorn worker agreeing about which feature flags are on. maxmemory
+    # is a ceiling, not a saving — this is already the smallest process in the stack — but on a
+    # memory-limited box it should evict cache entries under pressure, not grow unbounded.
+    command: ["redis-server", "--save", "", "--appendonly", "no", "--maxmemory", "32mb", "--maxmemory-policy", "allkeys-lru"]
+
+volumes:
+  pgdata:
+  caddy_data:
+  caddy_config:
+  media_data:
diff --git a/controlpanel/__init__.py b/controlpanel/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/controlpanel/apps.py b/controlpanel/apps.py
new file mode 100644
index 0000000..36fad22
--- /dev/null
+++ b/controlpanel/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class ControlpanelConfig(AppConfig):
+    name = "controlpanel"
diff --git a/controlpanel/forms.py b/controlpanel/forms.py
new file mode 100644
index 0000000..c837a60
--- /dev/null
+++ b/controlpanel/forms.py
@@ -0,0 +1,155 @@
+from decimal import Decimal
+
+from django import forms
+from django.utils.translation import gettext_lazy as _
+from waffle import get_waffle_flag_model
+
+from billing.models import DuePayment, Subscription, Tier, TierPrice
+from club.models import Club
+from events.models import Location
+
+from .services.admins import find_member_by_email
+
+
+class ClubForm(forms.ModelForm):
+    class Meta:
+        model = Club
+        fields = ["name", "slug", "sport_type", "logo", "primary_color", "secondary_color", "season_start", "season_duration_months"]
+        help_texts = {"slug": _("Drives the club's subdomain. Left blank, it is derived from the name.")}
+        # Deliberately a text input, not <input type="color">: a colour picker cannot
+        # express "no colour" -- it would submit #000000 for every club that never
+        # touched it, and every club would silently get a black theme.
+        widgets = {
+            "primary_color": forms.TextInput(attrs={"placeholder": "#1e40af"}),
+            "secondary_color": forms.TextInput(attrs={"placeholder": "#be185d"}),
+            "logo": forms.ClearableFileInput(attrs={"accept": "image/png,image/jpeg,image/gif,image/webp,image/svg+xml"}),
+            "season_start": forms.DateInput(attrs={"type": "date"}),
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["slug"].required = False
+
+
+class HomeLocationForm(forms.ModelForm):
+    """Create or update the club's home ground -- this *is* an events.Location row
+    (flagged ``is_home``), the same one that shows up under the club's own
+    Teams > Locations page, so the two stay in sync by construction rather than
+    needing anything to keep them that way."""
+
+    class Meta:
+        model = Location
+        fields = ["name", "address", "city", "zip_code", "country"]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["country"].widget.attrs.update({"data-searchable": "true", "data-search-placeholder": _("Type a country to search...")})
+
+
+class ClubAdminForm(forms.Form):
+    """Grant club-admin rights to an email address, creating the person if new."""
+
+    email = forms.EmailField(label=_("Email address"), help_text=_("If this email has no account yet, one is created and they set a password via the reset link."))
+    first_name = forms.CharField(label=_("First name"), required=False)
+    last_name = forms.CharField(label=_("Last name"), required=False)
+
+    def clean(self):
+        cleaned = super().clean()
+        email = cleaned.get("email")
+
+        # Only a brand-new person needs a name; an existing member already has one.
+        if email and find_member_by_email(email) is None:
+            for field in ("first_name", "last_name"):
+                if not cleaned.get(field):
+                    self.add_error(field, _("Required: this email has no account yet."))
+
+        return cleaned
+
+
+class PlatformAdminForm(forms.Form):
+    """Grant platform access to an email address, creating the account if new."""
+
+    email = forms.EmailField(label=_("Email address"), help_text=_("If this email has no account yet, one is created and they set a password via the reset link."))
+    is_superuser = forms.BooleanField(label=_("Superuser"), required=False, help_text=_("Superusers can manage platform admins. Everyone granted access is staff."))
+
+
+class FlagForm(forms.ModelForm):
+    class Meta:
+        model = get_waffle_flag_model()
+        fields = ["name", "note", "everyone", "superusers", "staff", "percent"]
+        help_texts = {
+            "everyone": _("Yes = on for all clubs, No = off everywhere (overrides club targeting). Leave unknown to target clubs."),
+        }
+
+
+class TierForm(forms.ModelForm):
+    class Meta:
+        model = Tier
+        fields = ["name", "description", "is_active"]
+
+
+class TierPriceForm(forms.ModelForm):
+    class Meta:
+        model = TierPrice
+        fields = ["active_from", "amount"]
+        widgets = {"active_from": forms.DateInput(attrs={"type": "date"})}
+        help_texts = {"active_from": _("Periods opening on or after this date are billed at this amount. Existing periods keep the amount they were billed at.")}
+
+
+class SubscriptionForm(forms.ModelForm):
+    """Put a club on a tier. The first period opens when the subscription is created."""
+
+    start = forms.DateField(required=False, widget=forms.DateInput(attrs={"type": "date"}), label=_("First period starts"), help_text=_("Left blank, the period starts today."))
+
+    class Meta:
+        model = Subscription
+        fields = ["tier", "auto_renew", "auto_archive", "notes"]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # An inactive tier still bills its existing subscriptions, but must not be picked up
+        # by a new one — which is the whole point of retiring a tier.
+        self.fields["tier"].queryset = Tier.objects.filter(is_active=True)
+
+
+class TrialForm(forms.Form):
+    """Put a club with no subscription yet on a short trial that switches itself to
+    ``post_trial_tier`` automatically once it ends -- see billing.services.dues.start_trial."""
+
+    trial_tier = forms.ModelChoiceField(queryset=Tier.objects.none(), label=_("Trial tier"), help_text=_("What this club is billed on during the trial."))
+    post_trial_tier = forms.ModelChoiceField(queryset=Tier.objects.none(), label=_("Then switch to"), help_text=_("The plan it lands on automatically once the trial ends."))
+    trial_months = forms.IntegerField(min_value=1, initial=2, label=_("Trial length (months)"))
+    start = forms.DateField(required=False, widget=forms.DateInput(attrs={"type": "date"}), label=_("Trial starts"), help_text=_("Left blank, the trial starts today."))
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Same reasoning as SubscriptionForm: a retired tier keeps billing whoever is
+        # already on it, but must not be offered for a new trial or a new plan either.
+        self.fields["trial_tier"].queryset = Tier.objects.filter(is_active=True)
+        self.fields["post_trial_tier"].queryset = Tier.objects.filter(is_active=True)
+
+
+class DuePaymentForm(forms.Form):
+    amount = forms.DecimalField(max_digits=10, decimal_places=2, min_value=Decimal("0.01"), label=_("Amount"))
+    method = forms.ChoiceField(choices=DuePayment.Method.choices, initial=DuePayment.Method.BANK_TRANSFER, label=_("Method"))
+    reference = forms.CharField(required=False, label=_("Reference"), help_text=_("Bank reference, transaction id — whatever lets you find this again."))
+    paid_at = forms.DateTimeField(required=False, widget=forms.DateTimeInput(attrs={"type": "datetime-local"}), label=_("Received"), help_text=_("Left blank, now."))
+    note = forms.CharField(required=False, widget=forms.Textarea(attrs={"rows": 2}), label=_("Note"))
+
+
+class OpenPeriodForm(forms.Form):
+    """Renew, or reactivate an archived club."""
+
+    start = forms.DateField(required=False, widget=forms.DateInput(attrs={"type": "date"}), label=_("Period starts"), help_text=_("Left blank, it continues from the end of the last period — so a lapsed year is still owed."))
+
+
+class MaintenanceForm(forms.Form):
+    """Closing the platform is a deliberate act, so it takes a sentence explaining itself —
+    that message is the only thing a club will see."""
+
+    message = forms.CharField(
+        required=False,
+        widget=forms.Textarea(attrs={"rows": 2}),
+        label=_("Message"),
+        help_text=_("Shown to every club while the platform is closed. Left blank, they get a generic notice."),
+    )
diff --git a/controlpanel/messages.py b/controlpanel/messages.py
new file mode 100644
index 0000000..f7f4efb
--- /dev/null
+++ b/controlpanel/messages.py
@@ -0,0 +1,35 @@
+"""A compact way to queue a Django message that carries its own title.
+
+Django's messages framework has no title field — a call site that wants one passes it
+as ``extra_tags`` (``messages.success(request, body, extra_tags="Club created")``), which
+reads fine written out but is easy to forget, so in practice every message ends up on
+the generic per-level heading (`as_alert`'s "Done" / "Careful" / "Something went wrong").
+
+``notify`` folds level, title and body into one string instead: ``"<level>|<title>|<body>"``.
+One call, title included, nothing to forget. `as_alert` (controlpanel/templatetags/ui.py)
+reads the title back off ``extra_tags`` at render time — unchanged from before.
+"""
+
+from django.contrib import messages
+
+#: One letter per Django message level. `notify` picks the level from the spec string;
+#: `as_alert` picks the icon/colour/fallback-title from the level the message actually
+#: carries (via ``level_tag``), so the two stay in step by construction.
+LEVELS = {
+    "s": messages.SUCCESS,
+    "i": messages.INFO,
+    "w": messages.WARNING,
+    "e": messages.ERROR,
+    "d": messages.DEBUG,
+}
+
+
+def notify(request, spec: str, **kwargs) -> None:
+    """Queue a message from a ``"<level>|<title>|<body>"`` spec.
+
+    ``level`` is one of ``s`` (success), ``i`` (info), ``w`` (warning), ``e`` (error),
+    ``d`` (debug). An empty title (``"s||Body text"``) falls back to the generic
+    per-level heading, same as never passing ``extra_tags`` at all.
+    """
+    level_code, title, body = spec.split("|", 2)
+    messages.add_message(request, LEVELS[level_code], body, extra_tags=title, **kwargs)
diff --git a/controlpanel/migrations/__init__.py b/controlpanel/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/controlpanel/mixins.py b/controlpanel/mixins.py
new file mode 100644
index 0000000..9e8f326
--- /dev/null
+++ b/controlpanel/mixins.py
@@ -0,0 +1,61 @@
+from django.contrib.auth.mixins import UserPassesTestMixin
+from django.http import Http404
+from django.shortcuts import redirect
+
+from .messages import notify
+
+
+class PlatformStaffRequiredMixin(UserPassesTestMixin):
+    """Gate for the platform control panel.
+
+    Two rules:
+
+    * **Staff only.** ``is_staff`` or ``is_superuser``. Anonymous visitors are
+      sent to the login page; signed-in non-staff get a 403 (Django's
+      AccessMixin already distinguishes those two cases). Staff must also hold a
+      second factor — ``RequireMFAMiddleware`` enforces that, so the panel is
+      2FA-protected for free.
+    * **Base domain only.** The panel manages *all* clubs, so it must not be
+      reachable from inside one. If the tenant middleware resolved a club from
+      the subdomain, the panel does not exist here.
+    """
+
+    def dispatch(self, request, *args, **kwargs):
+        if getattr(request, "club", None) is not None:
+            raise Http404("The control panel is not available on a club subdomain.")
+        return super().dispatch(request, *args, **kwargs)
+
+    def test_func(self):
+        user = self.request.user
+        return user.is_staff or user.is_superuser
+
+
+class PlatformSuperuserRequiredMixin(PlatformStaffRequiredMixin):
+    """Superusers only.
+
+    Managing platform admins is the one thing staff may not do. The panel is
+    gated on ``is_staff or is_superuser``, so if a staff member could grant
+    themselves ``is_superuser`` the two would collapse into the same thing and
+    ``is_superuser`` would stop being a security boundary.
+    """
+
+    def test_func(self):
+        return self.request.user.is_superuser
+
+
+class RedirectOnInvalidMixin:
+    """A form submitted from a modal has nowhere sensible to re-render on error: the page
+    that opened it has already moved on, and the view has no standalone template of its
+    own. Redirect back to ``invalid_redirect_url_name`` instead, with the errors flattened
+    into messages, rather than Django's default of re-rendering ``template_name``.
+    """
+
+    invalid_redirect_url_name = None
+
+    def get_invalid_redirect_kwargs(self):
+        return {}
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|Couldn't save|{' '.join(error)}")
+        return redirect(self.invalid_redirect_url_name, **self.get_invalid_redirect_kwargs())
diff --git a/controlpanel/services/__init__.py b/controlpanel/services/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/controlpanel/services/admins.py b/controlpanel/services/admins.py
new file mode 100644
index 0000000..89ba187
--- /dev/null
+++ b/controlpanel/services/admins.py
@@ -0,0 +1,47 @@
+"""Granting and revoking club-admin rights from the platform panel."""
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+
+from club.models import ClubRole
+from members.models import Member
+
+User = get_user_model()
+
+
+def find_member_by_email(email):
+    """The Member behind a login email, if that account exists at all."""
+    return Member.objects.filter(user__email__iexact=email).first()
+
+
+@transaction.atomic
+def grant_club_admin(club, email, first_name="", last_name=""):
+    """Make the holder of ``email`` an ADMIN of ``club``, creating them if new.
+
+    A ClubRole hangs off a Member, and a Member optionally links to a User — so
+    an admin who has never existed needs both. The account is created without a
+    usable password; they set one via the password-reset flow.
+    """
+    email = email.lower()
+    user, created_user = User.objects.get_or_create(email=email, defaults={"is_active": True})
+    if created_user:
+        user.set_unusable_password()
+        user.save(update_fields=["password"])
+
+    member, _ = Member.objects.get_or_create(
+        user=user,
+        defaults={"first_name": first_name, "last_name": last_name},
+    )
+
+    # One role per member per club, so promote rather than add a second row.
+    role, created_role = ClubRole.objects.get_or_create(club=club, member=member, defaults={"role": ClubRole.Roles.ADMIN})
+    if not created_role and role.role != ClubRole.Roles.ADMIN:
+        role.role = ClubRole.Roles.ADMIN
+        role.save(update_fields=["role"])
+
+    return role
+
+
+def revoke_club_admin(role):
+    """Remove admin rights. The membership-status sync never re-adds ADMIN."""
+    role.delete()
diff --git a/controlpanel/services/platform_admins.py b/controlpanel/services/platform_admins.py
new file mode 100644
index 0000000..1bf55f0
--- /dev/null
+++ b/controlpanel/services/platform_admins.py
@@ -0,0 +1,76 @@
+"""Granting and revoking platform access (is_staff / is_superuser).
+
+The guardrails matter more than the plumbing here: it must be impossible to lock
+the platform out of itself. Two rules are enforced for every change:
+
+* you cannot strip your **own** access (you would lose the panel mid-click);
+* the **last superuser** can never be demoted, or nobody could administer the
+  platform again without shell access.
+"""
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django.db.models import Q
+
+User = get_user_model()
+
+
+class PlatformAdminError(Exception):
+    """A change that would leave the platform unadministrable."""
+
+
+def platform_admins():
+    return User.objects.filter(Q(is_staff=True) | Q(is_superuser=True)).order_by("email")
+
+
+def is_last_superuser(user) -> bool:
+    return user.is_superuser and not User.objects.filter(is_superuser=True).exclude(pk=user.pk).exists()
+
+
+def check_access_change(actor, user, *, is_staff: bool, is_superuser: bool) -> None:
+    """Raise PlatformAdminError if this change would lock someone out."""
+    losing_access = not (is_staff or is_superuser)
+
+    if actor.pk == user.pk and losing_access:
+        raise PlatformAdminError("You cannot remove your own platform access.")
+
+    if actor.pk == user.pk and user.is_superuser and not is_superuser:
+        raise PlatformAdminError("You cannot remove your own superuser rights.")
+
+    if user.is_superuser and not is_superuser and is_last_superuser(user):
+        raise PlatformAdminError("At least one superuser must remain.")
+
+
+@transaction.atomic
+def set_platform_access(actor, user, *, is_staff: bool, is_superuser: bool):
+    check_access_change(actor, user, is_staff=is_staff, is_superuser=is_superuser)
+
+    # A superuser without is_staff cannot reach the panel, which is a confusing
+    # half-state; superuser implies staff.
+    user.is_staff = is_staff or is_superuser
+    user.is_superuser = is_superuser
+    user.save(update_fields=["is_staff", "is_superuser"])
+    return user
+
+
+def revoke_platform_access(actor, user):
+    return set_platform_access(actor, user, is_staff=False, is_superuser=False)
+
+
+@transaction.atomic
+def grant_platform_access(email, *, is_superuser: bool = False):
+    """Give ``email`` platform access, creating the account if it is new.
+
+    New accounts get an unusable password — they set one through the password
+    reset flow — and, being staff, must enrol a second factor before they can
+    sign in at all.
+    """
+    email = email.lower()
+    user, created = User.objects.get_or_create(email=email, defaults={"is_active": True})
+    if created:
+        user.set_unusable_password()
+
+    user.is_staff = True
+    user.is_superuser = is_superuser
+    user.save()
+    return user
diff --git a/controlpanel/services/statistics.py b/controlpanel/services/statistics.py
new file mode 100644
index 0000000..8fc84db
--- /dev/null
+++ b/controlpanel/services/statistics.py
@@ -0,0 +1,475 @@
+"""Platform and per-club statistics.
+
+``club_statistics`` returns a list of stat *groups*, so growing the model later
+means adding an entry here and nothing else. ``clubs_with_totals`` annotates in
+a single query — the club list must not fan out into N+1.
+"""
+
+from collections import defaultdict
+from datetime import timedelta
+from decimal import Decimal
+
+from allauth.mfa.models import Authenticator
+from dateutil.relativedelta import relativedelta
+from django.contrib.auth import get_user_model
+from django.db.models import Count, DateField, DecimalField, Exists, F, IntegerField, OuterRef, Q, Subquery, Sum, Value
+from django.db.models.functions import Coalesce, TruncMonth
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+from waffle import get_waffle_flag_model
+
+from authentication.middleware import ELEVATED_ROLES
+from billing.models import Due, DuePayment, Subscription
+from billing.services.dues import dues_in_grace, dues_overdue, subscriptions_due_for_renewal
+from club.models import Club, ClubMembership, ClubRole, Season
+from events.models import Attendance, Event
+from members.models import Member
+from shop.models import Cart, Order
+from teams.models import StaffAssignment, Team, TeamMembership
+
+ZERO = Decimal("0.00")
+
+PAID_STATUSES = (Order.OrderStatus.PAID, Order.OrderStatus.DELIVERED)
+OWED_STATUSES = (Order.OrderStatus.PENDING, Order.OrderStatus.PARTIALLY_PAID)
+
+#: A club with nothing scheduled inside this window has stopped using the product.
+DORMANT_DAYS = 30
+MONTHS_OF_HISTORY = 12
+
+
+def clubs_with_totals(queryset=None):
+    """Clubs annotated with headline counts (one query, no N+1)."""
+    clubs = Club.objects.all() if queryset is None else queryset
+    return clubs.annotate(
+        member_count=Count("clubmemberships__member", distinct=True),
+        team_count=Count("teams", distinct=True),
+        event_count=Count("events", distinct=True),
+        admin_count=Count("clubroles", filter=Q(clubroles__role=ClubRole.Roles.ADMIN), distinct=True),
+    )
+
+
+def _subquery(queryset, expression, output_field):
+    """One aggregate, in its own subquery.
+
+    Deliberately not a pile of annotate(Count(...), Sum(...)) on one queryset: aggregates
+    that span *different* joins multiply each other's rows, so a club's outstanding total
+    would come back doubled for every membership it happens to have. Subqueries each stand
+    alone, so nothing can inflate anything else.
+    """
+    return Coalesce(Subquery(queryset.filter(club=OuterRef("pk")).values("club").annotate(value=expression).values("value"), output_field=output_field), Value(0), output_field=output_field)
+
+
+def clubs_with_health(queryset=None, today=None, now=None):
+    """Clubs annotated with the health of each — for the dashboard table, in one query."""
+    today = today or timezone.localdate()
+    now = now or timezone.now()
+    clubs = Club.objects.active() if queryset is None else queryset
+
+    in_season = Q(season__start_date__lte=today, season__end_date__gte=today)
+    # A period the club is covered for, most recent first — paid or waived, both settled.
+    _covered = Due.objects.filter(club=OuterRef("pk"), status__in=(Due.Status.PAID, Due.Status.WAIVED)).order_by("-period_end")
+    managed_this_season = Q(
+        staff_assignments__season__start_date__lte=today,
+        staff_assignments__season__end_date__gte=today,
+        staff_assignments__position__management_position=True,
+    )
+
+    return (
+        clubs.annotate(
+            has_season=Exists(Season.objects.filter(club=OuterRef("pk"), start_date__lte=today, end_date__gte=today)),
+            active_members=_subquery(ClubMembership.objects.filter(in_season, status=ClubMembership.StatusChoices.ACTIVE), Count("pk"), IntegerField()),
+            unpaid_members=_subquery(ClubMembership.objects.filter(in_season, fee_status=ClubMembership.FeeStatus.UNPAID), Count("pk"), IntegerField()),
+            outstanding=_subquery(Order.objects.filter(status__in=OWED_STATUSES), Sum("total"), DecimalField(max_digits=10, decimal_places=2)),
+            upcoming_events=_subquery(Event.objects.filter(start__gte=now, start__lte=now + timedelta(days=DORMANT_DAYS)), Count("pk"), IntegerField()),
+            team_count=_subquery(Team.objects.all(), Count("pk"), IntegerField()),
+            teams_managed=_subquery(Team.objects.filter(managed_this_season), Count("pk", distinct=True), IntegerField()),
+            admin_count=_subquery(ClubRole.objects.filter(role=ClubRole.Roles.ADMIN), Count("pk"), IntegerField()),
+            tier_name=Subquery(Subscription.objects.filter(club=OuterRef("pk")).values("tier__name")[:1]),
+            dues_owed=_subquery(Due.objects.filter(status__in=Due.OWING), Sum(F("amount") - F("amount_paid")), DecimalField(max_digits=10, decimal_places=2)),
+            dues_grace_until=Subquery(Due.objects.filter(club=OuterRef("pk"), status__in=Due.OWING).order_by("grace_until").values("grace_until")[:1]),
+            dues_period_end=Subquery(Due.objects.filter(club=OuterRef("pk"), status__in=Due.OWING).order_by("period_end").values("period_end")[:1]),
+            # How far the club is covered: the furthest-out period that is settled. PAID and
+            # WAIVED both mean nothing is owed for that period, and its end is the day grace
+            # would start if nothing renews — so both count. `covered_status` is read from the
+            # same top row, so the table can badge "paid" vs "waived". Null when the club owes
+            # or was never billed.
+            covered_until=Subquery(_covered.values("period_end")[:1], output_field=DateField()),
+            covered_status=Subquery(_covered.values("status")[:1]),
+        )
+        .annotate(teams_without_coach=F("team_count") - F("teams_managed"))
+        .order_by("name")
+    )
+
+
+def platform_totals():
+    return {
+        "clubs": Club.objects.active().count(),
+        "archived_clubs": Club.objects.archived().count(),
+        "members": Member.objects.count(),
+        "admins": ClubRole.objects.filter(role=ClubRole.Roles.ADMIN).count(),
+    }
+
+
+def clubs_without_a_season(today=None):
+    """Clubs with no season covering today.
+
+    Not cosmetic: seasons scope memberships, rosters and events, so a club without
+    one cannot take a signup or schedule a match. It fails silently — nothing errors,
+    the club is simply inert — which is exactly why it belongs on a dashboard.
+    """
+    today = today or timezone.localdate()
+    return Club.objects.active().exclude(seasons__start_date__lte=today, seasons__end_date__gte=today)
+
+
+def dormant_clubs(days=DORMANT_DAYS):
+    """Active clubs with nothing on the calendar in the next ``days``. Churn signal."""
+    now = timezone.now()
+    return Club.objects.active().exclude(events__start__gte=now, events__start__lte=now + timedelta(days=days))
+
+
+def admins_pending_mfa():
+    """Privileged users who have not enrolled a second factor.
+
+    They are locked out until they do (RequireMFAMiddleware redirects them to the
+    enrolment page), so this is a support queue rather than a statistic. The rule is
+    the middleware's own: platform staff, plus anyone holding an elevated ClubRole.
+    """
+    User = get_user_model()
+    elevated = User.objects.filter(Q(is_staff=True) | Q(is_superuser=True) | Q(member__roles__role__in=ELEVATED_ROLES))
+
+    return elevated.exclude(pk__in=Authenticator.objects.values("user")).distinct()
+
+
+def onboarding_funnel():
+    """How far each active club got: created → has members → has a team → has events.
+
+    Separates working clubs from empty shells someone created and walked away from,
+    and shows which step people stall on.
+    """
+    clubs = clubs_with_totals(Club.objects.active())
+    total = len(clubs)
+
+    return [
+        {"label": _("Clubs"), "count": total, "icon": "building-2"},
+        {"label": _("With members"), "count": sum(1 for club in clubs if club.member_count), "icon": "users"},
+        {"label": _("With a team"), "count": sum(1 for club in clubs if club.team_count), "icon": "trophy"},
+        {"label": _("With events"), "count": sum(1 for club in clubs if club.event_count), "icon": "calendar-days"},
+    ]
+
+
+def flags_for_club(club):
+    """Every flag, annotated with whether it is on for this club and why."""
+    enabled_ids = set(club.flags.values_list("pk", flat=True))
+    return [
+        {
+            "flag": flag,
+            "enabled": flag.pk in enabled_ids,
+            # `everyone` overrides club targeting, so the per-club toggle is moot.
+            "overridden": flag.everyone is not None,
+        }
+        for flag in get_waffle_flag_model().objects.order_by("name")
+    ]
+
+
+def flag_adoption():
+    """Clubs per feature flag. `everyone` overrides club targeting, so a flag set that
+    way is on (or off) everywhere and its club count says nothing — hence `overridden`."""
+    Flag = get_waffle_flag_model()
+
+    return [{"name": flag.name, "clubs": flag.clubs.count(), "everyone": flag.everyone, "overridden": flag.everyone is not None} for flag in Flag.objects.annotate(club_total=Count("clubs")).order_by("name")]
+
+
+def platform_attention():
+    """The numbers that are supposed to be zero. A dashboard of healthy counts is a
+    dashboard nobody opens."""
+    members = Member.objects.count()
+
+    return {
+        "clubs_without_season": clubs_without_a_season().count(),
+        "dormant_clubs": dormant_clubs().count(),
+        "admins_pending_mfa": admins_pending_mfa().count(),
+        "outstanding": _money(Order.objects.filter(status__in=OWED_STATUSES)),
+        "members_without_login": Member.objects.filter(user__isnull=True).count(),
+        "members": members,
+        # Platform billing: what the clubs owe US. Distinct from `outstanding`, which is
+        # what members owe their clubs — that money is never ours.
+        "dues_owed": _dues_owed(),
+        "dues_in_grace": dues_in_grace().count(),
+        "dues_overdue": dues_overdue().count(),
+        "clubs_unbilled": Club.objects.active().filter(subscription__isnull=True).count(),
+        # Normally ~0: the renewal job keeps it there. A number that sits here means cron is
+        # dead, and a club is about to use the platform for free — silently, because nothing is
+        # owed, so no other number on this page would go red.
+        "renewals_pending": len(subscriptions_due_for_renewal()),
+    }
+
+
+def _dues_owed():
+    """What clubs owe the platform right now."""
+    owed = Due.objects.filter(status__in=Due.OWING).aggregate(total=Sum(F("amount") - F("amount_paid")))["total"]
+
+    return owed or ZERO
+
+
+def _monthly(queryset, field, value, months=MONTHS_OF_HISTORY):
+    """A dense month-by-month series — zero-filled, because a chart that silently skips
+    empty months draws a smooth line over a month where nothing happened."""
+    start = (timezone.now() - relativedelta(months=months)).replace(day=1, hour=0, minute=0, second=0, microsecond=0)
+
+    rows = queryset.filter(**{f"{field}__gte": start}).annotate(month=TruncMonth(field)).values("month").annotate(value=value).order_by("month")
+    found = {row["month"].strftime("%Y-%m"): row["value"] or 0 for row in rows if row["month"]}
+
+    series, cursor = [], start
+    while cursor <= timezone.now():
+        key = cursor.strftime("%Y-%m")
+        series.append({"month": cursor.strftime("%b %Y"), "value": float(found.get(key, 0))})
+        cursor = (cursor + timedelta(days=32)).replace(day=1)
+
+    return series
+
+
+def platform_charts():
+    return {
+        "signups": signup_split(),
+        # Two different pots of money: `dues` is platform income (clubs paying us), while
+        # `club_revenue` is members paying their clubs — never ours, and labelling it
+        # "revenue" on our dashboard would be a lie.
+        "dues": _monthly(DuePayment.objects.all(), "paid_at", Sum("amount")),
+        "club_revenue": _monthly(Order.objects.filter(status__in=PAID_STATUSES), "created", Sum("total")),
+    }
+
+
+def _money(queryset):
+    return queryset.aggregate(total=Sum("total"))["total"] or ZERO
+
+
+def previous_season(club, season):
+    """The season immediately before ``season``. Seasons are ordered by name (which is
+    derived from the years), so go by the date instead — a club may skip a year."""
+    if season is None:
+        return None
+
+    return Season.objects.filter(club=club, end_date__lt=season.start_date).order_by("-end_date").first()
+
+
+def renewal_rate(club, season):
+    """Share of last season's active members who signed up again.
+
+    The single best health signal a club has, and it is exactly computable here because
+    memberships are season-scoped. Returns None when there is no season to compare
+    against — a first-season club has not failed to renew anyone, and rendering that as
+    0% would libel it.
+    """
+    previous = previous_season(club, season)
+    if previous is None:
+        return None
+
+    was_active = ClubMembership.objects.filter(club=club, season=previous, status=ClubMembership.StatusChoices.ACTIVE)
+    total = was_active.count()
+    if not total:
+        return None
+
+    returned = ClubMembership.objects.filter(club=club, season=season, member__in=was_active.values("member")).count()
+
+    return round(100 * returned / total)
+
+
+def new_members(club, season):
+    """Members whose first-ever season at this club is ``season``.
+
+    Keyed on "has no membership in an earlier season", not on "signed up recently" — a
+    member who lapsed for a year and came back is a renewal, not a new member, and
+    counting them as new would flatter every recovery into growth.
+    """
+    if season is None:
+        return Member.objects.none()
+
+    seen_before = ClubMembership.objects.filter(club=club, season__start_date__lt=season.start_date).values("member")
+
+    return Member.objects.filter(member_of__club=club, member_of__season=season).exclude(pk__in=seen_before).distinct()
+
+
+def signup_split(club=None, months=MONTHS_OF_HISTORY):
+    """Signups per month, split into first-timers and returners. ``club=None`` is platform-wide.
+
+    "First" is keyed on (club, member), never on the member alone — the same person can be
+    new at one club while renewing at another, and collapsing that would mark their second
+    club's very first signup as a renewal.
+
+    Each member's earliest season is resolved once up front rather than per row: the same
+    question asked inside a loop is one query per membership.
+    """
+    start = (timezone.now() - relativedelta(months=months)).replace(day=1, hour=0, minute=0, second=0, microsecond=0)
+
+    memberships = ClubMembership.objects.all() if club is None else ClubMembership.objects.filter(club=club)
+
+    first_season = {}
+    for club_id, member_id, season_start in memberships.values_list("club_id", "member_id", "season__start_date"):
+        key = (club_id, member_id)
+        if key not in first_season or season_start < first_season[key]:
+            first_season[key] = season_start
+
+    counts = defaultdict(lambda: {"new": 0, "returning": 0})
+    for club_id, member_id, season_start, signed_up_at in memberships.filter(signed_up_at__isnull=False, signed_up_at__gte=start).values_list("club_id", "member_id", "season__start_date", "signed_up_at"):
+        kind = "new" if season_start == first_season[(club_id, member_id)] else "returning"
+        counts[signed_up_at.strftime("%Y-%m")][kind] += 1
+
+    series, cursor = [], start
+    while cursor <= timezone.now():
+        month = counts[cursor.strftime("%Y-%m")]
+        series.append({"month": cursor.strftime("%b %Y"), "new": month["new"], "returning": month["returning"]})
+        cursor = (cursor + timedelta(days=32)).replace(day=1)
+
+    return series
+
+
+def teams_without_a_manager(club, season):
+    """Teams with nobody in a management position this season.
+
+    A defect in the club's own setup, not a statistic: without a coach or manager the
+    access service grants nobody authority over that team, so nobody can pick the squad.
+    """
+    if season is None:
+        return Team.objects.none()
+
+    return Team.objects.filter(club=club).exclude(staff_assignments__season=season, staff_assignments__position__management_position=True)
+
+
+def unrostered_members(club, season):
+    """Active members who are on no team this season — people who paid and play nowhere."""
+    if season is None:
+        return Member.objects.none()
+
+    rostered = TeamMembership.objects.filter(team__club=club, season=season).values("member")
+
+    return Member.objects.filter(member_of__club=club, member_of__season=season, member_of__status=ClubMembership.StatusChoices.ACTIVE).exclude(pk__in=rostered).distinct()
+
+
+def fee_aging(club):
+    """Unpaid orders bucketed by age. "€2,400 overdue past 60 days" drives a phone call;
+    "€2,400 outstanding" does not."""
+    now = timezone.now()
+    owed = Order.objects.filter(club=club, status__in=OWED_STATUSES)
+
+    buckets = []
+    for label, older_than, newer_than in ((_("0-30 days"), 0, 30), (_("30-60 days"), 30, 60), (_("60+ days"), 60, None)):
+        rows = owed.filter(created__lte=now - timedelta(days=older_than))
+        if newer_than is not None:
+            rows = rows.filter(created__gt=now - timedelta(days=newer_than))
+        buckets.append({"label": label, "total": _money(rows), "count": rows.count(), "overdue": newer_than is None})
+
+    return buckets
+
+
+def attendance_rates(club, season):
+    """Turnout, and how many never answered.
+
+    The no-response share is the leading indicator: it measures whether members are using
+    the app at all, which every other number here depends on.
+    """
+    if season is None:
+        return {"turnout": None, "no_response": None, "responses": 0}
+
+    counts = Attendance.objects.filter(event__club=club, event__season=season, event__start__lt=timezone.now()).aggregate(
+        present=Count("id", filter=Q(status=Attendance.AttendanceStatus.PRESENT)),
+        absent=Count("id", filter=Q(status=Attendance.AttendanceStatus.ABSENT)),
+        silent=Count("id", filter=Q(status=Attendance.AttendanceStatus.NO_RESPONSE)),
+        total=Count("id"),
+    )
+
+    answered = counts["present"] + counts["absent"]
+
+    return {
+        "turnout": round(100 * counts["present"] / answered) if answered else None,
+        "no_response": round(100 * counts["silent"] / counts["total"]) if counts["total"] else None,
+        "responses": counts["total"],
+    }
+
+
+def club_attention(club):
+    """A club's own numbers that are supposed to be zero."""
+    season = Season.covering(club, timezone.localdate())
+    memberships = ClubMembership.objects.filter(club=club)
+
+    return {
+        "season": season,
+        "no_season": season is None,
+        "outstanding": _money(Order.objects.filter(club=club, status__in=OWED_STATUSES)),
+        "aging": fee_aging(club),
+        "unpaid_members": memberships.filter(season=season, fee_status=ClubMembership.FeeStatus.UNPAID).count() if season else 0,
+        "pending_approvals": memberships.filter(status=ClubMembership.StatusChoices.PENDING).count(),
+        "teams_without_manager": teams_without_a_manager(club, season).count(),
+        "unrostered": unrostered_members(club, season).count(),
+        "new_members": new_members(club, season).count(),
+        "renewal_rate": renewal_rate(club, season),
+        "attendance": attendance_rates(club, season),
+    }
+
+
+def club_charts(club):
+    season = Season.covering(club, timezone.localdate())
+    memberships = ClubMembership.objects.filter(club=club, season=season) if season else ClubMembership.objects.none()
+
+    return {
+        "signups": signup_split(club),
+        # Fee status this season, in the order a treasurer cares about.
+        "fees": [
+            {"label": label, "value": memberships.filter(fee_status=status).count()}
+            for status, label in (
+                (ClubMembership.FeeStatus.PAID, _("Paid")),
+                (ClubMembership.FeeStatus.PARTIALLY_PAID, _("Partial")),
+                (ClubMembership.FeeStatus.UNPAID, _("Unpaid")),
+                (ClubMembership.FeeStatus.WAIVED, _("Waived")),
+            )
+        ],
+    }
+
+
+def club_statistics(club):
+    """Stat groups for one club. Add new groups here as the domain grows."""
+    season = Season.covering(club, timezone.localdate())
+    now = timezone.now()
+
+    memberships = ClubMembership.objects.filter(club=club)
+    events = Event.objects.filter(club=club)
+    orders = Order.objects.filter(club=club)
+
+    return [
+        {
+            "title": _("Members"),
+            "icon": "users",
+            "stats": [
+                (_("Members"), memberships.values("member").distinct().count()),
+                (_("Active this season"), memberships.filter(season=season, status=ClubMembership.StatusChoices.ACTIVE).count() if season else 0),
+                (_("Pending"), memberships.filter(status=ClubMembership.StatusChoices.PENDING).count()),
+                (_("Lapsed"), memberships.filter(status=ClubMembership.StatusChoices.LAPSED).count()),
+            ],
+        },
+        {
+            "title": _("Teams & staff"),
+            "icon": "shield",
+            "stats": [
+                (_("Teams"), Team.objects.filter(club=club).count()),
+                (_("Players this season"), TeamMembership.objects.filter(team__club=club, season=season).count() if season else 0),
+                (_("Staff this season"), StaffAssignment.objects.filter(team__club=club, season=season).count() if season else 0),
+            ],
+        },
+        {
+            "title": _("Events"),
+            "icon": "calendar-days",
+            "stats": [
+                (_("Upcoming"), events.filter(start__gte=now).count()),
+                (_("This season"), events.filter(season=season).count() if season else 0),
+            ],
+        },
+        {
+            "title": _("Shop"),
+            "icon": "shopping-cart",
+            "stats": [
+                (_("Orders"), orders.count()),
+                (_("Revenue"), _money(orders.filter(status__in=PAID_STATUSES))),
+                (_("Outstanding"), _money(orders.filter(status__in=OWED_STATUSES))),
+                (_("Open carts"), Cart.objects.filter(club=club, status=Cart.CartStatus.OPEN).count()),
+            ],
+        },
+    ]
diff --git a/controlpanel/templates/controlpanel/_club_admins_card.html b/controlpanel/templates/controlpanel/_club_admins_card.html
new file mode 100644
index 0000000..d88fa87
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_club_admins_card.html
@@ -0,0 +1,49 @@
+{% load lucide ui %}
+
+{% comment %}
+    Club-scoped admins, and the modals to add one / confirm removing one. Included with
+    `club`, `admins`, `admin_form` already in context.
+{% endcomment %}
+<div class="card bg-base-100 shadow">
+    <div class="card-body">
+        <div class="flex items-center justify-between">
+            <h2 class="card-title text-base">{% lucide "shield-user" size=18 %} Club admins</h2>
+            <button class="btn btn-primary btn-sm gap-2" type="button" onclick="document.getElementById('club_admin_add_modal').showModal()">{% lucide "user-plus" size=16 %} Add admin</button>
+        </div>
+        <div class="overflow-x-auto">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>Name</th>
+                        <th>Email</th>
+                        <th></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for role in admins %}
+                        <tr>
+                            <td>{{ role.member }}</td>
+                            <td>{{ role.member.user.email|default:"—" }}</td>
+                            <td class="text-right">
+                                <button class="btn btn-error btn-outline btn-sm gap-1" type="button" onclick="document.getElementById('{{ role.pk|dom_id:"admin_remove_modal" }}').showModal()">{% lucide "trash-2" size=14 %} Remove</button>
+                            </td>
+                        </tr>
+                    {% empty %}
+                        <tr>
+                            <td colspan="3" class="text-center opacity-60">No admins yet.</td>
+                        </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+
+{% url 'controlpanel:club_admin_add' club.pk as club_admin_add_url %}
+{% include "controlpanel/_modal_form.html" with modal_id="club_admin_add_modal" title="Add admin" form=admin_form action_url=club_admin_add_url submit_label="Grant admin" submit_icon="user-plus" blurb="A club admin can manage everything in this club. They will be required to set up two-factor authentication before they can sign in." %}
+
+{% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+{% for role in admins %}
+    {% url 'controlpanel:club_admin_remove' club.pk role.pk as admin_remove_url %}
+    {% include "controlpanel/_confirm_modal.html" with modal_id=role.pk|dom_id:"admin_remove_modal" title="Remove admin" body="Remove "|add:role.member.get_full_name|add:" as an admin of this club? They keep their membership — only admin rights are revoked." action_url=admin_remove_url submit_label="Remove" %}
+{% endfor %}
diff --git a/controlpanel/templates/controlpanel/_club_billing_card.html b/controlpanel/templates/controlpanel/_club_billing_card.html
new file mode 100644
index 0000000..5fcbfe2
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_club_billing_card.html
@@ -0,0 +1,138 @@
+{% load lucide ui %}
+
+{% comment %}
+    What the platform bills this club: plan, periods, and the modals for changing plan,
+    opening a period, and recording a payment. Included with `club`, `subscription`,
+    `dues`, `today`, `subscription_form`, `open_period_form`, `open_period_blurb` already
+    in context.
+{% endcomment %}
+<div class="card mb-6 bg-base-100 shadow">
+    <div class="card-body">
+        <div class="flex flex-wrap items-center justify-between gap-2">
+            <h2 class="card-title text-base">{% lucide "receipt-euro" size=18 %} Billing</h2>
+            <div class="flex flex-wrap gap-2">
+                <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('subscription_modal').showModal()">
+                    {% lucide "layers" size=14 %} {% if subscription %}Change plan{% else %}Start billing{% endif %}
+                </button>
+                {% if not subscription %}
+                    <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('trial_modal').showModal()">
+                        {% lucide "hourglass" size=14 %} Start trial
+                    </button>
+                {% endif %}
+                {% if subscription %}
+                    <button class="btn btn-primary btn-sm gap-2" type="button" onclick="document.getElementById('open_period_modal').showModal()">
+                        {% lucide "calendar-plus" size=14 %} {% if club.is_archived %}Reactivate{% else %}Open period{% endif %}
+                    </button>
+                {% endif %}
+            </div>
+        </div>
+
+        {% if not subscription %}
+            <p class="text-sm opacity-70">This club is not billed for anything. Put it on a tier to start.</p>
+        {% else %}
+            <p class="text-sm opacity-70">
+                On plan <strong>{{ subscription.tier.name }}</strong>.
+                {% if subscription.trial_ends_at %}
+                    <span class="badge badge-info badge-sm gap-1">{% lucide "hourglass" size=12 %} Trial</span>
+                    On trial until {{ subscription.trial_ends_at|date:"j M Y" }}, then switches to <strong>{{ subscription.post_trial_tier.name }}</strong>.
+                {% endif %}
+                {% if subscription.auto_renew %}
+                    Renews automatically 30 days before the period ends.
+                {% else %}
+                    <span class="badge badge-warning badge-sm">Auto-renew off</span> — you must open each period by hand, or this club uses the platform for free.
+                {% endif %}
+                {% if subscription.auto_archive %}
+                    Archived automatically when a period goes unpaid past its grace period.
+                {% else %}
+                    <span class="badge badge-warning badge-sm">Auto-archive off</span> — it will never be archived for non-payment.
+                {% endif %}
+            </p>
+
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>Period</th>
+                            <th class="text-right">Billed</th>
+                            <th class="text-right">Paid</th>
+                            <th class="text-right">Status</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for due in dues %}
+                            <tr>
+                                <td>
+                                    {{ due.period_start|date:"j M Y" }} — {{ due.period_end|date:"j M Y" }}
+                                    <div class="text-xs opacity-60">{{ due.tier.name }} · {{ due.invoice.number }} · grace to {{ due.grace_until|date:"j M Y" }}</div>
+                                </td>
+                                <td class="text-right tabular-nums">€{{ due.amount|floatformat:2 }}</td>
+                                <td class="text-right tabular-nums">€{{ due.amount_paid|floatformat:2 }}</td>
+                                <td class="text-right">
+                                    {% if due.status == "paid" %}
+                                        <span class="badge badge-success gap-1">{% lucide "check" size=12 %} Paid</span>
+                                    {% elif due.status == "waived" %}
+                                        <span class="badge badge-outline gap-1">{% lucide "check" size=12 %} Waived</span>
+                                    {% elif due.grace_until < today %}
+                                        <span class="badge badge-error gap-1">{% lucide "triangle-alert" size=12 %} Overdue</span>
+                                    {% elif due.period_end < today %}
+                                        <span class="badge badge-warning gap-1">{% lucide "hourglass" size=12 %} In grace</span>
+                                    {% else %}
+                                        <span class="badge badge-outline">{{ due.get_status_display }}</span>
+                                    {% endif %}
+                                </td>
+                                <td class="text-right flex flex-row gap-2 justify-end">
+                                    {% if due.is_owing %}
+                                        <button class="btn btn-primary btn-outline btn-sm gap-1" type="button" onclick="document.getElementById('{{ due.pk|dom_id:"due_pay_modal" }}').showModal()">{% lucide "banknote" size=14 %} Add payment</button>
+                                        {% if not due.payments.all %}
+                                            <form class="inline" method="post" action="{% url 'controlpanel:due_waive' due.pk %}">
+                                                {% csrf_token %}
+                                                <button class="btn btn-outline btn-sm gap-1" type="submit">{% lucide "ban" size=14 %} Waive payment</button>
+                                            </form>
+                                        {% endif %}
+                                    {% endif %}
+                                    <a class="btn btn-accent btn-outline btn-sm gap-1" href="{% url 'controlpanel:due_invoice' due.pk %}">{% lucide "file-down" size=14 %} Download invoice</a>
+                                </td>
+                            </tr>
+                            {% for payment in due.payments.all %}
+                                <tr class="text-xs opacity-70">
+                                    <td colspan="2" class="pl-8">
+                                        {% lucide "corner-down-right" size=12 %}
+                                        {{ payment.paid_at|date:"j M Y" }} · {{ payment.get_method_display }}{% if payment.reference %} · {{ payment.reference }}{% endif %}
+                                    </td>
+                                    <td class="text-right tabular-nums">€{{ payment.amount|floatformat:2 }}</td>
+                                    <td colspan="2"></td>
+                                </tr>
+                            {% endfor %}
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">No periods billed yet.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+
+            {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+            {% for due in dues %}
+                {% if due.is_owing %}
+                    {% url 'controlpanel:due_pay' due.pk as due_pay_url %}
+                    {% include "controlpanel/_modal_form.html" with modal_id=due.pk|dom_id:"due_pay_modal" title="Record payment" form=due.payment_form action_url=due_pay_url submit_label="Record payment" submit_icon="banknote" %}
+                {% endif %}
+            {% endfor %}
+        {% endif %}
+    </div>
+</div>
+
+{% url 'controlpanel:club_subscribe' club.pk as subscribe_url %}
+{% include "controlpanel/_modal_form.html" with modal_id="subscription_modal" title=subscription|yesno:"Change plan,Start billing" form=subscription_form action_url=subscribe_url submit_label="Save plan" submit_icon="layers" blurb="Changing tier does not re-bill: the current period keeps the amount it was issued at, and the new rate applies from the next one." %}
+
+{% if not subscription %}
+    {% url 'controlpanel:club_trial_start' club.pk as trial_start_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="trial_modal" title="Start trial" form=trial_form action_url=trial_start_url submit_label="Start trial" submit_icon="hourglass" blurb="The trial period is billed like any other, on the trial tier you pick. It switches to the plan you pick here automatically the next time a period is opened after it ends -- no follow-up needed." %}
+{% endif %}
+
+{% if subscription %}
+    {% url 'controlpanel:club_open_period' club.pk as open_period_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="open_period_modal" title=club.is_archived|yesno:"Reactivate,Open period" form=open_period_form action_url=open_period_url submit_label="Open period" submit_icon="calendar-plus" blurb=open_period_blurb %}
+{% endif %}
diff --git a/controlpanel/templates/controlpanel/_club_features_card.html b/controlpanel/templates/controlpanel/_club_features_card.html
new file mode 100644
index 0000000..e335918
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_club_features_card.html
@@ -0,0 +1,45 @@
+{% load lucide %}
+
+{% comment %}
+    Which feature flags apply to this club. Included with `club`, `flags` (from
+    `flags_for_club`) already in context.
+{% endcomment %}
+<div class="card mb-6 bg-base-100 shadow">
+    <div class="card-body">
+        <div class="flex items-center justify-between">
+            <h2 class="card-title text-base">{% lucide "toggle-right" size=18 %} Features</h2>
+            <a class="btn btn-outline btn-sm gap-2" href="{% url 'controlpanel:features' %}">{% lucide "wrench" size=14 %} Manage features</a>
+        </div>
+        <div class="overflow-x-auto">
+            <table class="table">
+                <tbody>
+                    {% for entry in flags %}
+                        <tr>
+                            <td class="font-mono font-medium">{{ entry.flag.name }}</td>
+                            <td class="opacity-70">{{ entry.flag.note|default:"—" }}</td>
+                            <td class="text-right">
+                                {% if entry.overridden %}
+                                    {# `everyone` overrides club targeting, so a per-club toggle would be a lie. #}
+                                    <span class="badge {% if entry.flag.everyone %}badge-success{% else %}badge-error{% endif %}">
+                                        {% if entry.flag.everyone %}On for all clubs{% else %}Off everywhere{% endif %}
+                                    </span>
+                                {% else %}
+                                    <form method="post" action="{% url 'controlpanel:club_feature_toggle' club.pk entry.flag.pk %}">
+                                        {% csrf_token %}
+                                        <button class="btn btn-sm gap-1 {% if entry.enabled %}btn-success{% else %}btn-ghost{% endif %}" type="submit">
+                                            {% if entry.enabled %}{% lucide "toggle-right" size=16 %} On{% else %}{% lucide "toggle-left" size=16 %} Off{% endif %}
+                                        </button>
+                                    </form>
+                                {% endif %}
+                            </td>
+                        </tr>
+                    {% empty %}
+                        <tr>
+                            <td class="text-center opacity-60">No features defined yet.</td>
+                        </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
diff --git a/controlpanel/templates/controlpanel/_club_health_table.html b/controlpanel/templates/controlpanel/_club_health_table.html
new file mode 100644
index 0000000..3613f14
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_club_health_table.html
@@ -0,0 +1,135 @@
+{% load lucide %}
+
+{% comment %}
+    The club table, shared by the dashboard and the clubs list so the two cannot drift apart.
+    Health, not vanity: a member total says nothing you can act on, while "no coach",
+    "nothing scheduled", "€ owed" and "no admins" each name something somebody has to go and
+    fix. Every column is annotated by clubs_with_health() in a single query.
+
+    Expects: clubs (from clubs_with_health), and optionally empty_message.
+{% endcomment %}
+<div class="overflow-x-auto">
+    <table class="table">
+        <thead>
+            <tr>
+                <th>Club</th>
+                <th></th>
+                <th class="text-right">Members</th>
+                <th class="text-right">Admins</th>
+                <th class="text-right">Teams</th>
+                <th class="text-right">Events</th>
+                <th class="text-right">Plan</th>
+                <th class="text-right">Dues</th>
+                <th class="text-right">Plan end</th>
+                <th></th>
+            </tr>
+        </thead>
+        <tbody>
+            {% for club in clubs %}
+                <tr>
+                    <td>
+                        <div class="flex flex-row items-center gap-4">
+                            <div>
+                                {% if club.logo %}
+                                    <img class="h-12 w-12 object-contain" src="{{ club.logo.url }}" alt="{{ club.name }}">
+                                {% else %}
+                                    <div class="avatar avatar-placeholder">
+                                        <div class="w-12 rounded-full bg-neutral text-neutral-content">
+                                            <span>{{ club.initials }}</span>
+                                        </div>
+                                    </div>
+                                {% endif %}
+                            </div>
+
+                            <div class="flex flex-col gap-1">
+                                <a class="link link-hover font-semibold tracking-wide" href="{% url "controlpanel:club_detail" club.pk %}">{{ club.name }}</a>
+                                <div class="text-xs opacity-60">{{ club.slug }}.rosterchief.app &middot; {{ club.get_sport_type_display }}</div>
+                            </div>
+                        </div>
+                    </td>
+
+                    <td>
+                        <div class="flex flex-row gap-2">
+                            {% if club.is_archived %}
+                                <span class="badge badge-warning">{% lucide "archive" size=14 %} archived</span>
+                            {% else %}
+                                {% if not club.has_season %}
+                                    <span class="badge badge-warning">{% lucide "calendar-x" size=14 %} no seasons</span>
+                                {% endif %}
+
+                                {% if not club.upcoming_events %}
+                                    <span class="badge badge-ghost badge-outline">{% lucide "moon-star" size=14 %}dormant</span>
+                                {% endif %}
+                            {% endif %}
+                        </div>
+                    </td>
+
+                    <td class="text-right tabular-nums">{{ club.active_members }}</td>
+                    <td class="text-right tabular-nums">
+                        <div class="flex flex-row gap-2 items-center justify-end">
+                            {% if not club.admin_count %}
+                                <span class="text-error">{% lucide "triangle-alert" size=16 %}</span>
+                            {% endif %}
+                            <span class="{% if not club.admin_count %}font-bold text-error{% endif %}">{{ club.admin_count }}</span>
+                        </div>
+                    </td>
+                    <td class="text-right tabular-nums">{{ club.team_count }}</td>
+                    <td class="text-right tabular-nums">{{ club.upcoming_events }}</td>
+
+                    <td class="text-right">
+                        {% if club.tier_name %}
+                            <span class="badge badge-accent">{{ club.tier_name|lower }}</span>
+                        {% else %}
+                            -
+                        {% endif %}
+                    </td>
+
+                    <td class="text-right">
+                        <div class="flex flex-row gap-2 items-center justify-end">
+                            {% if not club.dues_owed %}
+                                {% if club.tier_name %}
+                                    {% comment %}
+                                        Not owing and on a plan. covered_until is the settled period's end — the day
+                                        grace would start if nothing renews — shown on its own row under the badge,
+                                        for a paid period AND a waived one (both cover the club, they just differ in
+                                        how). No covered period at all (only cancelled dues, say) shows a dash.
+                                    {% endcomment %}
+                                    <div class="flex flex-col items-end gap-1">
+                                        {% if club.covered_status == "waived" %}
+                                            <span class="badge badge-ghost badge-outline">waived</span>
+                                        {% elif club.covered_until %}
+                                            <span class="badge badge-success">paid</span>
+                                        {% else %}
+                                            -
+                                        {% endif %}
+                                    </div>
+                                {% else %}
+                                    -
+                                {% endif %}
+                            {% else %}
+                                <span class="font-semibold">€{{ club.dues_owed|floatformat:2 }}</span>
+                                {% if club.dues_grace_until < today %}
+                                    <span class="badge badge-error">overdue</span>
+                                {% elif club.dues_period_end < today %}
+                                    <span class="badge badge-warning">grace</span>
+                                {% endif %}
+                            {% endif %}
+                        </div>
+                    </td>
+
+                    <td class="text-right">
+                        <span class="whitespace-nowrap">{{ club.covered_until|date:"j M Y"|default:"-" }}</span>
+                    </td>
+
+                    <td>
+                        <a class="btn btn-outline btn-sm gap-2" href="{% url "controlpanel:club_detail" club.pk %}">{% lucide "pencil" size=14 %} Edit</a>
+                    </td>
+                </tr>
+            {% empty %}
+                <tr>
+                    <td colspan="9" class="text-center opacity-60">{{ empty_message|default:"No clubs yet." }}</td>
+                </tr>
+            {% endfor %}
+        </tbody>
+    </table>
+</div>
diff --git a/controlpanel/templates/controlpanel/_club_home_location_card.html b/controlpanel/templates/controlpanel/_club_home_location_card.html
new file mode 100644
index 0000000..6e0a449
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_club_home_location_card.html
@@ -0,0 +1,39 @@
+{% load lucide %}
+
+{% comment %}
+    The club's home ground -- an events.Location row flagged is_home, so setting or
+    editing it here creates/updates the very same Location the club's own Teams >
+    Locations page shows, no separate sync step involved. Included with `club`,
+    `home_location`, `home_location_form` already in context.
+{% endcomment %}
+<div class="card mb-6 bg-base-100 shadow">
+    <div class="card-body">
+        <div class="flex items-center justify-between">
+            <h2 class="card-title text-base">{% lucide "map-pin" size=18 %} Home location</h2>
+            <button class="btn btn-primary btn-sm gap-2" type="button" onclick="document.getElementById('club_home_location_modal').showModal()">
+                {% if home_location %}
+                    {% lucide "pencil" size=16 %} Edit
+                {% else %}
+                    {% lucide "plus" size=16 %} Set home location
+                {% endif %}
+            </button>
+        </div>
+        {% if home_location %}
+            <dl class="divide-y divide-base-200">
+                <div class="flex items-center justify-between py-2">
+                    <dt class="text-sm opacity-70">Name</dt>
+                    <dd class="font-semibold">{{ home_location.name }}</dd>
+                </div>
+                <div class="flex items-center justify-between py-2">
+                    <dt class="text-sm opacity-70">Address</dt>
+                    <dd>{{ home_location.address }}, {{ home_location.zip_code }} {{ home_location.city }}, {{ home_location.country }}</dd>
+                </div>
+            </dl>
+        {% else %}
+            <p class="text-sm opacity-60">Not set yet. Once set, events at this location can be recognised as home games.</p>
+        {% endif %}
+    </div>
+</div>
+
+{% url 'controlpanel:club_home_location_set' club.pk as home_location_url %}
+{% include "controlpanel/_modal_form.html" with modal_id="club_home_location_modal" title="Home location" form=home_location_form action_url=home_location_url submit_label="Save" submit_icon="save" blurb="This creates or updates a Location for the club -- the same one that shows up on its own Teams > Locations page." %}
diff --git a/controlpanel/templates/controlpanel/_confirm_modal.html b/controlpanel/templates/controlpanel/_confirm_modal.html
new file mode 100644
index 0000000..3b89361
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_confirm_modal.html
@@ -0,0 +1,29 @@
+{% load i18n lucide %}
+
+{% comment %}
+    A daisyUI native <dialog> confirmation modal for a destructive POST action with no
+    fields of its own. Included with `modal_id`, `title`, `body`, `action_url`, and
+    optional `submit_label` (default "Confirm"), `submit_icon` (default "trash-2"). The
+    submit button sits outside the form tag (linked via the `form` attribute), same as
+    `_modal_form.html`, so it can share the `modal-action` row with the dialog-closing
+    Cancel button without nesting one <form> inside another.
+{% endcomment %}
+{% trans "Confirm" as default_submit_label %}
+<dialog id="{{ modal_id }}" class="modal">
+    <div class="modal-box">
+        <h3 class="text-lg font-bold">{{ title }}</h3>
+        <p class="py-2 text-sm opacity-70">{{ body }}</p>
+        <form method="post" action="{{ action_url }}" id="{{ modal_id }}-form">
+            {% csrf_token %}
+        </form>
+        <div class="modal-action">
+            <form method="dialog">
+                <button class="btn btn-outline gap-2">{% lucide "x" size=16 %} {% trans "Cancel" %}</button>
+            </form>
+            <button class="btn btn-error gap-2" type="submit" form="{{ modal_id }}-form">{% lucide submit_icon|default:"trash-2" size=16 %} {{ submit_label|default:default_submit_label }}</button>
+        </div>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+        <button>close</button>
+    </form>
+</dialog>
diff --git a/controlpanel/templates/controlpanel/_form_fields.html b/controlpanel/templates/controlpanel/_form_fields.html
new file mode 100644
index 0000000..75b4c70
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_form_fields.html
@@ -0,0 +1,17 @@
+{% load ui %}
+
+{% comment %}
+    The field loop every card-form and modal-form wrapper shares: label, daisyUI-styled
+    widget, help text, errors — with checkboxes laid out label-beside-input instead of
+    label-above. Included with `form`.
+{% endcomment %}
+{% for error in form.non_field_errors %}
+    <div class="alert alert-error my-2">
+        <span>{{ error }}</span>
+    </div>
+{% endfor %}
+{% for field in form %}
+    <div class="form-control my-3 w-full">
+        {% form_field field %}
+    </div>
+{% endfor %}
diff --git a/controlpanel/templates/controlpanel/_modal_form.html b/controlpanel/templates/controlpanel/_modal_form.html
new file mode 100644
index 0000000..9b545a1
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_modal_form.html
@@ -0,0 +1,30 @@
+{% load i18n lucide %}
+
+{% comment %}
+    A daisyUI native <dialog> modal wrapping a Django form that posts straight to
+    `action_url`. Included with `modal_id`, `title`, `form`, `action_url`, `submit_label`
+    and `submit_icon`, plus an optional `blurb`. The submit button sits outside the form
+    tag (linked via the `form` attribute) so it can share the `modal-action` row with the
+    dialog-closing Cancel button without nesting one <form> inside another. `enctype` is
+    always multipart -- harmless for a form with no file field, required for one that has.
+{% endcomment %}
+{% trans "Save" as default_submit_label %}
+<dialog id="{{ modal_id }}" class="modal">
+    <div class="modal-box">
+        <h3 class="text-lg font-bold">{{ title }}</h3>
+        {% if blurb %}<p class="py-2 text-sm opacity-70">{{ blurb }}</p>{% endif %}
+        <form method="post" action="{{ action_url }}" id="{{ modal_id }}-form" enctype="multipart/form-data">
+            {% csrf_token %}
+            {% include "controlpanel/_form_fields.html" %}
+        </form>
+        <div class="modal-action">
+            <form method="dialog">
+                <button class="btn btn-outline gap-2">{% lucide "x" size=16 %} {% trans "Cancel" %}</button>
+            </form>
+            <button class="btn btn-primary gap-2" type="submit" form="{{ modal_id }}-form">{% lucide submit_icon|default:"check" size=16 %} {{ submit_label|default:default_submit_label }}</button>
+        </div>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+        <button>close</button>
+    </form>
+</dialog>
diff --git a/controlpanel/templates/controlpanel/_nav_items.html b/controlpanel/templates/controlpanel/_nav_items.html
new file mode 100644
index 0000000..c3d9465
--- /dev/null
+++ b/controlpanel/templates/controlpanel/_nav_items.html
@@ -0,0 +1,37 @@
+{% load lucide %}
+
+{% comment %}
+    The panel's navigation, in one place: the sidebar renders it on a wide screen and the
+    collapsed menu renders it on a narrow one. Two copies of a link list is how a new section
+    ends up reachable on a desktop and invisible on a phone.
+
+    `menu-active` is daisyUI 5's active state; hover and focus come with `.menu` itself.
+{% endcomment %}
+<li>
+    <a class="{% if nav == 'dashboard' %}menu-active{% endif %}" href="{% url 'controlpanel:dashboard' %}">
+        {% lucide "layout-dashboard" size=16 %} Dashboard
+    </a>
+</li>
+<li>
+    <a class="{% if nav == 'clubs' %}menu-active{% endif %}" href="{% url 'controlpanel:club_list' %}">
+        {% lucide "building-2" size=16 %} Clubs
+    </a>
+</li>
+<li>
+    <a class="{% if nav == 'billing' %}menu-active{% endif %}" href="{% url 'controlpanel:billing' %}">
+        {% lucide "receipt-euro" size=16 %} Billing
+    </a>
+</li>
+<li>
+    <a class="{% if nav == 'features' %}menu-active{% endif %}" href="{% url 'controlpanel:features' %}">
+        {% lucide "toggle-right" size=16 %} Features
+    </a>
+</li>
+{% if user.is_superuser %}
+    {# Superusers only, exactly as the view is gated: a link staff cannot follow is a lie. #}
+    <li>
+        <a class="{% if nav == 'admins' %}menu-active{% endif %}" href="{% url 'controlpanel:admins' %}">
+            {% lucide "user-cog" size=16 %} Platform admins
+        </a>
+    </li>
+{% endif %}
diff --git a/controlpanel/templates/controlpanel/admins.html b/controlpanel/templates/controlpanel/admins.html
new file mode 100644
index 0000000..2d2d9ba
--- /dev/null
+++ b/controlpanel/templates/controlpanel/admins.html
@@ -0,0 +1,80 @@
+{% extends "controlpanel/base.html" %}
+{% load lucide ui %}
+
+{% block heading %}Platform admins{% endblock heading %}
+
+{% block subheading %}
+    <p class="text-sm opacity-70">Staff run the panel. Superusers additionally manage this list.</p>
+{% endblock subheading %}
+
+{% block actions %}
+    <button class="btn btn-primary gap-2" type="button" onclick="document.getElementById('admin_add_modal').showModal()">{% lucide "user-plus" size=16 %} Grant access</button>
+{% endblock actions %}
+
+{% block panel %}
+    {% url 'controlpanel:admin_add' as admin_add_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="admin_add_modal" title="Grant platform access" form=admin_form action_url=admin_add_url submit_label="Grant access" submit_icon="user-plus" blurb="Platform admins can manage every club. They must set up two-factor authentication before they can sign in." %}
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>User</th>
+                            <th>Staff</th>
+                            <th>Superuser</th>
+                            <th>Last login</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for admin in admins %}
+                            <tr>
+                                <td>
+                                    <div class="font-medium">{{ admin.email }}</div>
+                                    {% if admin.pk == user.pk %}
+                                        <div class="text-xs opacity-60">That's you</div>{% endif %}
+                                </td>
+                                <td>
+                                    <form method="post" action="{% url 'controlpanel:admin_update' admin.pk %}">
+                                        {% csrf_token %}
+                                        <input type="hidden" name="is_staff" value="{% if admin.is_staff %}0{% else %}1{% endif %}">
+                                        <input type="hidden" name="is_superuser" value="{% if admin.is_superuser %}1{% else %}0{% endif %}">
+                                        <button class="btn btn-sm gap-1 {% if admin.is_staff %}btn-success{% else %}btn-outline{% endif %}" type="submit">
+                                            {% if admin.is_staff %}{% lucide "user" size=14 %} Yes{% else %}{% lucide "x" size=14 %} No{% endif %}
+                                        </button>
+                                    </form>
+                                </td>
+                                <td>
+                                    <form method="post" action="{% url 'controlpanel:admin_update' admin.pk %}">
+                                        {% csrf_token %}
+                                        <input type="hidden" name="is_staff" value="{% if admin.is_staff %}1{% else %}0{% endif %}">
+                                        <input type="hidden" name="is_superuser" value="{% if admin.is_superuser %}0{% else %}1{% endif %}">
+                                        <button class="btn btn-sm gap-1 {% if admin.is_superuser %}btn-warning{% else %}btn-outline{% endif %}" type="submit">
+                                            {% if admin.is_superuser %}{% lucide "shield" size=14 %} Yes{% else %}{% lucide "x" size=14 %} No{% endif %}
+                                        </button>
+                                    </form>
+                                </td>
+                                <td class="opacity-70">{{ admin.last_login|date:"j M Y"|default:"Never" }}</td>
+                                <td class="text-right">
+                                    <button class="btn btn-error btn-outline btn-sm gap-1" type="button" onclick="document.getElementById('{{ admin.pk|dom_id:"admin_revoke_modal" }}').showModal()">{% lucide "user-minus" size=14 %} Revoke</button>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">No platform admins.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+
+            {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+            {% for admin in admins %}
+                {% url 'controlpanel:admin_revoke' admin.pk as admin_revoke_url %}
+                {% include "controlpanel/_confirm_modal.html" with modal_id=admin.pk|dom_id:"admin_revoke_modal" title="Revoke platform access" body="Revoke platform access for "|add:admin.email|add:"? They will no longer be able to reach the control panel." action_url=admin_revoke_url submit_label="Revoke" submit_icon="user-minus" %}
+            {% endfor %}
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/controlpanel/templates/controlpanel/base.html b/controlpanel/templates/controlpanel/base.html
new file mode 100644
index 0000000..b1e1133
--- /dev/null
+++ b/controlpanel/templates/controlpanel/base.html
@@ -0,0 +1,52 @@
+{% extends "_platform_base.html" %}
+{% load lucide %}
+
+{% block title %}
+    {% block panel_title %}Control panel{% endblock panel_title %} · RosterChief
+{% endblock title %}
+
+{% block menu %}
+    {% comment %}
+        Outside <main>, so it never scrolls with the content. Its own overflow-y-auto is for
+        the day the menu itself grows taller than the screen.
+    {% endcomment %}
+    <aside class="hidden w-64 shrink-0 overflow-y-auto border-r border-base-300 bg-base-100 lg:block">
+        <ul class="menu w-full gap-1 p-3 mt-4">
+            {% include "controlpanel/_nav_items.html" %}
+        </ul>
+    </aside>
+{% endblock menu %}
+
+{% block main %}
+    {% if maintenance_on %}
+        <div class="alert alert-error mb-6">
+            {% lucide "wrench" size=20 %}
+            <span>
+        <strong>The platform is currently closed for maintenance.</strong>
+        Clubs see a maintenance page and the scheduled jobs are standing down.
+    </span>
+            <a class="btn btn-sm gap-2 btn-error btn-soft" href="{% url 'controlpanel:features' %}">{% lucide "unlock" size=16 %} Reopen platform</a>
+        </div>
+    {% endif %}
+    <div class="mb-6 flex flex-wrap flex-row items-center justify-between gap-3">
+        {% block logo %}{% endblock logo %}
+
+        <div class="flex flex-col gap-2 grow">
+            <h1 class="text-3xl font-bold">
+                {% block heading %}Control panel{% endblock heading %}
+            </h1>
+            <span class="text-sm text-base-content/50">{% block subheading %}{% endblock subheading %}</span>
+        </div>
+
+        <div class="flex gap-2">
+            {% block actions %}{% endblock actions %}
+        </div>
+    </div>
+
+    {# Below `lg` the sidebar is hidden, so the same links appear here rather than nowhere. #}
+    <ul class="menu menu-horizontal mb-6 w-full gap-1 overflow-x-auto rounded-box bg-base-100 lg:hidden">
+        {% include "controlpanel/_nav_items.html" %}
+    </ul>
+
+    {% block panel %}{% endblock panel %}
+{% endblock main %}
diff --git a/controlpanel/templates/controlpanel/billing.html b/controlpanel/templates/controlpanel/billing.html
new file mode 100644
index 0000000..2487280
--- /dev/null
+++ b/controlpanel/templates/controlpanel/billing.html
@@ -0,0 +1,135 @@
+{% extends "controlpanel/base.html" %}
+{% load lucide ui %}
+
+{% block heading %}Billing{% endblock heading %}
+
+{% block actions %}
+    <button class="btn btn-primary gap-2" type="button" onclick="document.getElementById('tier_create_modal').showModal()">{% lucide "plus" size=16 %} New plan</button>
+{% endblock actions %}
+
+{% block panel %}
+    {% url 'controlpanel:tier_create' as tier_create_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="tier_create_modal" title="New plan" form=tier_form action_url=tier_create_url submit_label="Create plan" submit_icon="plus" %}
+
+    <div class="card mb-6 bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title text-base">{% lucide "layers" size=18 %} Plans</h2>
+            {% comment %}
+                Prices are dated, not edited. A rate change is a new row with a future
+                active_from; every period already opened keeps the amount it was billed at,
+                so raising the price cannot rewrite an invoice you have already sent.
+            {% endcomment %}
+            <p class="text-sm opacity-70">A rate change only takes effect as of a certain date. Periods already billed keep the amount they were issued at.</p>
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>Plan</th>
+                            <th class="text-right">Clubs</th>
+                            <th>Prices</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for tier in tiers %}
+                            <tr>
+                                <td>
+                                    <div class="font-medium">{{ tier.name }}</div>
+                                    {% if not tier.is_active %}<span class="badge badge-ghost badge-xs">Retired</span>{% endif %}
+                                    {% if tier.description %}
+                                        <div class="text-xs opacity-60">{{ tier.description }}</div>{% endif %}
+                                </td>
+                                <td class="text-right tabular-nums">{{ tier.club_count }}</td>
+                                <td>
+                                    {% for price in tier.prices.all %}
+                                        <div class="text-sm tabular-nums">
+                                            €{{ price.amount|floatformat:2 }}
+                                            <span class="opacity-60">from {{ price.active_from|date:"j M Y" }}</span>
+                                            {% if price.active_from > today %}<span class="badge badge-info badge-xs">Scheduled</span>{% endif %}
+                                        </div>
+                                    {% empty %}
+                                        <span class="badge badge-error badge-sm">No price — cannot be billed</span>
+                                    {% endfor %}
+                                </td>
+                                <td class="flex flex-row gap-2 justify-end">
+                                    <button class="btn btn-primary btn-sm btn-outline gap-1" type="button" onclick="document.getElementById('{{ tier.pk|dom_id:"tier_price_modal" }}').showModal()">{% lucide "euro" size=14 %} New price</button>
+                                    <button class="btn btn-outline btn-sm gap-1" type="button" onclick="document.getElementById('{{ tier.pk|dom_id:"tier_edit_modal" }}').showModal()">{% lucide "pencil" size=14 %} Edit</button>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="4" class="text-center opacity-60">No plans yet.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+    {% for tier in tiers %}
+        {% url 'controlpanel:tier_price_create' tier.pk as tier_price_url %}
+        {% include "controlpanel/_modal_form.html" with modal_id=tier.pk|dom_id:"tier_price_modal" title="New price — "|add:tier.name form=tier.price_form action_url=tier_price_url submit_label="Add price" submit_icon="euro" %}
+
+        {% url 'controlpanel:tier_update' tier.pk as tier_update_url %}
+        {% include "controlpanel/_modal_form.html" with modal_id=tier.pk|dom_id:"tier_edit_modal" title="Edit "|add:tier.name form=tier.edit_form action_url=tier_update_url submit_label="Save" submit_icon="check" %}
+    {% endfor %}
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title text-base">{% lucide "receipt-euro" size=18 %} Owed</h2>
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>Club</th>
+                            <th>Period</th>
+                            <th class="text-right">Owed</th>
+                            <th class="text-right">Status</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for due in owing %}
+                            <tr>
+                                <td>
+                                    <a class="link link-hover font-medium" href="{% url 'controlpanel:club_detail' due.club.pk %}">{{ due.club.name }}</a>
+                                    <div class="text-xs opacity-60">{{ due.tier.name }}</div>
+                                </td>
+                                <td class="text-sm">
+                                    {{ due.period_start|date:"j M Y" }} — {{ due.period_end|date:"j M Y" }}
+                                    <div class="text-xs opacity-60">Grace to {{ due.grace_until|date:"j M Y" }}</div>
+                                </td>
+                                <td class="text-right font-semibold tabular-nums">€{{ due.balance|floatformat:2 }}</td>
+                                <td class="text-right">
+                                    {% if due.grace_until < today %}
+                                        <span class="badge badge-error gap-1">{% lucide "triangle-alert" size=12 %} Overdue</span>
+                                    {% elif due.period_end < today %}
+                                        <span class="badge badge-warning gap-1">{% lucide "hourglass" size=12 %} In grace</span>
+                                    {% else %}
+                                        <span class="badge badge-outline">{{ due.get_status_display }}</span>
+                                    {% endif %}
+                                </td>
+                                <td class="text-right flex flex-row gap-2 justify-end">
+                                    <button class="btn btn-primary btn-sm btn-outline gap-1" type="button" onclick="document.getElementById('{{ due.pk|dom_id:"due_pay_modal" }}').showModal()">{% lucide "banknote" size=14 %} Record payment</button>
+                                    <a class="btn btn-accent btn-outline btn-sm gap-1" href="{% url 'controlpanel:due_invoice' due.pk %}">{% lucide "file-down" size=14 %} Download invoice</a>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">Nothing outstanding.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+    {% for due in owing %}
+        {% url 'controlpanel:due_pay' due.pk as due_pay_url %}
+        {% include "controlpanel/_modal_form.html" with modal_id=due.pk|dom_id:"due_pay_modal" title="Record payment — "|add:due.club.name form=due.payment_form action_url=due_pay_url submit_label="Record payment" submit_icon="banknote" %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/controlpanel/templates/controlpanel/club_detail.html b/controlpanel/templates/controlpanel/club_detail.html
new file mode 100644
index 0000000..384699d
--- /dev/null
+++ b/controlpanel/templates/controlpanel/club_detail.html
@@ -0,0 +1,268 @@
+{% extends "controlpanel/base.html" %}
+{% load static lucide %}
+
+{% block logo %}
+    {% if club.logo %}
+        {% comment %}
+            The ring is the club's own primary colour, same as on the club's own subdomain --
+            but the control panel never injects a page-wide --color-primary override (it must
+            not dress itself up as the club), so it's set here as a locally-scoped custom
+            property instead: it only reaches this element and its children, not the rest of
+            the panel's buttons and badges.
+        {% endcomment %}
+        <div class="avatar">
+            <div class="w-16 rounded-full bg-base-100 ring-2 ring-primary ring-offset-2 ring-offset-base-100" {% if club.primary_color %}style="--color-primary: {{ club.primary_color }};"{% endif %}>
+                <img class="club-logo object-contain" src="{{ club.logo.url }}" alt="{{ club.name }}">
+            </div>
+        </div>
+    {% else %}
+        <div class="avatar avatar-placeholder">
+            <div class="w-16 text-xl rounded-full bg-neutral text-neutral-content">
+                <span>{{ club.initials }}</span>
+            </div>
+        </div>
+    {% endif %}
+{% endblock logo %}
+
+{% block heading %}{{ club.name }}{% endblock heading %}
+
+{% block subheading %}
+    {{ club.slug }}.rosterchief.app &middot; {{ club.get_sport_type_display }}
+    {% if club.is_archived %}
+        <span class="badge badge-warning badge-sm ml-2">Archived</span>
+    {% endif %}
+{% endblock subheading %}
+
+{% block actions %}
+    <a class="btn btn-outline gap-2" href="{% url 'controlpanel:club_update' club.pk %}">{% lucide "pencil" size=16 %} Edit</a>
+    <a class="btn btn-primary gap-2" href="https://{{ club.slug }}.rosterchief.app">{% lucide "external-link" size=16 %} Open</a>
+    {% if club.is_archived %}
+        <form method="post" action="{% url 'controlpanel:club_restore' club.pk %}">
+            {% csrf_token %}
+            <button class="btn btn-success gap-2" type="submit">{% lucide "archive-restore" size=16 %} Restore</button>
+        </form>
+    {% else %}
+        <form method="post" action="{% url 'controlpanel:club_archive' club.pk %}">
+            {% csrf_token %}
+            <button class="btn btn-warning gap-2" type="submit">{% lucide "archive" size=16 %} Archive</button>
+        </form>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    {% if club.is_archived %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "alert-triangle" size=20 %}
+            <span>This club is archived: its subdomain no longer resolves. Nothing has been deleted — restore it to bring it back.</span>
+        </div>
+    {% endif %}
+    {% if attention.no_season %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "calendar-x" size=20 %}
+            <span>
+                No season covers today, so this club cannot take a signup or schedule a match. Nothing errors — it is simply inert.
+            </span>
+        </div>
+    {% endif %}
+
+    {% comment %}
+        The club's own numbers that should be zero. Teams without a manager is a defect in
+        the club's setup, not a statistic: with nobody in a management position the access
+        service grants no authority over that team, so nobody can pick the squad.
+    {% endcomment %}
+    <div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-6">
+        {% comment %}<div class="card bg-base-100 shadow {% if attention.outstanding %}border-l-4 border-error{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70">{% lucide "banknote" size=16 %} Outstanding</div>
+                <div class="text-3xl font-bold tabular-nums">€{{ attention.outstanding|floatformat:2 }}</div>
+                <div class="text-xs opacity-60">{{ attention.unpaid_members }} member{{ attention.unpaid_members|pluralize }} unpaid this season</div>
+            </div>
+        </div>{% endcomment %}
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.teams_without_manager %}border-error{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-x" size=16 %} Teams without coach</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.teams_without_manager }}</div>
+                <div class="text-xs opacity-60">Teams nobody can pick a squad for</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.unrostered %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-minus" size=16 %} Unrostered members</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.unrostered }}</div>
+                <div class="text-xs opacity-60">Active members on no team</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.pending_approvals %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "clock" size=16 %} Pending</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.pending_approvals }}</div>
+                <div class="text-xs opacity-60">Memberships awaiting approval</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-info">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "sparkles" size=16 %} New members</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.new_members }}</div>
+                {# First season at this club — someone returning after a year away is a renewal. #}
+                <div class="text-xs opacity-60">First season at this club</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.renewal_rate is None %}border-info{% elif attention.renewal_rate < 30 %}border-error{% elif attention.renewal_rate < 65 %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "repeat" size=16 %} Renewal rate</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">
+                    {% if attention.renewal_rate is None %}
+                        N/A
+                    {% else %}
+                        {{ attention.renewal_rate }}%
+                    {% endif %}
+                </div>
+                <div class="text-xs opacity-60">
+                    {% if attention.renewal_rate is None %}
+                        No previous season
+                    {% else %}
+                        <progress class="progress w-full {% if attention.renewal_rate < 30 %}progress-error{% elif attention.renewal_rate < 65 %}progress-warning{% else %}progress-success{% endif %}" value="{{ attention.renewal_rate }}"
+                                  max="100"></progress>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.attendance.turnout is None %}border-info{% elif attention.attendance.turnout < 30 %}border-error{% elif attention.attendance.turnout < 65 %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-check" size=16 %} Attendance rate</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">
+                    {% if attention.attendance.turnout is None %}
+                        N/A
+                    {% else %}
+                        {{ attention.attendance.turnout }}%
+                    {% endif %}
+                </div>
+                <div class="text-xs opacity-60">
+                    {% if attention.attendance.turnout is None %}
+                        No events this season
+                    {% else %}
+                        <progress class="progress w-full {% if attention.attendance.turnout < 30 %}progress-error{% elif attention.attendance.turnout < 65 %}progress-warning{% else %}progress-success{% endif %}"
+                                  value="{{ attention.attendance.turnout }}" max="100"></progress>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+    </div>
+
+
+    <div class="mb-6 grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "user-plus" size=18 %} Signups per month</h2>
+                <p class="text-sm opacity-70">New members against returning ones.</p>
+                <div class="h-56">
+                    <canvas id="signups-chart"></canvas>
+                </div>
+            </div>
+        </div>
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "wallet" size=18 %} Club fee status this season</h2>
+                <div class="h-56">
+                    <canvas id="fees-chart"></canvas>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="mb-6 grid gap-4 md:grid-cols-4">
+        {% for group in groups %}
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide group.icon size=18 %} {{ group.title }}</h2>
+                    <dl class="divide-y divide-base-200">
+                        {% for label, value in group.stats %}
+                            <div class="flex items-center justify-between py-2">
+                                <dt class="text-sm opacity-70">{{ label }}</dt>
+                                <dd class="font-semibold tabular-nums font-mono">{% if group.title == "Shop" and label == "Outstanding" or label == "Revenue" %}&euro;{% endif %}{{ value }}</dd>
+                            </div>
+                        {% endfor %}
+                    </dl>
+                </div>
+            </div>
+        {% endfor %}
+    </div>
+    {% include "controlpanel/_club_features_card.html" %}
+    {% include "controlpanel/_club_billing_card.html" %}
+    {% include "controlpanel/_club_home_location_card.html" %}
+    {% include "controlpanel/_club_admins_card.html" %}
+{% endblock panel %}
+
+{% block extra_body %}
+    {{ charts|json_script:"chart-data" }}
+    <script src="{% static 'js/chart.js' %}"></script>
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+    <script>
+        (() => {
+            const data = JSON.parse(document.getElementById("chart-data").textContent);
+            const css = (name, fallback) => getComputedStyle(document.documentElement).getPropertyValue(name).trim() || fallback;
+
+            const render = () => {
+                const ink = css("--color-base-content", "#333");
+                const grid = "color-mix(in oklab, " + ink + " 15%, transparent)";
+
+                // Stacked: the bar height stays "signups this month" while the split shows where
+                // they came from. Side-by-side bars would answer a different question.
+                const signups = new Chart(document.getElementById("signups-chart"), {
+                    type: "bar",
+                    data: {
+                        labels: data.signups.map((point) => point.month),
+                        datasets: [
+                            {label: "New", data: data.signups.map((point) => point.new), backgroundColor: css("--color-primary", "#4f46e5")},
+                            {label: "Returning", data: data.signups.map((point) => point.returning), backgroundColor: css("--color-accent", "#0ea5e9")},
+                        ],
+                    },
+                    options: {
+                        responsive: true,
+                        maintainAspectRatio: false,
+                        plugins: {legend: {position: "bottom", labels: {color: ink}}},
+                        scales: {
+                            x: {stacked: true, ticks: {color: ink}, grid: {color: grid}},
+                            y: {stacked: true, beginAtZero: true, ticks: {color: ink, precision: 0}, grid: {color: grid}},
+                        },
+                    },
+                });
+
+                // Colour carries the meaning here — unpaid must read as a problem, waived must
+                // not — so the slices are pinned to the semantic theme colours, in order.
+                const fees = new Chart(document.getElementById("fees-chart"), {
+                    type: "pie",
+                    data: {
+                        labels: data.fees.map((slice) => slice.label),
+                        datasets: [
+                            {
+                                data: data.fees.map((slice) => slice.value),
+                                backgroundColor: [css("--color-success", "#16a34a"), css("--color-warning", "#f59e0b"), css("--color-error", "#dc2626"), css("--color-neutral", "#6b7280")],
+                            },
+                        ],
+                    },
+                    options: {
+                        responsive: true,
+                        maintainAspectRatio: false,
+                        plugins: {legend: {position: "right", labels: {color: ink}}},
+                    },
+                });
+
+                return [signups, fees];
+            };
+
+            let charts = render();
+
+            // "auto" removes data-theme entirely, so watch the attribute rather than a click.
+            new MutationObserver(() => {
+                charts.forEach((chart) => chart.destroy());
+                charts = render();
+            }).observe(document.documentElement, {attributes: true, attributeFilter: ["data-theme"]});
+        })();
+    </script>
+{% endblock extra_body %}
diff --git a/controlpanel/templates/controlpanel/club_form.html b/controlpanel/templates/controlpanel/club_form.html
new file mode 100644
index 0000000..6aa9878
--- /dev/null
+++ b/controlpanel/templates/controlpanel/club_form.html
@@ -0,0 +1,46 @@
+{% extends "controlpanel/base.html" %}
+{% load lucide ui %}
+
+{% block heading %}{% if object %}Edit {{ object }}{% else %}New club{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post" enctype="multipart/form-data">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    {% form_field form.name %}
+                    {% form_field form.slug %}
+                    {% form_field form.sport_type %}
+                </div>
+
+                <div class="divider"></div>
+
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    {% form_field form.logo %}
+                    {% form_field form.primary_color %}
+                    {% form_field form.secondary_color %}
+                </div>
+
+                <div class="divider"></div>
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.season_start %}
+                    {% form_field form.season_duration_months %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "controlpanel:club_detail" object.pk %}{% else %}{% url "controlpanel:club_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} Cancel</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} Save</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/controlpanel/templates/controlpanel/club_list.html b/controlpanel/templates/controlpanel/club_list.html
new file mode 100644
index 0000000..a815aa4
--- /dev/null
+++ b/controlpanel/templates/controlpanel/club_list.html
@@ -0,0 +1,41 @@
+{% extends "controlpanel/base.html" %}
+{% load lucide %}
+
+{% block heading %}{% if show_archived %}Archived clubs{% else %}Clubs{% endif %}{% endblock heading %}
+
+{% block actions %}
+    {% if show_archived %}
+        <a class="btn btn-outline" href="{% url 'controlpanel:club_list' %}">{% lucide "archive-x" size=16 %} Hide archived clubs</a>
+    {% else %}
+        <a class="btn btn-outline" href="{% url 'controlpanel:club_list' %}?archived=1">{% lucide "archive" size=16 %} Show archived clubs</a>
+    {% endif %}
+    <a class="btn btn-primary gap-2" href="{% url 'controlpanel:club_create' %}">{% lucide "plus" size=16 %} New club</a>
+{% endblock actions %}
+
+{% block panel %}
+    <form method="get" class="mb-4 flex gap-2">
+        {% if show_archived %}<input type="hidden" name="archived" value="1">{% endif %}
+        <label class="input">
+            <span class="opacity-50">{% lucide "search" size=16 %}</span>
+            <input type="search"
+                   name="q"
+                   value="{{ search }}"
+                   placeholder="Search clubs…"
+                   class="input input-bordered w-full max-w-xs">
+        </label>
+
+        <button class="btn btn-outline gap-2" type="submit">{% lucide "search" size=16 %} Search</button>
+        {% if search %}
+            <a class="btn btn-primary gap-2" href="{% url "controlpanel:club_list" %}">{% lucide "x" size=16 %} Clear filter</a>
+        {% endif %}
+    </form>
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            {% if show_archived %}
+                {% include "controlpanel/_club_health_table.html" with empty_message="No archived clubs." %}
+            {% else %}
+                {% include "controlpanel/_club_health_table.html" %}
+            {% endif %}
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/controlpanel/templates/controlpanel/dashboard.html b/controlpanel/templates/controlpanel/dashboard.html
new file mode 100644
index 0000000..8dd7260
--- /dev/null
+++ b/controlpanel/templates/controlpanel/dashboard.html
@@ -0,0 +1,199 @@
+{% extends "controlpanel/base.html" %}
+{% load static lucide %}
+
+{% block heading %}RosterChief Platform Dashboard{% endblock heading %}
+{% block subheading %}Welcome back {{ user.member.first_name }} &middot; {% now "d b Y" %}{% endblock subheading %}
+
+{% block actions %}
+    <a class="btn btn-primary gap-2" href="{% url 'controlpanel:club_create' %}">{% lucide "plus" size=16 %} Create new club</a>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-6">
+        <div class="card bg-base-100 shadow border-l-4 border-info">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "building-2" size=16 %} Clubs</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ totals.clubs }}</div>
+                <div class="text-xs opacity-60">Managing {{ totals.members }} member{{ totals.members|pluralize }}</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-info">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "archive" size=16 %} Archived clubs</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ totals.archived_clubs }}</div>
+                <div class="text-xs opacity-60">Not accessible but data maintained</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-success {% if attention.clubs_without_season %}border-warning{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "calendar-x" size=16 %} No current season</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.clubs_without_season }}</div>
+                <div class="text-xs opacity-60">Clubs that cannot take signups</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-success {% if attention.dormant_clubs %}border-warning{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "moon-star" size=16 %} Dormant clubs</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.dormant_clubs }}</div>
+                <div class="text-xs opacity-60">No events scheduled next 30 days</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-success {% if attention.admins_pending_mfa %}border-warning{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "shield-alert" size=16 %} MFA pending</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.admins_pending_mfa }}</div>
+                <div class="text-xs opacity-60">Admins without MFA configured</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-success {% if attention.dues_owed %}border-warning{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "receipt-euro" size=16 %} Payment pending</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">&euro;{{ attention.dues_owed|floatformat:2 }}</div>
+                <div class="text-xs opacity-60">
+                    {{ attention.dues_in_grace }} in grace ·
+                    <span class="{% if attention.dues_overdue %}font-semibold text-error{% endif %}">{{ attention.dues_overdue }} overdue</span>
+                    {% comment %}
+                        Renewals pending should sit at ~0: the cron job renews clubs 30 days out and
+                        then they fall past the horizon. A number that lingers here means the job has
+                        stopped and a club is about to use the platform for free — which no other
+                        figure on this page reveals, because nothing has been billed yet.
+                    {% endcomment %}
+                    {% if attention.renewals_pending %}
+                        · <span class="font-semibold text-warning">{{ attention.renewals_pending }} awaiting renewal</span>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="mb-6 grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "user-plus" size=18 %} Signups per month</h2>
+                <p class="text-sm opacity-70">New members against returning ones, across every club.</p>
+                <div class="h-56">
+                    <canvas id="signups-chart"></canvas>
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "milestone" size=18 %} Onboarding</h2>
+                <p class="text-sm opacity-70">Tracking club onboarding to ensure a smooth start</p>
+                <div class="mt-2 space-y-3">
+                    {% for step in funnel %}
+                        <div>
+                            <div class="mb-1 flex items-center justify-between text-sm">
+                                <span class="flex items-center gap-2">{% lucide step.icon size=14 %} {{ step.label }}</span>
+                                <span class="font-semibold tabular-nums font-mono">{{ step.count }}</span>
+                            </div>
+                            <progress class="progress {% if step.count == funnel.0.count %}progress-success{% elif step.count == 0 %}progress-error{% else %}progress-warning{% endif %} w-full" value="{{ step.count }}"
+                                      max="{{ funnel.0.count }}"></progress>
+                        </div>
+                    {% endfor %}
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title">{% lucide "building-2" size=18 %} Clubs</h2>
+            {% include "controlpanel/_club_health_table.html" %}
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    {{ charts|json_script:"chart-data" }}
+    <script src="{% static 'js/chart.js' %}"></script>
+    <script>
+        (() => {
+            const data = JSON.parse(document.getElementById("chart-data").textContent);
+
+            // Chart.js paints to a canvas, so it cannot inherit daisyUI's colours the way the
+            // rest of the page does — they are CSS variables. Read the computed values, and
+            // rebuild when the theme attribute changes, or the charts keep the light palette
+            // after a switch to dark.
+            const css = (name, fallback) => getComputedStyle(document.documentElement).getPropertyValue(name).trim() || fallback;
+
+            const render = () => {
+                const ink = css("--color-base-content", "#333");
+                const grid = "color-mix(in oklab, " + ink + " 15%, transparent)";
+
+                // Locale-aware, so 1234.5 reads as "€ 1.234,50" rather than "€1,234.5". Two of
+                // them: the axis is rounded to keep the labels short, but the tooltip keeps the
+                // cents — rounding a euro amount someone is reading off a chart is a lie.
+                const axisEuros = new Intl.NumberFormat("nl-BE", {style: "currency", currency: "EUR", maximumFractionDigits: 0});
+                const exactEuros = new Intl.NumberFormat("nl-BE", {style: "currency", currency: "EUR", minimumFractionDigits: 2});
+
+                const build = (id, label, series, colour, type, money) =>
+                    new Chart(document.getElementById(id), {
+                        type,
+                        data: {
+                            labels: series.map((point) => point.month),
+                            datasets: [{label, data: series.map((point) => point.value), borderColor: colour, backgroundColor: colour, tension: 0.3}],
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {
+                                legend: {display: false},
+                                // The tooltip carries the unit too: an axis in euros and a bare
+                                // number on hover reads as two different quantities.
+                                tooltip: money ? {callbacks: {label: (item) => exactEuros.format(item.parsed.y)}} : {},
+                            },
+                            scales: {
+                                x: {ticks: {color: ink}, grid: {color: grid}},
+                                y: {
+                                    beginAtZero: true,
+                                    grid: {color: grid},
+                                    ticks: {color: ink, precision: 0, callback: money ? (value) => axisEuros.format(value) : undefined},
+                                },
+                            },
+                        },
+                    });
+
+                // Stacked, so the bar height stays "signups this month" while the split shows
+                // where they came from. New is per club: joining a second club is a new
+                // membership there, even for someone who has been on the platform for years.
+                const signups = new Chart(document.getElementById("signups-chart"), {
+                    type: "bar",
+                    data: {
+                        labels: data.signups.map((point) => point.month),
+                        datasets: [
+                            {label: "New", data: data.signups.map((point) => point.new), backgroundColor: css("--color-primary", "#4f46e5")},
+                            {label: "Returning", data: data.signups.map((point) => point.returning), backgroundColor: css("--color-accent", "#0ea5e9")},
+                        ],
+                    },
+                    options: {
+                        responsive: true,
+                        maintainAspectRatio: false,
+                        plugins: {legend: {position: "bottom", labels: {color: ink}}},
+                        scales: {
+                            x: {stacked: true, ticks: {color: ink}, grid: {color: grid}},
+                            y: {stacked: true, beginAtZero: true, ticks: {color: ink, precision: 0}, grid: {color: grid}},
+                        },
+                    },
+                });
+
+                return [signups]; // build("revenue-chart", "Dues", data.dues, css("--color-accent", "#0ea5e9"), "bar", true)];
+            };
+
+            let charts = render();
+
+            // The theme toggle sets data-theme on <html>; "auto" removes it entirely, so watch
+            // the attribute rather than listening for a click.
+            new MutationObserver(() => {
+                charts.forEach((chart) => chart.destroy());
+                charts = render();
+            }).observe(document.documentElement, {attributes: true, attributeFilter: ["data-theme"]});
+        })();
+    </script>
+{% endblock extra_body %}
diff --git a/controlpanel/templates/controlpanel/features.html b/controlpanel/templates/controlpanel/features.html
new file mode 100644
index 0000000..64fa957
--- /dev/null
+++ b/controlpanel/templates/controlpanel/features.html
@@ -0,0 +1,145 @@
+{% extends "controlpanel/base.html" %}
+{% load lucide ui %}
+
+{% block heading %}Features{% endblock heading %}
+
+{% block actions %}
+    <button class="btn btn-primary gap-2" type="button" onclick="document.getElementById('flag_create_modal').showModal()">{% lucide "plus" size=16 %} New feature</button>
+{% endblock actions %}
+
+{% block panel %}
+    {% url 'controlpanel:flag_create' as flag_create_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="flag_create_modal" title="New feature" form=flag_form action_url=flag_create_url submit_label="Create" submit_icon="plus" %}
+
+    {% comment %}
+        The lock-down. Clubs get a maintenance page, the scheduled jobs stand down, and the
+        control panel and the auth screens stay open — otherwise you could not sign in to
+        turn it back off.
+    {% endcomment %}
+    <div class="card mb-6 bg-base-100 shadow {% if maintenance.is_active %}border-l-4 border-error{% endif %}">
+        <div class="card-body">
+            <div class="flex flex-wrap items-start justify-between gap-4">
+                <div class="w-full">
+                    <h2 class="card-title text-base mb-2">{% lucide "wrench" size=18 %} Maintenance mode</h2>
+                    {% if maintenance.is_active %}
+                        <div class="flex flex-row gap-2 text-sm">
+                            <span class="badge badge-error gap-1">{% lucide "lock" size=12 %} Platform closed</span>
+                            <div>&middot;</div>
+                            <div>since {{ maintenance.started_at|date:"j M Y, H:i" }}{% if maintenance.started_by %} by {{ maintenance.started_by.email }}{% endif %}</div>
+                        </div>
+
+                        {% if maintenance.message %}
+                            <div class="my-4">
+                                <div class="font-semibold mb-1">Message</div>
+                                <div class="p-4 bg-base-300 border-l-4 border-info w-full font-mono">{{ maintenance.message }}</div>
+                            </div>
+                        {% endif %}
+                    {% else %}
+                        <p class="text-sm opacity-70">
+                            Closes every club subdomain and stands the scheduled jobs down. The control panel and the sign-in screens stay open.
+                        </p>
+                    {% endif %}
+                </div>
+            </div>
+
+            <form class="mt-2" method="post" action="{% url 'controlpanel:maintenance' %}">
+                {% csrf_token %}
+                {% if not maintenance.is_active %}
+                    <div class="form-control my-2 w-full pb-2">
+                        <label class="label" for="{{ maintenance_form.message.id_for_label }}">
+                            <span class="label-text">{{ maintenance_form.message.label }}</span>
+                        </label>
+                        {{ maintenance_form.message|daisy }}
+                        <span class="label-text-alt mt-1 block text-xs text-base-content/70">{{ maintenance_form.message.help_text }}</span>
+                    </div>
+                    <button class="btn btn-error gap-2" type="submit">{% lucide "lock" size=16 %} Close the platform</button>
+                {% else %}
+                    <button class="btn btn-success gap-2" type="submit">{% lucide "lock-open" size=16 %} Reopen the platform</button>
+                {% endif %}
+            </form>
+        </div>
+    </div>
+
+    <div class="card mb-6 bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title text-base">{% lucide "flag" size=18 %} Flags</h2>
+            <p class="text-sm opacity-70">
+                Flags are turned on per club. Setting <em>Everyone</em> to Yes or No overrides club targeting entirely.
+            </p>
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>Name</th>
+                            <th>Everyone</th>
+                            <th>Clubs</th>
+                            <th>Note</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for flag in flags %}
+                            <tr>
+                                <td class="font-mono font-medium">{{ flag.name }}</td>
+                                <td>
+                                    {% if flag.everyone is True %}
+                                        <span class="badge badge-success">On for all</span>
+                                    {% elif flag.everyone is False %}
+                                        <span class="badge badge-error">Off everywhere</span>
+                                    {% else %}
+                                        <span class="badge badge-info">Per club</span>
+                                    {% endif %}
+                                </td>
+                                <td>{{ flag.clubs.count }}</td>
+                                <td class="max-w-xs truncate opacity-70">{{ flag.note|default:"-" }}</td>
+                                <td class="text-right">
+                                    <button class="btn btn-outline btn-sm gap-1" type="button" onclick="document.getElementById('{{ flag.pk|dom_id:"flag_edit_modal" }}').showModal()">{% lucide "pencil" size=14 %} Edit</button>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">No features yet.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+
+            {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+            {% for flag in flags %}
+                {% url 'controlpanel:flag_update' flag.pk as flag_update_url %}
+                {% include "controlpanel/_modal_form.html" with modal_id=flag.pk|dom_id:"flag_edit_modal" title="Edit "|add:flag.name form=flag.edit_form action_url=flag_update_url submit_label="Save" submit_icon="check" %}
+            {% endfor %}
+        </div>
+    </div>
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title text-base">{% lucide "power" size=18 %} Switches</h2>
+            <p class="text-sm opacity-70">Global on/off for the whole platform — kill-switches, maintenance, infra rollouts.</p>
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <tbody>
+                        {% for switch in switches %}
+                            <tr>
+                                <td class="font-mono font-medium">{{ switch.name }}</td>
+                                <td class="opacity-70">{{ switch.note|default:"-" }}</td>
+                                <td class="text-right">
+                                    <form method="post" action="{% url 'controlpanel:switch_toggle' switch.pk %}">
+                                        {% csrf_token %}
+                                        <button class="btn btn-sm gap-1 {% if switch.active %}btn-success{% else %}btn-ghost{% endif %}" type="submit">
+                                            {% if switch.active %}{% lucide "toggle-right" size=16 %} On{% else %}{% lucide "toggle-left" size=16 %} Off{% endif %}
+                                        </button>
+                                    </form>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td class="text-center opacity-60">No switches yet — add one in the Django admin.</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/controlpanel/templates/templatetags/field.html b/controlpanel/templates/templatetags/field.html
new file mode 100644
index 0000000..db9360b
--- /dev/null
+++ b/controlpanel/templates/templatetags/field.html
@@ -0,0 +1,239 @@
+{% load i18n %}
+
+<div class="w-full max-w-6xl {% if size_modifier %}lg:w-fit{% endif %}">
+    <div class="flex flex-col gap-y-2">
+        {% if show_label %}
+            <div class="flex flex-row items-end min-h-6">
+                <div class="ml-1 grow text-sm font-semibold {% if field.errors %}text-error{% else %}text-base-content{% endif %}">
+                    {{ field.label }}
+                </div>
+
+                {% if field.field.required %}
+                    <div class="mr-1">
+                        <span class="badge badge-sm {% if field.errors %}badge-error text-error-content{% else %}badge-neutral text-neutral-content{% endif %}">{% translate "required" %}</span>
+                    </div>
+                {% endif %}
+            </div>
+        {% endif %}
+
+        <div>
+            {% if field_type == "input" %}
+                <input
+                        type="{% if field.widget_type == "regionalphonenumber" %}tel{% elif field.widget_type == "datetime" %}datetime-local{% else %}{{ field.widget_type }}{% endif %}"
+                        class="input w-full {% if field.errors %}input-error text-error{% endif %} {% if size_modifier %}input-{{ size_modifier }}{% endif %}"
+                        name="{{ field.html_name }}"
+                        value="{% if field.widget_type == "date" or field.widget_type == "datetime" %}{% if field.value|date:"c"|default:"" != "" %}{{ field.value|date:"c"|default:"" }}{% else %}{{ field.value|default:"" }}{% endif %}{% else %}{% if field.value == None %}{{ field.value|default:"" }}{% else %}{{ field.value }}{% endif %}{% endif %}"
+                        {% if show_placeholder %}placeholder="{{ field.label|capfirst }}"{% endif %}
+                />
+
+            {% elif field_type == "checkbox" %}
+                <div class="flex flex-row items-center gap-2">
+                    <input
+                            type="checkbox"
+                            {% if show_as_toggle %}
+                            class="toggle {% if size_modifier %}toggle-{{ size_modifier }}{% endif %}"
+                            {% else %}
+                            class="checkbox {% if size_modifier %}checkbox-{{ size_modifier }}{% endif %}"
+                            {% endif %}
+                            name="{{ field.html_name }}"
+                            {% if field.value %}checked="checked"{% endif %}
+                    />
+
+                    {% if show_help_text %}
+                        <div class="text-sm">
+                            {{ field.help_text }}
+                        </div>
+                    {% endif %}
+                </div>
+
+            {% elif field_type == "textarea" %}
+                <textarea
+                        name="{{ field.html_name }}"
+                        class="{% if type == "markdownx" %}markdownx{% endif %} textarea textarea-bordered h-72 w-full {% if field.errors %}textarea-error text-error{% endif %} {% if size_modifier %}textarea-{{ size_modifier }}{% endif %}"
+                        {% if show_placeholder %}placeholder="{{ field.label }}"{% endif %}
+                >{{ field.value|default:"" }}</textarea>
+
+            {% elif field_type == "select" %}
+                {% comment %}
+                    field.field.widget.choices, not field.field.choices: a plain ChoiceField
+                    exposes both (kept in sync), but NullBooleanField (the "everyone" tri-state
+                    Yes/No/Unknown field) only ever has them on the widget -- the field itself
+                    has no .choices attribute at all. Reading from the field silently rendered
+                    zero <option> tags for it, an empty dropdown, since a template attribute
+                    lookup that raises AttributeError just resolves to nothing rather than
+                    erroring.
+                {% endcomment %}
+                <select
+                        class="select w-full {% if size_modifier %}select-{{ size_modifier }}{% endif %} {% if field.errors %}select-error text-error{% endif %}"
+                        name="{{ field.html_name }}"
+                        id="{{ field.auto_id }}"
+                        {% if field.widget_type == "selectmultiple" %}multiple{% endif %}
+                        {% for attr, value in field.field.widget.attrs.items %}{{ attr }}="{{ value }}" {% endfor %}
+                >
+
+                    {% if field.widget_type == "selectmultiple" %}
+                        {% if not show_label %}
+                            <option selected disabled>{{ field.label|capfirst }}</option>
+                        {% endif %}
+
+                        {% for option_value, option_label in field.field.widget.choices %}
+                            <option value="{{ option_value }}" {% if option_value in field.value %}selected="selected"{% endif %}>
+                                {{ option_label }}
+                            </option>
+                        {% endfor %}
+                    {% else %}
+                        {% if not show_label %}
+                            <option selected disabled>{{ field.label|capfirst }}</option>
+                        {% endif %}
+
+                        {% for option_value, option_label in field.field.widget.choices %}
+                            <option value="{{ option_value }}" {% if field.value|stringformat:"s" == option_value|stringformat:"s" %}selected="selected"{% endif %}>
+                                {{ option_label }}
+                            </option>
+                        {% endfor %}
+                    {% endif %}
+
+                </select>
+
+            {% elif field_type == "file" %}
+                <input
+                        type="file"
+                        class="file-input w-full {% if size_modifier %}file-input-{{ size_modifier }}{% endif %}"
+                        name="{{ field.html_name }}"
+                        {% if field.field.widget.attrs.accept %}accept="{{ field.field.widget.attrs.accept }}"{% endif %}
+                        {% if field.field.widget.attrs.multiple %}multiple{% endif %}
+                />
+
+                {% if field.value %}
+                    <span class="my-1 text-xs opacity-50">{% translate "Current file:" %} {{ field.value }}</span>
+                {% endif %}
+            {% endif %}
+        </div>
+
+        {% if field_type != "checkbox" and field.help_text and show_help_text or field.errors %}
+            <div class="flex flex-col gap-1 ml-2">
+                {% if field.errors %}
+                    <div class="text-xs text-error">
+                        {{ field.errors }}
+                    </div>
+                {% endif %}
+
+                {% if field.help_text %}
+                    <div class="text-xs self-start opacity-50 {% if field.errors %}text-error{% endif %}">
+                        {{ field.help_text }}
+                    </div>
+                {% endif %}
+            </div>
+        {% endif %}
+    </div>
+</div>
+
+
+{% comment %} <div class="w-full max-w-6xl {% if size_modifier %}lg:w-fit{% endif %}">
+    <label class="w-full form-control">
+        {% if show_label %}
+            <div class="label">
+                <span class="label-text opacity-50 {% if field.errors %}text-error{% else %}text-base-content{% endif %}">{{ field.label }}</span>
+
+                {% if field.field.required %}
+                    <span class="label-text-alt badge badge-sm {% if field.errors %}badge-error text-error-content{% else %}badge-neutral text-neutral-content{% endif %}">{% translate "required" %}</span>
+                {% endif %}
+            </div>
+        {% endif %}
+
+        {% if field_type == "select" %}
+            <select
+                class="select select-bordered {% if size_modifier %}select-{{ size_modifier }}{% endif %} {% if field.errors %}select-error text-error{% endif %}"
+                name="{{ field.html_name }}"
+                id="{{ field.auto_id }}"
+                {% if field.widget_type == "selectmultiple" %}multiple{% endif %}
+            >
+
+                {% if field.widget_type == "selectmultiple" %}
+                    {% if not show_label %}
+                        <option selected disabled>{{ field.label|capfirst }}</option>
+                    {% endif %}
+
+                    {% for option_value, option_label in field.field.choices %}
+                        <option value="{{ option_value }}" {% if option_value in field.value %}selected="selected"{% endif %}>
+                            {{ option_label }}
+                        </option>
+                    {% endfor %}
+                {% else %}
+                    {% if not show_label %}
+                        <option selected disabled>{{ field.label|capfirst }}</option>
+                    {% endif %}
+
+                    {% for option_value, option_label in field.field.choices %}
+                        <option value="{{ option_value }}" {% if field.value|stringformat:"s" == option_value|stringformat:"s" %}selected="selected"{% endif %}>
+                            {{ option_label }}
+                        </option>
+                    {% endfor %}
+                {% endif %}
+
+            </select>
+
+        {% elif field_type == "checkbox" %}
+            <div class="flex flex-row items-center gap-2">
+                <input
+                    type="checkbox"
+                    {% if show_as_toggle %}
+                        class="toggle {% if size_modifier %}toggle-{{ size_modifier }}{% endif %}"
+                    {% else %}
+                        class="checkbox {% if size_modifier %}checkbox-{{ size_modifier }}{% endif %}"
+                    {% endif %}
+                    name="{{ field.html_name }}"
+                    {% if field.value %}checked="checked"{% endif %}
+                />
+
+                {% if show_help_text %}
+                    <div class="label-text">
+                        {{ field.help_text }}
+                    </div>
+                {% endif %}
+            </div>
+
+        {% elif field_type == "textarea" %}
+            <textarea
+                name="{{ field.html_name }}"
+                class="{% if type == "markdownx" %}markdownx{% endif %} textarea textarea-bordered h-72 {% if field.errors %}textarea-error text-error{% endif %} {% if size_modifier %}textarea-{{ size_modifier }}{% endif %}"
+                {% if show_placeholder %}placeholder="{{ field.label }}"{% endif %}
+            >{{ field.value|default:"" }}</textarea>
+
+        {% elif field_type == "file" %}
+            <input
+                type="file"
+                class="file-input file-input-bordered {% if size_modifier %}file-input-{{ size_modifier }}{% endif %}"
+                name="{{ field.html_name }}"
+            />
+            {% if field.value %}
+                <span class="my-1 text-sm text-gray-500">{% translate "Current file:" %} {{ field.value }}</span>
+            {% endif %}
+
+        {% elif field_type == "input" %}
+            <input
+                type="{% if field.widget_type == "regionalphonenumber" %}tel{% elif field.widget_type == "datetime" %}datetime-local{% else %}{{ field.widget_type }}{% endif %}"
+                class="input input-bordered {% if field.errors %}input-error text-error{% endif %} {% if size_modifier %}input-{{ size_modifier }}{% endif %}"
+                name="{{ field.html_name }}"
+                value="{% if field.widget_type == "date" or field.widget_type == "datetime" %}{{ field.value|date:"c"|default:"" }}{% else %}{{ field.value|default:"" }}{% endif %}"
+                {% if show_placeholder %}placeholder="{{ field.label|capfirst }}"{% endif %}
+            />
+        {% endif %}
+
+        {% if field.help_text and show_help_text or field.errors %}
+            <div class="label">
+                {% if field.errors %}
+                    <div class="label-text-alt text-error">
+                        {{ field.errors }}
+                    </div>
+                {% endif %}
+
+                {% if field.help_text and field_type != "checkbox" %}
+                    <div class="label-text-alt self-start {% if field.errors %}text-error{% endif %}">
+                        {{ field.help_text }}
+                    </div>
+                {% endif %}
+            </div>
+        {% endif %}
+    </label>
+</div> {% endcomment %}
\ No newline at end of file
diff --git a/controlpanel/templatetags/__init__.py b/controlpanel/templatetags/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/controlpanel/templatetags/ui.py b/controlpanel/templatetags/ui.py
new file mode 100644
index 0000000..6ae53bd
--- /dev/null
+++ b/controlpanel/templatetags/ui.py
@@ -0,0 +1,192 @@
+"""Template helpers for the daisyUI-based UI."""
+
+from django import forms, template
+from django.forms import BoundField
+
+register = template.Library()
+
+#: daisyUI class per widget kind. Django renders widgets unstyled, so this is
+#: what makes every allauth and control-panel form field look right.
+WIDGET_CLASSES = (
+    (forms.CheckboxInput, "checkbox"),
+    (forms.FileInput, "file-input file-input-bordered w-full"),
+    (forms.RadioSelect, "radio"),
+    (forms.Select, "select select-bordered w-full"),
+    (forms.Textarea, "textarea textarea-bordered w-full"),
+)
+DEFAULT_WIDGET_CLASS = "input input-bordered w-full"
+
+
+#: Icon, default heading and daisyUI colour per message level.
+MESSAGE_ALERTS = {
+    "debug": ("bug", "Debug", "alert-info border-info"),
+    "info": ("info", "Heads up", "alert-info border-info"),
+    "success": ("circle-check", "Done", "alert-success border-success"),
+    "warning": ("triangle-alert", "Careful", "alert-warning border-warning"),
+    "error": ("circle-x", "Something went wrong", "alert-error border-error"),
+}
+DEFAULT_MESSAGE_ALERT = MESSAGE_ALERTS["info"]
+
+
+@register.filter
+def as_alert(message):
+    """Presentation for one Django message: icon, bold title, body, colour.
+
+    Django messages carry a level and a string — there is no title field — so the
+    title comes from the level, unless the message carries one as ``extra_tags``.
+    Call sites queue messages with ``notify`` (controlpanel/messages.py), which sets
+    exactly that from a compact ``"<level>|<title>|<body>"`` spec::
+
+        notify(request, f"s|Club created|{club} is live.")
+
+    Keyed on ``level_tag``, never ``tags``: ``tags`` is extra_tags and level_tag
+    joined, so a message carrying a custom title would stop matching its own level
+    and quietly render as info.
+    """
+    icon, title, css = MESSAGE_ALERTS.get(message.level_tag, DEFAULT_MESSAGE_ALERT)
+
+    return {"icon": icon, "title": message.extra_tags or title, "body": message.message, "css": css}
+
+
+#: Icon shown inside the field, by form field name. Anything unlisted gets none.
+FIELD_ICONS = {
+    "login": "mail",
+    "email": "mail",
+    "email2": "mail",
+    "oldpassword": "lock-keyhole",
+    "password": "lock-keyhole",
+    "password1": "lock-keyhole",
+    "password2": "lock-keyhole",
+    "code": "shield-check",
+}
+
+
+#: Fields rendered as a boxed one-time-code input rather than a plain text field.
+OTP_FIELDS = {"code"}
+
+
+@register.filter
+def is_otp(field):
+    return field.name in OTP_FIELDS
+
+
+@register.filter
+def as_otp(field):
+    """Render the code input for the boxed otp layout.
+
+    No daisy classes — the wrapping div carries them — and no placeholder: allauth sets
+    one ("Code"), and grey text sitting inside the boxes reads as an already-typed code.
+    The label lives outside the box as an sr-only element, so nothing is lost.
+
+    False, not a pop: as_widget() merges the widget's own attrs back in, so deleting the
+    placeholder from a copy achieves nothing. Django's attribute template omits any attr
+    whose value is False, which is the only way to actually suppress one.
+    """
+    return field.as_widget(attrs={"class": "", "placeholder": False})
+
+
+@register.filter
+def field_icon(field):
+    return FIELD_ICONS.get(field.name, "")
+
+
+@register.filter
+def excluded(field, names):
+    """Is this field in a comma-separated exclude list?
+
+    Split rather than a substring test: ``"password" in "password2"`` is true, and the
+    login page excluding "remember" must not silently drop a field whose name happens
+    to contain it.
+    """
+    return field.name in (names or "").split(",")
+
+
+@register.filter
+def dom_id(pk, prefix):
+    """A stable per-row DOM id, e.g. ``{{ due.pk|dom_id:"due_pay_modal" }}``.
+
+    Django templates cannot concatenate a string literal with a non-string filter
+    argument directly (``"prefix_"|add:some_uuid`` raises), which is what a per-row modal
+    id needs. This is the one place that builds one, so every call site reads the same way.
+    """
+    return f"{prefix}_{pk}"
+
+
+@register.filter
+def daisy(field, css=None):
+    """Render a bound form field with the right daisyUI classes.
+
+    Pass ``css`` to override them — the icon-in-field layout wraps the input in a
+    ``label.input``, and there the input itself must NOT carry the ``input`` class
+    (daisyUI styles the wrapper instead), so it is rendered with ``grow``. The error
+    state then belongs on the wrapper too, which is why an override skips it here.
+    """
+    widget = field.field.widget
+
+    if css is None:
+        css = next((css for widget_type, css in WIDGET_CLASSES if isinstance(widget, widget_type)), DEFAULT_WIDGET_CLASS)
+        if field.errors:
+            css = f"{css} {css.split()[0]}-error"
+
+    attrs = dict(widget.attrs)
+    attrs["class"] = " ".join(part for part in [widget.attrs.get("class", ""), css] if part)
+    return field.as_widget(attrs=attrs)
+
+
+@register.inclusion_tag("templatetags/field.html")
+def form_field(
+    field: BoundField,
+    label: str | None = None,
+    help_text: str | None = None,
+    show_label: bool = True,
+    show_help_text: bool = True,
+    show_placeholder: bool = True,
+    show_as_toggle: bool = False,
+    size: str = "full",
+) -> dict:
+    if label is not None:
+        field.label = label
+
+    if help_text is not None:
+        field.help_text = help_text
+
+    field_type = None
+    match field.widget_type:
+        # "lazyselect" is django_countries' CountryField widget (a Select subclass
+        # with a lazily-translated choice list) -- without it here, this fell
+        # through to the "input" case below and rendered as a plain text box
+        # (`<input type="lazyselect">`, which browsers just treat as text).
+        case "select" | "nullbooleanselect" | "radioselect" | "lazyselect":
+            field_type = "select"
+        case "checkbox":
+            field_type = "checkbox"
+        case "textarea" | "markdownx":
+            field_type = "textarea"
+        case "clearablefile" | "multiplefile":
+            field_type = "file"
+        case "selectmultiple":
+            field_type = "select"
+        case _:
+            field_type = "input"
+
+    size_modifier = None
+    match size:
+        case "extra-small":
+            size_modifier = "xs"
+        case "small":
+            size_modifier = "sm"
+        case _:
+            pass
+
+    # if field.widget_type == "number":
+    #    field.value = str(field.value())
+
+    return {
+        "field": field,
+        "show_label": show_label,
+        "show_help_text": show_help_text,
+        "show_placeholder": show_placeholder,
+        "show_as_toggle": show_as_toggle,
+        "field_type": field_type,
+        "size_modifier": size_modifier,
+    }
diff --git a/controlpanel/tests.py b/controlpanel/tests.py
new file mode 100644
index 0000000..d8be903
--- /dev/null
+++ b/controlpanel/tests.py
@@ -0,0 +1,1679 @@
+import datetime
+import pathlib
+from decimal import Decimal
+from unittest import mock
+
+from allauth.mfa.models import Authenticator
+from django import forms
+from django.conf import settings
+from django.contrib import messages
+from django.contrib.auth import get_user_model
+from django.contrib.messages.storage.base import Message
+from django.contrib.messages.storage.fallback import FallbackStorage
+from django.core.cache import cache
+from django.test import RequestFactory, TestCase, override_settings
+from django.urls import reverse
+from django.utils import timezone
+from waffle import get_waffle_flag_model, get_waffle_switch_model
+
+from billing.models import GRACE_DAYS, Due, Tier, TierPrice
+from billing.services import BillingError
+from billing.services.dues import record_payment, subscribe, waive
+from club.models import Club, ClubMembership, ClubRole, Season
+from events.models import Attendance, Event, Location
+from features.models import Maintenance
+from members.models import Member
+from shop.models import Order
+from teams.models import Position, StaffAssignment, Team, TeamMembership
+
+from .messages import LEVELS, notify
+from .services.admins import grant_club_admin
+from .services.platform_admins import PlatformAdminError, is_last_superuser, set_platform_access
+from .services.statistics import (
+    admins_pending_mfa,
+    attendance_rates,
+    club_attention,
+    club_statistics,
+    clubs_with_health,
+    clubs_with_totals,
+    clubs_without_a_season,
+    dormant_clubs,
+    fee_aging,
+    flag_adoption,
+    new_members,
+    onboarding_funnel,
+    platform_attention,
+    platform_charts,
+    platform_totals,
+    renewal_rate,
+    signup_split,
+    teams_without_a_manager,
+    unrostered_members,
+)
+from .templatetags.ui import as_alert, daisy, excluded, field_icon
+
+User = get_user_model()
+Flag = get_waffle_flag_model()
+Switch = get_waffle_switch_model()
+
+
+def enrol_mfa(user):
+    return Authenticator.objects.create(user=user, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+
+
+class ControlPanelTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        self.staff = User.objects.create_user(email="root@example.com", password="pw-secret-123", is_staff=True)
+        # Staff must hold a second factor, else RequireMFAMiddleware redirects.
+        enrol_mfa(self.staff)
+        self.client.force_login(self.staff)
+
+
+class AccessTests(ControlPanelTestBase):
+    def test_staff_can_reach_the_panel(self):
+        self.assertEqual(self.client.get(reverse("controlpanel:dashboard")).status_code, 200)
+
+    def test_anonymous_is_sent_to_login(self):
+        self.client.logout()
+
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(reverse("account_login"), response.url)
+
+    def test_signed_in_non_staff_gets_403(self):
+        self.client.force_login(User.objects.create_user(email="member@example.com", password="pw-secret-123"))
+
+        self.assertEqual(self.client.get(reverse("controlpanel:dashboard")).status_code, 403)
+
+    def test_superuser_can_reach_the_panel(self):
+        root = User.objects.create_superuser(email="super@example.com", password="pw-secret-123")
+        enrol_mfa(root)
+        self.client.force_login(root)
+
+        self.assertEqual(self.client.get(reverse("controlpanel:dashboard")).status_code, 200)
+
+    @override_settings(ROSTERCHIEF_BASE_DOMAIN="rosterchief.app", ALLOWED_HOSTS=[".rosterchief.app"])
+    def test_panel_does_not_exist_on_a_club_subdomain(self):
+        # It manages *all* clubs, so it must not be reachable from inside one.
+        Club.objects.create(name="Rival FC", slug="rival-fc")
+
+        response = self.client.get(reverse("controlpanel:dashboard"), headers={"host": "rival-fc.rosterchief.app"})
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_staff_without_a_second_factor_is_sent_to_enrolment(self):
+        self.client.force_login(User.objects.create_user(email="nomfa@example.com", password="pw-secret-123", is_staff=True))
+
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.url, reverse("mfa_index"))
+
+
+class ClubManagementTests(ControlPanelTestBase):
+    def test_dashboard_lists_clubs(self):
+        self.assertContains(self.client.get(reverse("controlpanel:dashboard")), "Ajax United")
+
+    def test_the_club_rows_subtitle_shows_the_sport_type_behind_the_url(self):
+        self.club.sport_type = Club.SportType.ICE_HOCKEY
+        self.club.save()
+
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        self.assertContains(response, f"{self.club.slug}.rosterchief.app &middot; Ice hockey", html=False)
+
+    def test_create_club_derives_the_slug(self):
+        response = self.client.post(reverse("controlpanel:club_create"), {"name": "New Club", "slug": "", "sport_type": "other", "season_start": "2000-08-01", "season_duration_months": "12"})
+
+        club = Club.objects.get(name="New Club")
+        self.assertEqual(club.slug, "new-club")
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[club.pk]))
+
+    def test_update_club(self):
+        self.client.post(
+            reverse("controlpanel:club_update", args=[self.club.pk]),
+            {"name": "Renamed", "slug": self.club.slug, "sport_type": "other", "season_start": "2000-08-01", "season_duration_months": "12"},
+        )
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.name, "Renamed")
+
+    def test_update_club_sport_type(self):
+        self.client.post(
+            reverse("controlpanel:club_update", args=[self.club.pk]),
+            {"name": self.club.name, "slug": self.club.slug, "sport_type": "ice_hockey", "season_start": "2000-08-01", "season_duration_months": "12"},
+        )
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.sport_type, "ice_hockey")
+
+    def test_club_detail_shows_statistics(self):
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "Members")
+        self.assertContains(response, "Teams &amp; staff")
+        self.assertContains(response, "Shop")
+
+    def test_club_detail_subheading_shows_the_sport_type_behind_the_url(self):
+        self.club.sport_type = Club.SportType.ICE_HOCKEY
+        self.club.save()
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, f"{self.club.slug}.rosterchief.app &middot; Ice hockey", html=False)
+
+    def test_archive_then_restore(self):
+        self.client.post(reverse("controlpanel:club_archive", args=[self.club.pk]))
+        self.club.refresh_from_db()
+        self.assertTrue(self.club.is_archived)
+
+        self.client.post(reverse("controlpanel:club_restore", args=[self.club.pk]))
+        self.club.refresh_from_db()
+        self.assertFalse(self.club.is_archived)
+
+    def test_list_separates_active_from_archived(self):
+        Club.objects.create(name="Gone FC").archive()
+
+        active = self.client.get(reverse("controlpanel:club_list"))
+        self.assertContains(active, "Ajax United")
+        self.assertNotContains(active, "Gone FC")
+
+        archived = self.client.get(reverse("controlpanel:club_list"), {"archived": "1"})
+        self.assertContains(archived, "Gone FC")
+        self.assertNotContains(archived, "Ajax United")
+
+    def test_list_search(self):
+        Club.objects.create(name="Rival FC")
+
+        response = self.client.get(reverse("controlpanel:club_list"), {"q": "Ajax"})
+
+        self.assertContains(response, "Ajax United")
+        self.assertNotContains(response, "Rival FC")
+
+
+class ClubAdminManagementTests(ControlPanelTestBase):
+    def add_admin(self, **data):
+        return self.client.post(reverse("controlpanel:club_admin_add", args=[self.club.pk]), data)
+
+    def test_granting_admin_to_a_new_email_creates_the_account(self):
+        self.add_admin(email="New.Admin@Example.com", first_name="Ada", last_name="Min")
+
+        user = User.objects.get(email="new.admin@example.com")
+        self.assertFalse(user.has_usable_password())  # they set one via password reset
+        self.assertEqual(ClubRole.objects.get(club=self.club, member__user=user).role, ClubRole.Roles.ADMIN)
+
+    def test_a_new_email_must_come_with_a_name(self):
+        # Reachable only via the "Add admin" modal on the club detail page, so a rejected
+        # submission bounces back there with the error as a message.
+        response = self.client.post(reverse("controlpanel:club_admin_add", args=[self.club.pk]), {"email": "nameless@example.com", "first_name": "", "last_name": ""}, follow=True)
+
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[self.club.pk]))
+        self.assertFalse(ClubRole.objects.exists())
+        self.assertContains(response, "Required: this email has no account yet.")
+
+    def test_add_admin_is_post_only(self):
+        response = self.client.get(reverse("controlpanel:club_admin_add", args=[self.club.pk]))
+
+        self.assertEqual(response.status_code, 405)
+
+    def test_an_existing_member_is_promoted_rather_than_duplicated(self):
+        user = User.objects.create_user(email="existing@example.com", password="pw-secret-123")
+        member = Member.objects.create(user=user, first_name="Ex", last_name="Isting")
+        ClubRole.objects.create(club=self.club, member=member, role=ClubRole.Roles.MEMBER)
+
+        self.add_admin(email="existing@example.com")
+
+        # One role per member per club, so the MEMBER role is upgraded in place.
+        self.assertEqual(ClubRole.objects.get(club=self.club, member=member).role, ClubRole.Roles.ADMIN)
+        self.assertEqual(Member.objects.filter(user=user).count(), 1)
+
+    def test_granting_twice_is_idempotent(self):
+        self.add_admin(email="ada@example.com", first_name="Ada", last_name="Min")
+        self.add_admin(email="ada@example.com", first_name="Ada", last_name="Min")
+
+        self.assertEqual(ClubRole.objects.filter(club=self.club).count(), 1)
+
+    def test_remove_admin(self):
+        role = grant_club_admin(self.club, "ada@example.com", "Ada", "Min")
+
+        self.client.post(reverse("controlpanel:club_admin_remove", args=[self.club.pk, role.pk]))
+
+        self.assertFalse(ClubRole.objects.filter(pk=role.pk).exists())
+
+    def test_admins_are_listed_on_the_club(self):
+        grant_club_admin(self.club, "ada@example.com", "Ada", "Min")
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "Ada Min")
+        self.assertContains(response, "ada@example.com")
+
+
+class ClubHomeLocationTests(ControlPanelTestBase):
+    """The club detail page's "Home location" box -- see
+    controlpanel.views.ClubHomeLocationSetView. Setting it here creates/updates
+    an events.Location row flagged is_home, which is also what shows up on the
+    club's own Teams > Locations page (management app) -- there's no separate
+    sync step, it's the same row."""
+
+    def set_home_location(self, **data):
+        data = {"name": "Home Ground", "address": "1 Main St", "city": "Town", "zip_code": "1000", "country": "BE"} | data
+        return self.client.post(reverse("controlpanel:club_home_location_set", args=[self.club.pk]), data)
+
+    def test_setting_it_creates_a_location(self):
+        response = self.set_home_location()
+
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[self.club.pk]))
+        location = Location.objects.get(club=self.club, is_home=True)
+        self.assertEqual(location.name, "Home Ground")
+
+    def test_the_home_location_modal_renders_country_as_a_dropdown(self):
+        # Regression: CountryField's widget_type ("lazyselect") wasn't recognised
+        # by the form_field templatetag and fell through to a broken plain
+        # <input type="lazyselect">, not a <select> -- see form_field in
+        # controlpanel/templatetags/ui.py.
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertNotContains(response, 'type="lazyselect"')
+        self.assertContains(response, "Belgium")
+        self.assertContains(response, '<select')
+
+    def test_the_club_detail_page_shows_the_home_location(self):
+        self.set_home_location(name="Home Ground")
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "Home Ground")
+
+    def test_setting_it_again_updates_the_same_location_instead_of_creating_another(self):
+        self.set_home_location(name="Home Ground")
+
+        self.set_home_location(name="Renamed Ground")
+
+        self.assertEqual(Location.objects.filter(club=self.club, is_home=True).count(), 1)
+        self.assertEqual(Location.objects.get(club=self.club, is_home=True).name, "Renamed Ground")
+
+    def test_the_home_location_is_visible_on_the_clubs_own_locations_page(self):
+        # Same row, no sync needed -- the club-facing management app reads straight
+        # from events.Location, same as this view writes to.
+        self.set_home_location(name="Home Ground")
+        self.client.logout()
+        admin_user = User.objects.create_user(email="clubadmin@example.com", password="pw-secret-123")
+        admin_member = Member.objects.create(user=admin_user, first_name="Ada", last_name="Admin")
+        ClubMembership.objects.create(club=self.club, member=admin_member, season=Season.objects.create(club=self.club, start_date=datetime.date(2020, 1, 1), end_date=datetime.date(2020, 12, 31)), status=ClubMembership.StatusChoices.ACTIVE)
+        ClubRole.objects.filter(club=self.club, member=admin_member).update(role=ClubRole.Roles.ADMIN)
+        enrol_mfa(admin_user)
+        self.client.force_login(admin_user)
+
+        with override_settings(ROSTERCHIEF_BASE_DOMAIN="rosterchief.app", ALLOWED_HOSTS=[".rosterchief.app"]):
+            response = self.client.get(reverse("management:location_list"), headers={"host": f"{self.club.slug}.rosterchief.app"})
+
+        self.assertContains(response, "Home Ground")
+
+    def test_invalid_submission_redirects_back_with_an_error(self):
+        response = self.set_home_location(name="")
+
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[self.club.pk]))
+        self.assertFalse(Location.objects.filter(club=self.club, is_home=True).exists())
+
+
+class StatisticsTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today)
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+
+    def groups_for(self, club):
+        return {group["title"]: dict(group["stats"]) for group in club_statistics(club)}
+
+    def test_platform_totals_split_active_and_archived(self):
+        Club.objects.create(name="Gone FC").archive()
+
+        totals = platform_totals()
+
+        self.assertEqual(totals["clubs"], 1)
+        self.assertEqual(totals["archived_clubs"], 1)
+
+    def test_club_totals_are_annotated(self):
+        Team.objects.create(club=self.club, name="First", short_name="1st")
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season)
+
+        club = clubs_with_totals().get(pk=self.club.pk)
+
+        self.assertEqual(club.member_count, 1)
+        self.assertEqual(club.team_count, 1)
+        self.assertEqual(club.admin_count, 0)
+
+    def test_club_statistics_count_members_teams_and_money(self):
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        team = Team.objects.create(club=self.club, name="First", short_name="1st")
+        position = Position.objects.create(club=self.club, name="Forward", short_name="FW")
+        TeamMembership.objects.create(team=team, member=self.member, season=self.season, position=position)
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("50.00"), status=Order.OrderStatus.PAID)
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("20.00"), status=Order.OrderStatus.PENDING)
+
+        groups = self.groups_for(self.club)
+
+        self.assertEqual(groups["Members"]["Active this season"], 1)
+        self.assertEqual(groups["Teams & staff"]["Players this season"], 1)
+        self.assertEqual(groups["Shop"]["Revenue"], Decimal("50.00"))
+        self.assertEqual(groups["Shop"]["Outstanding"], Decimal("20.00"))
+
+    def test_statistics_cope_with_no_current_season(self):
+        # A brand-new club has no season covering today; it must not blow up.
+        groups = self.groups_for(Club.objects.create(name="Seasonless FC"))
+
+        self.assertEqual(groups["Members"]["Active this season"], 0)
+        self.assertEqual(groups["Teams & staff"]["Players this season"], 0)
+        self.assertEqual(groups["Events"]["This season"], 0)
+        self.assertEqual(groups["Shop"]["Revenue"], Decimal("0.00"))
+
+
+class SampleForm(forms.Form):
+    text = forms.CharField()
+    choice = forms.ChoiceField(choices=[("a", "A")])
+    note = forms.CharField(widget=forms.Textarea)
+    agree = forms.BooleanField()
+
+
+class DaisyFilterTests(TestCase):
+    def rendered(self, field_name, data=None):
+        form = SampleForm(data)
+        if data is not None:
+            form.is_valid()
+        return str(daisy(form[field_name]))
+
+    def test_widgets_get_the_right_daisyui_class(self):
+        self.assertIn("input input-bordered", self.rendered("text"))
+        self.assertIn("select select-bordered", self.rendered("choice"))
+        self.assertIn("textarea textarea-bordered", self.rendered("note"))
+        self.assertIn("checkbox", self.rendered("agree"))
+
+    def test_invalid_fields_get_an_error_class(self):
+        self.assertIn("input-error", self.rendered("text", data={}))
+
+
+class PlatformAdminAccessTests(ControlPanelTestBase):
+    """Managing platform admins is superuser-only: the panel is gated on
+    is_staff OR is_superuser, so letting staff grant superuser would collapse
+    the two into one privilege level."""
+
+    def test_staff_cannot_reach_the_admins_section(self):
+        self.assertEqual(self.client.get(reverse("controlpanel:admins")).status_code, 403)
+
+    def test_staff_cannot_grant_platform_access(self):
+        self.assertEqual(self.client.get(reverse("controlpanel:admin_add")).status_code, 403)
+
+    def test_the_admins_tab_is_hidden_from_staff(self):
+        self.assertNotContains(self.client.get(reverse("controlpanel:dashboard")), reverse("controlpanel:admins"))
+
+
+class PlatformAdminTests(TestCase):
+    def setUp(self):
+        self.root = User.objects.create_superuser(email="root@example.com", password="pw-secret-123")
+        enrol_mfa(self.root)
+        self.client.force_login(self.root)
+
+    def test_superuser_sees_the_admins_section(self):
+        self.assertEqual(self.client.get(reverse("controlpanel:admins")).status_code, 200)
+
+    def test_the_grant_form_is_post_only(self):
+        # Reachable only via the "Grant access" modal on the admins page: there is no
+        # standalone template to render on a GET.
+        self.assertEqual(self.client.get(reverse("controlpanel:admin_add")).status_code, 405)
+
+    def test_grant_access_to_a_new_email_creates_a_staff_account(self):
+        self.client.post(reverse("controlpanel:admin_add"), {"email": "New.Admin@Example.com"})
+
+        user = User.objects.get(email="new.admin@example.com")
+        self.assertTrue(user.is_staff)
+        self.assertFalse(user.is_superuser)
+        self.assertFalse(user.has_usable_password())  # set via password reset
+
+    def test_grant_superuser(self):
+        self.client.post(reverse("controlpanel:admin_add"), {"email": "boss@example.com", "is_superuser": "1"})
+
+        user = User.objects.get(email="boss@example.com")
+        self.assertTrue(user.is_superuser)
+        self.assertTrue(user.is_staff)  # superuser implies staff, else they can't reach the panel
+
+    def test_promote_and_demote_another_admin(self):
+        other = User.objects.create_user(email="other@example.com", password="pw-secret-123", is_staff=True)
+
+        self.client.post(reverse("controlpanel:admin_update", args=[other.pk]), {"is_staff": "1", "is_superuser": "1"})
+        other.refresh_from_db()
+        self.assertTrue(other.is_superuser)
+
+        self.client.post(reverse("controlpanel:admin_update", args=[other.pk]), {"is_staff": "1", "is_superuser": "0"})
+        other.refresh_from_db()
+        self.assertFalse(other.is_superuser)
+
+    def test_revoke_another_admins_access(self):
+        other = User.objects.create_user(email="other@example.com", password="pw-secret-123", is_staff=True)
+
+        self.client.post(reverse("controlpanel:admin_revoke", args=[other.pk]))
+
+        other.refresh_from_db()
+        self.assertFalse(other.is_staff)
+        self.assertFalse(other.is_superuser)
+
+    # --- guardrails: it must be impossible to lock the platform out of itself ---
+    def test_cannot_revoke_your_own_access(self):
+        response = self.client.post(reverse("controlpanel:admin_revoke", args=[self.root.pk]), follow=True)
+
+        self.root.refresh_from_db()
+        self.assertTrue(self.root.is_superuser)
+        self.assertContains(response, "cannot remove your own platform access")
+
+    def test_cannot_remove_your_own_superuser_rights(self):
+        # Keep another superuser around so this is blocked by the self-rule, not
+        # by the last-superuser rule.
+        User.objects.create_superuser(email="spare@example.com", password="pw-secret-123")
+
+        response = self.client.post(reverse("controlpanel:admin_update", args=[self.root.pk]), {"is_staff": "1", "is_superuser": "0"}, follow=True)
+
+        self.root.refresh_from_db()
+        self.assertTrue(self.root.is_superuser)
+        self.assertContains(response, "cannot remove your own superuser rights")
+
+    def test_the_last_superuser_cannot_be_demoted(self):
+        other = User.objects.create_superuser(email="other@example.com", password="pw-secret-123")
+        # Now demote self is blocked by the self-rule; demote `other` is fine...
+        self.client.post(reverse("controlpanel:admin_update", args=[other.pk]), {"is_staff": "1", "is_superuser": "0"})
+        other.refresh_from_db()
+        self.assertFalse(other.is_superuser)
+
+        # ...leaving root as the last superuser, who now cannot be demoted by anyone.
+        self.assertTrue(is_last_superuser(self.root))
+        with self.assertRaises(PlatformAdminError):
+            set_platform_access(other, self.root, is_staff=True, is_superuser=False)
+
+    def test_last_superuser_rule_is_enforced_for_other_actors_too(self):
+        response = self.client.post(reverse("controlpanel:admin_revoke", args=[self.root.pk]), follow=True)
+
+        self.root.refresh_from_db()
+        self.assertTrue(self.root.is_superuser)
+        self.assertContains(response, "cannot remove your own platform access")
+
+
+class FeatureViewTests(ControlPanelTestBase):
+    def setUp(self):
+        super().setUp()
+        cache.clear()
+        self.addCleanup(cache.clear)
+        self.flag = Flag.objects.create(name="shop")
+
+    def test_features_page_lists_flags_and_switches(self):
+        Switch.objects.create(name="maintenance", active=False)
+
+        response = self.client.get(reverse("controlpanel:features"))
+
+        self.assertContains(response, "shop")
+        self.assertContains(response, "maintenance")
+
+    def test_the_everyone_field_renders_as_a_populated_dropdown(self):
+        # Regression: NullBooleanField has no .choices on the field itself (only
+        # on field.widget.choices) -- the shared form_field templatetag read the
+        # wrong attribute and silently rendered the "everyone" tri-state dropdown
+        # with zero <option> tags. See controlpanel/templates/templatetags/field.html.
+        response = self.client.get(reverse("controlpanel:features"))
+
+        self.assertContains(response, '<option value="unknown">Unknown</option>', html=True)
+        self.assertContains(response, '<option value="true">Yes</option>', html=True)
+        self.assertContains(response, '<option value="false">No</option>', html=True)
+
+    def test_the_flag_forms_are_post_only(self):
+        # Reachable only through a modal on the features page: there is no standalone
+        # template to render on a GET.
+        self.assertEqual(self.client.get(reverse("controlpanel:flag_create")).status_code, 405)
+        self.assertEqual(self.client.get(reverse("controlpanel:flag_update", args=[self.flag.pk])).status_code, 405)
+
+    def test_an_invalid_flag_submission_redirects_with_a_message(self):
+        response = self.client.post(reverse("controlpanel:flag_create"), {"name": "", "note": "", "percent": "", "everyone": ""}, follow=True)
+
+        self.assertRedirects(response, reverse("controlpanel:features"))
+        self.assertContains(response, "This field is required")
+
+    def test_create_a_flag(self):
+        self.client.post(reverse("controlpanel:flag_create"), {"name": "news", "note": "News module", "percent": "", "everyone": ""})
+
+        self.assertTrue(Flag.objects.filter(name="news").exists())
+
+    def test_edit_a_flag(self):
+        self.client.post(reverse("controlpanel:flag_update", args=[self.flag.pk]), {"name": "shop", "note": "Webshop", "percent": "", "everyone": ""})
+
+        self.flag.refresh_from_db()
+        self.assertEqual(self.flag.note, "Webshop")
+
+    def test_toggle_a_feature_on_and_off_for_a_club(self):
+        url = reverse("controlpanel:club_feature_toggle", args=[self.club.pk, self.flag.pk])
+
+        self.client.post(url)
+        self.assertTrue(self.flag.clubs.filter(pk=self.club.pk).exists())
+
+        self.client.post(url)
+        self.assertFalse(self.flag.clubs.filter(pk=self.club.pk).exists())
+
+    def test_toggle_a_switch(self):
+        switch = Switch.objects.create(name="maintenance", active=False)
+
+        self.client.post(reverse("controlpanel:switch_toggle", args=[switch.pk]))
+
+        switch.refresh_from_db()
+        self.assertTrue(switch.active)
+
+    def test_club_detail_offers_a_toggle_per_feature(self):
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "shop")
+        self.assertContains(response, reverse("controlpanel:club_feature_toggle", args=[self.club.pk, self.flag.pk]))
+
+    def test_an_everyone_flag_shows_a_badge_instead_of_a_club_toggle(self):
+        # `everyone` overrides club targeting, so offering a per-club toggle would lie.
+        self.flag.everyone = True
+        self.flag.save()
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "On for all clubs")
+        self.assertNotContains(response, reverse("controlpanel:club_feature_toggle", args=[self.club.pk, self.flag.pk]))
+
+
+class NotifyTests(TestCase):
+    def request(self):
+        request = RequestFactory().get("/")
+        request.session = {}
+        storage = FallbackStorage(request)
+        request._messages = storage
+        return request, storage
+
+    def test_splits_level_title_and_body(self):
+        request, storage = self.request()
+
+        notify(request, "s|Club created|Ajax United is live.")
+
+        [message] = list(storage)
+        self.assertEqual(message.level, messages.SUCCESS)
+        self.assertEqual(message.extra_tags, "Club created")
+        self.assertEqual(message.message, "Ajax United is live.")
+
+    def test_maps_every_level_code_to_its_django_level(self):
+        self.assertEqual(LEVELS, {"s": messages.SUCCESS, "i": messages.INFO, "w": messages.WARNING, "e": messages.ERROR, "d": messages.DEBUG})
+
+    def test_a_pipe_inside_the_body_is_preserved_intact(self):
+        # maxsplit=2 stops after the level and the title, so a "|" a club/tier/flag name
+        # might contain stays part of the body rather than truncating it.
+        request, storage = self.request()
+
+        notify(request, "s|Title|Before | after.")
+
+        [message] = list(storage)
+        self.assertEqual(message.message, "Before | after.")
+
+    def test_an_empty_title_falls_back_to_the_generic_one_at_render_time(self):
+        request, storage = self.request()
+
+        notify(request, "s||No custom title.")
+
+        [message] = list(storage)
+        self.assertEqual(as_alert(message)["title"], "Done")
+
+
+class MessageAlertTests(TestCase):
+    def alert(self, level, text, extra_tags=None):
+        return as_alert(Message(level, text, extra_tags=extra_tags))
+
+    def test_each_level_gets_its_own_icon_title_and_colour(self):
+        self.assertEqual(self.alert(messages.SUCCESS, "Saved.")["icon"], "circle-check")
+        self.assertEqual(self.alert(messages.WARNING, "Careful.")["css"], "alert-warning border-warning")
+        self.assertEqual(self.alert(messages.ERROR, "Boom.")["title"], "Something went wrong")
+        self.assertEqual(self.alert(messages.INFO, "FYI.")["css"], "alert-info border-info")
+
+    def test_extra_tags_override_the_title(self):
+        alert = self.alert(messages.SUCCESS, "Ajax United is live.", extra_tags="Club created")
+
+        self.assertEqual(alert["title"], "Club created")
+        self.assertEqual(alert["body"], "Ajax United is live.")
+        self.assertEqual(alert["css"], "alert-success border-success")  # a custom title must not change the level
+
+    def test_an_unknown_level_falls_back_to_info(self):
+        self.assertEqual(self.alert(999, "Odd.")["css"], "alert-info border-info")
+
+
+class MessageRenderingTests(ControlPanelTestBase):
+    def test_a_message_renders_as_a_soft_alert_with_icon_and_title(self):
+        # club_archive queues its message through `notify`, which sets a custom title —
+        # so the generic per-level one ("Careful") must not show.
+        response = self.client.post(reverse("controlpanel:club_archive", args=[self.club.pk]), follow=True)
+
+        self.assertContains(response, "alert alert-soft border-2 alert-warning border-warning")
+        self.assertContains(response, '<div class="font-bold">Club archived</div>', html=False)
+        self.assertContains(response, "<svg")  # the lucide icon
+
+
+class FieldRenderingTests(TestCase):
+    def field(self, form_field, name="email", errors=False):
+        class Form(forms.Form):
+            pass
+
+        Form.base_fields[name] = form_field
+        form = Form(data={} if errors else None)
+        if errors:
+            form.full_clean()
+        return form[name]
+
+    def test_known_fields_get_an_icon_and_others_do_not(self):
+        self.assertEqual(field_icon(self.field(forms.EmailField(), "email")), "mail")
+        self.assertEqual(field_icon(self.field(forms.CharField(), "password")), "lock-keyhole")
+        self.assertEqual(field_icon(self.field(forms.CharField(), "note")), "")
+
+    def test_the_default_rendering_styles_the_input_itself(self):
+        self.assertIn('class="input input-bordered w-full"', str(daisy(self.field(forms.CharField()))))
+
+    def test_an_override_replaces_the_daisy_classes(self):
+        # The icon layout puts `input` on the wrapping label, so the input must not
+        # carry it too — that would draw a box inside a box.
+        rendered = str(daisy(self.field(forms.CharField()), "grow"))
+
+        self.assertIn('class="grow"', rendered)
+        self.assertNotIn("input-bordered", rendered)
+
+    def test_an_override_leaves_the_error_state_to_the_wrapper(self):
+        rendered = str(daisy(self.field(forms.CharField(required=True), errors=True), "grow"))
+
+        self.assertNotIn("grow-error", rendered)
+
+    def test_the_default_rendering_marks_errors_on_the_input(self):
+        rendered = str(daisy(self.field(forms.CharField(required=True), errors=True)))
+
+        self.assertIn("input-error", rendered)
+
+
+class LoginFormRenderingTests(TestCase):
+    def setUp(self):
+        self.response = self.client.get(reverse("account_login"))
+
+    def test_the_fields_carry_an_icon_and_no_visible_label(self):
+        self.assertContains(self.response, 'class="sr-only">Email</span>')
+        self.assertContains(self.response, 'class="sr-only">Password</span>')
+        self.assertNotContains(self.response, '<span class="label-text">Email</span>')
+        self.assertContains(self.response, 'placeholder="Email address"')
+
+    def test_the_checkbox_keeps_its_visible_label(self):
+        self.assertContains(self.response, '<span class="label-text">Remember Me</span>')
+
+    def test_the_password_reset_link_is_spaced_and_addressable(self):
+        # The input's aria-describedby points here; without the id it dangles.
+        self.assertContains(self.response, 'id="id_password_helptext"')
+        self.assertContains(self.response, "mt-3")
+        self.assertContains(self.response, "Forgot your password?")
+
+
+class LoginLayoutTests(TestCase):
+    def setUp(self):
+        self.response = self.client.get(reverse("account_login"))
+
+    def test_remember_me_is_laid_out_by_the_page_not_the_fields_element(self):
+        # It sits on the button row, so the fields element must not also render it.
+        self.assertEqual(self.response.content.count(b'name="remember"'), 1)
+        self.assertContains(self.response, '<span class="label-text">Remember Me</span>')
+
+    def test_the_passkey_button_sits_beside_sign_in(self):
+        self.assertContains(self.response, "btn btn-accent")
+        self.assertContains(self.response, "Sign in with a passkey")
+
+    def test_the_passkey_button_has_a_form_to_submit(self):
+        # The button posts to the hidden `mfa_login` form via its `form` attribute. That
+        # form comes from allauth's extra_body block — without it the button is dead.
+        self.assertContains(self.response, 'form="mfa_login"')
+        self.assertContains(self.response, 'id="mfa_login"')
+        self.assertContains(self.response, "allauth.webauthn.forms.loginForm")
+
+
+class ExcludedFilterTests(TestCase):
+    def field(self, name):
+        class Form(forms.Form):
+            pass
+
+        Form.base_fields[name] = forms.CharField()
+        return Form()[name]
+
+    def test_a_field_is_excluded_by_exact_name(self):
+        self.assertTrue(excluded(self.field("remember"), "remember"))
+
+    def test_a_name_that_merely_contains_another_is_not_excluded(self):
+        # A substring test would drop "password" when excluding "password2".
+        self.assertFalse(excluded(self.field("password"), "password2,remember"))
+
+    def test_nothing_is_excluded_without_a_list(self):
+        self.assertFalse(excluded(self.field("remember"), None))
+
+
+class PlatformAttentionTests(TestCase):
+    """The numbers that are supposed to be zero."""
+
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        self.today = timezone.localdate()
+
+    def season(self, club, start, end):
+        return Season.objects.create(club=club, start_date=start, end_date=end)
+
+    def test_a_club_with_no_season_covering_today_is_flagged(self):
+        self.assertIn(self.club, clubs_without_a_season())
+
+        self.season(self.club, self.today - datetime.timedelta(days=10), self.today + datetime.timedelta(days=10))
+
+        self.assertNotIn(self.club, clubs_without_a_season())
+
+    def test_a_past_season_does_not_count_as_a_current_one(self):
+        self.season(self.club, self.today - datetime.timedelta(days=400), self.today - datetime.timedelta(days=40))
+
+        self.assertIn(self.club, clubs_without_a_season())
+
+    def test_an_archived_club_is_not_chased(self):
+        self.club.archive()
+
+        self.assertNotIn(self.club, clubs_without_a_season())
+        self.assertNotIn(self.club, dormant_clubs())
+
+    def test_a_club_with_nothing_scheduled_is_dormant(self):
+        self.assertIn(self.club, dormant_clubs())
+
+        Event.objects.create(club=self.club, title="Training", start=timezone.now() + datetime.timedelta(days=3))
+
+        self.assertNotIn(self.club, dormant_clubs())
+
+    def test_an_event_beyond_the_horizon_does_not_wake_a_club(self):
+        Event.objects.create(club=self.club, title="Far off", start=timezone.now() + datetime.timedelta(days=90))
+
+        self.assertIn(self.club, dormant_clubs())
+
+    def test_a_past_event_does_not_wake_a_club(self):
+        Event.objects.create(club=self.club, title="Gone", start=timezone.now() - datetime.timedelta(days=3))
+
+        self.assertIn(self.club, dormant_clubs())
+
+
+class MfaPendingTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+
+    def test_staff_without_a_second_factor_are_pending(self):
+        user = User.objects.create_user(email="staff@example.com", password="pw-secret-123", is_staff=True)
+
+        self.assertIn(user, admins_pending_mfa())
+
+        enrol_mfa(user)
+
+        self.assertNotIn(user, admins_pending_mfa())
+
+    def test_a_club_admin_without_a_second_factor_is_pending(self):
+        # They are locked out until they enrol, so this is a support queue.
+        user = User.objects.create_user(email="admin@example.com", password="pw-secret-123")
+        member = Member.objects.create(first_name="Ada", last_name="Lovelace", user=user)
+        ClubRole.objects.create(club=self.club, member=member, role=ClubRole.Roles.ADMIN)
+
+        self.assertIn(user, admins_pending_mfa())
+
+    def test_an_ordinary_member_is_not_chased(self):
+        user = User.objects.create_user(email="member@example.com", password="pw-secret-123")
+        member = Member.objects.create(first_name="Bob", last_name="Bobson", user=user)
+        ClubRole.objects.create(club=self.club, member=member, role=ClubRole.Roles.MEMBER)
+
+        self.assertNotIn(user, admins_pending_mfa())
+
+    def test_each_pending_admin_is_counted_once(self):
+        # Two elevated roles in two clubs is still one person to chase.
+        other = Club.objects.create(name="Feyenoord")
+        user = User.objects.create_user(email="admin@example.com", password="pw-secret-123", is_staff=True)
+        member = Member.objects.create(first_name="Ada", last_name="Lovelace", user=user)
+        ClubRole.objects.create(club=self.club, member=member, role=ClubRole.Roles.ADMIN)
+        ClubRole.objects.create(club=other, member=member, role=ClubRole.Roles.EDITOR)
+
+        self.assertEqual(admins_pending_mfa().count(), 1)
+
+
+class OnboardingFunnelTests(TestCase):
+    def test_the_funnel_narrows_as_clubs_stall(self):
+        empty = Club.objects.create(name="Empty FC")  # noqa: F841 — a shell, counted only at step one
+        with_member = Club.objects.create(name="Members FC")
+        season = Season.objects.create(club=with_member, start_date=timezone.localdate(), end_date=timezone.localdate() + datetime.timedelta(days=30))
+        member = Member.objects.create(first_name="Ada", last_name="Lovelace")
+        ClubMembership.objects.create(club=with_member, season=season, member=member)
+
+        steps = {step["label"]: step["count"] for step in onboarding_funnel()}
+
+        self.assertEqual(steps["Clubs"], 2)
+        self.assertEqual(steps["With members"], 1)
+        self.assertEqual(steps["With a team"], 0)
+        self.assertEqual(steps["With events"], 0)
+
+
+class FlagAdoptionTests(TestCase):
+    def setUp(self):
+        cache.clear()
+        self.addCleanup(cache.clear)
+        self.club = Club.objects.create(name="Ajax United")
+
+    def test_clubs_are_counted_per_flag(self):
+        # Not an exact-list assertion: migration 0018 seeds real "CEHL"/"RBIHF"
+        # flags for the built-in competitions, so a fresh test database is never
+        # actually flag-free.
+        flag = Flag.objects.create(name="shop")
+        flag.clubs.add(self.club)
+
+        self.assertIn({"name": "shop", "clubs": 1, "everyone": None, "overridden": False}, flag_adoption())
+
+    def test_an_everyone_flag_reports_itself_as_overridden(self):
+        # `everyone` beats club targeting, so the club count would be a lie.
+        Flag.objects.create(name="shop", everyone=True)
+
+        shop_entry = next(entry for entry in flag_adoption() if entry["name"] == "shop")
+        self.assertTrue(shop_entry["overridden"])
+
+
+class PlatformChartTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        self.season = Season.objects.create(club=self.club, start_date=timezone.localdate(), end_date=timezone.localdate() + datetime.timedelta(days=30))
+        self.member = Member.objects.create(first_name="Ada", last_name="Lovelace")
+
+    def test_the_series_is_dense(self):
+        # Zero-filled: a chart that skips empty months draws a smooth line over a month
+        # in which nothing happened.
+        series = platform_charts()["signups"]
+
+        self.assertEqual(len(series), 13)
+        self.assertTrue(all(point["new"] == 0 and point["returning"] == 0 for point in series))
+
+    def test_the_series_stays_dense_on_a_late_day_of_the_month(self):
+        # A 30-days-per-month approximation of "12 months ago" drifts by a few days a
+        # year, and on the tail end of a month that drift used to fall short of a full
+        # calendar month, silently dropping the series to 12 points instead of 13.
+        late_month_day = timezone.now().replace(day=28)
+
+        with mock.patch.object(timezone, "now", return_value=late_month_day):
+            series = platform_charts()["signups"]
+
+        self.assertEqual(len(series), 13)
+
+    def test_signups_land_in_the_month_they_happened(self):
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member, signed_up_at=timezone.localdate())
+
+        series = platform_charts()["signups"]
+
+        self.assertEqual(series[-1]["new"], 1)
+
+    def test_new_is_per_club_not_per_platform(self):
+        # A veteran of one club joining a second is new *there*. Keying "first season" on the
+        # member alone would file their very first signup at the new club as a renewal.
+        other = Club.objects.create(name="Feyenoord")
+        old_season = Season.objects.create(club=other, start_date=timezone.localdate() - datetime.timedelta(days=400), end_date=timezone.localdate() - datetime.timedelta(days=40))
+        ClubMembership.objects.create(club=other, season=old_season, member=self.member, signed_up_at=timezone.localdate() - datetime.timedelta(days=300))
+        ClubMembership.objects.create(club=self.club, season=self.season, member=self.member, signed_up_at=timezone.localdate())
+
+        self.assertEqual(platform_charts()["signups"][-1]["new"], 1)
+
+    def test_only_paid_orders_count_as_club_revenue(self):
+        # `club_revenue` is members paying their clubs. It is NOT platform income, which is
+        # why it no longer shares a chart (or a name) with our dues.
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("50.00"), status=Order.OrderStatus.PAID)
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("30.00"), status=Order.OrderStatus.PENDING)
+
+        self.assertEqual(platform_charts()["club_revenue"][-1]["value"], 50.0)
+        self.assertEqual(platform_attention()["outstanding"], Decimal("30.00"))
+
+
+class DashboardMetricsTests(ControlPanelTestBase):
+    def test_the_dashboard_renders_its_metrics_and_charts(self):
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        self.assertContains(response, "No current season")
+        self.assertContains(response, "MFA pending")
+        self.assertContains(response, "Payment pending")
+        self.assertContains(response, 'id="signups-chart"')
+        self.assertContains(response, "js/chart.js")
+        self.assertIn("signups", response.context["charts"])
+
+
+class ClubAttentionTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        self.today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=30), end_date=self.today + datetime.timedelta(days=300))
+        self.member = Member.objects.create(first_name="Ada", last_name="Lovelace")
+
+    def membership(self, member=None, season=None, **kwargs):
+        return ClubMembership.objects.create(club=self.club, season=season or self.season, member=member or self.member, **kwargs)
+
+    def test_a_team_with_no_manager_is_flagged(self):
+        team = Team.objects.create(club=self.club, name="U15")
+
+        self.assertIn(team, teams_without_a_manager(self.club, self.season))
+
+        coach = Position.objects.create(club=self.club, name="Coach", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=self.member, season=self.season, position=coach)
+
+        self.assertNotIn(team, teams_without_a_manager(self.club, self.season))
+
+    def test_a_non_management_staffer_does_not_count_as_a_coach(self):
+        # Somebody has to be able to pick the squad; a physio cannot.
+        team = Team.objects.create(club=self.club, name="U15")
+        physio = Position.objects.create(club=self.club, name="Physio", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=team, member=self.member, season=self.season, position=physio)
+
+        self.assertIn(team, teams_without_a_manager(self.club, self.season))
+
+    def test_a_coach_from_a_previous_season_does_not_count(self):
+        old = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=400), end_date=self.today - datetime.timedelta(days=40))
+        team = Team.objects.create(club=self.club, name="U15")
+        coach = Position.objects.create(club=self.club, name="Coach", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=self.member, season=old, position=coach)
+
+        self.assertIn(team, teams_without_a_manager(self.club, self.season))
+
+    def test_an_active_member_on_no_team_is_unrostered(self):
+        self.membership(status=ClubMembership.StatusChoices.ACTIVE)
+
+        self.assertIn(self.member, unrostered_members(self.club, self.season))
+
+        team = Team.objects.create(club=self.club, name="U15")
+        position = Position.objects.create(club=self.club, name="Forward")
+        TeamMembership.objects.create(team=team, member=self.member, season=self.season, position=position, jersey_number=9)
+
+        self.assertNotIn(self.member, unrostered_members(self.club, self.season))
+
+    def test_a_pending_member_is_not_counted_as_unrostered(self):
+        # They have not been let in yet, so having no team is expected.
+        self.membership(status=ClubMembership.StatusChoices.PENDING)
+
+        self.assertNotIn(self.member, unrostered_members(self.club, self.season))
+
+    def test_renewal_compares_against_the_previous_season(self):
+        previous = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=400), end_date=self.today - datetime.timedelta(days=40))
+        stayed = self.member
+        left = Member.objects.create(first_name="Bob", last_name="Bobson")
+        self.membership(member=stayed, season=previous, status=ClubMembership.StatusChoices.ACTIVE)
+        self.membership(member=left, season=previous, status=ClubMembership.StatusChoices.ACTIVE)
+        self.membership(member=stayed, season=self.season)
+
+        self.assertEqual(renewal_rate(self.club, self.season), 50)
+
+    def test_a_previous_season_with_nobody_active_yields_no_rate(self):
+        # There is a season to compare against but nobody to renew — dividing by that
+        # would blow up, and calling it 0% would be a lie.
+        previous = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=400), end_date=self.today - datetime.timedelta(days=40))
+        self.membership(season=previous, status=ClubMembership.StatusChoices.LAPSED)
+
+        self.assertIsNone(renewal_rate(self.club, self.season))
+
+    def test_a_first_season_club_has_no_renewal_rate(self):
+        # It has not failed to renew anyone; rendering that as 0% would libel it.
+        self.membership(status=ClubMembership.StatusChoices.ACTIVE)
+
+        self.assertIsNone(renewal_rate(self.club, self.season))
+
+    def test_unpaid_orders_are_bucketed_by_age(self):
+        old = Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("100.00"), status=Order.OrderStatus.PENDING)
+        Order.objects.filter(pk=old.pk).update(created=timezone.now() - datetime.timedelta(days=90))
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("40.00"), status=Order.OrderStatus.PENDING)
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("999.00"), status=Order.OrderStatus.PAID)
+
+        buckets = {bucket["label"]: bucket["total"] for bucket in fee_aging(self.club)}
+
+        self.assertEqual(buckets["0-30 days"], Decimal("40.00"))
+        self.assertEqual(buckets["60+ days"], Decimal("100.00"))  # paid orders are not owed
+
+    def test_attendance_is_turnout_of_those_who_answered(self):
+        event = Event.objects.create(club=self.club, season=self.season, title="Match", start=timezone.now() - datetime.timedelta(days=1))
+        bob = Member.objects.create(first_name="Bob", last_name="Bobson")
+        carol = Member.objects.create(first_name="Carol", last_name="Carolson")
+        Attendance.objects.create(event=event, member=self.member, status=Attendance.AttendanceStatus.PRESENT)
+        Attendance.objects.create(event=event, member=bob, status=Attendance.AttendanceStatus.ABSENT)
+        Attendance.objects.create(event=event, member=carol, status=Attendance.AttendanceStatus.NO_RESPONSE)
+
+        rates = attendance_rates(self.club, self.season)
+
+        self.assertEqual(rates["turnout"], 50)  # 1 present of 2 who answered — silence is not an absence
+        self.assertEqual(rates["no_response"], 33)  # 1 of 3 never answered
+
+    def test_a_future_event_does_not_drag_turnout_down(self):
+        event = Event.objects.create(club=self.club, season=self.season, title="Next week", start=timezone.now() + datetime.timedelta(days=7))
+        Attendance.objects.create(event=event, member=self.member, status=Attendance.AttendanceStatus.NO_RESPONSE)
+
+        self.assertIsNone(attendance_rates(self.club, self.season)["turnout"])
+
+    def test_a_club_with_no_season_reports_no_rates(self):
+        Season.objects.all().delete()
+
+        attention = club_attention(self.club)
+
+        self.assertTrue(attention["no_season"])
+        self.assertEqual(attention["teams_without_manager"], 0)
+        self.assertIsNone(attention["renewal_rate"])
+
+
+class ClubDetailMetricsTests(ControlPanelTestBase):
+    def test_the_club_page_renders_its_metrics_and_charts(self):
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "Teams without coach")
+        self.assertContains(response, "Unrostered")
+        self.assertContains(response, "Club fee status this season")
+        self.assertContains(response, 'id="fees-chart"')
+        self.assertIn("fees", response.context["charts"])
+
+    def test_a_club_without_a_season_is_told_it_is_inert(self):
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "cannot take a signup")
+
+    def test_a_club_logo_gets_a_primary_coloured_ring(self):
+        # The control panel never injects a page-wide --color-primary override (that would
+        # dress the whole panel up as the club), so the ring colour is scoped locally to
+        # this element instead — assert the club's own colour reaches it regardless.
+        self.club.logo = "clubs/ajax-united/crest.png"
+        self.club.primary_color = "#1e40af"
+        self.club.save()
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "ring-primary")
+        self.assertContains(response, "--color-primary: #1e40af")
+
+
+class NewMemberTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United")
+        self.today = timezone.localdate()
+        self.previous = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=400), end_date=self.today - datetime.timedelta(days=40))
+        self.season = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=30), end_date=self.today + datetime.timedelta(days=300))
+        self.veteran = Member.objects.create(first_name="Ada", last_name="Lovelace")
+        self.rookie = Member.objects.create(first_name="Bob", last_name="Bobson")
+
+    def membership(self, member, season, signed_up_at=None):
+        return ClubMembership.objects.create(club=self.club, season=season, member=member, status=ClubMembership.StatusChoices.ACTIVE, signed_up_at=signed_up_at)
+
+    def test_only_first_timers_count_as_new(self):
+        self.membership(self.veteran, self.previous)
+        self.membership(self.veteran, self.season)
+        self.membership(self.rookie, self.season)
+
+        new = new_members(self.club, self.season)
+
+        self.assertIn(self.rookie, new)
+        self.assertNotIn(self.veteran, new)
+
+    def test_a_member_returning_after_a_gap_is_not_new(self):
+        # They skipped a season and came back. Counting that as growth would flatter every
+        # recovery; they are a renewal.
+        self.membership(self.veteran, self.previous)
+        gap = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=39), end_date=self.today - datetime.timedelta(days=31))  # noqa: F841
+        self.membership(self.veteran, self.season)
+
+        self.assertNotIn(self.veteran, new_members(self.club, self.season))
+
+    def test_a_member_of_another_club_is_new_here(self):
+        # "New" is per club, not per platform.
+        other = Club.objects.create(name="Feyenoord")
+        other_season = Season.objects.create(club=other, start_date=self.today - datetime.timedelta(days=400), end_date=self.today - datetime.timedelta(days=40))
+        ClubMembership.objects.create(club=other, season=other_season, member=self.rookie)
+        self.membership(self.rookie, self.season)
+
+        self.assertIn(self.rookie, new_members(self.club, self.season))
+
+    def test_a_club_with_no_season_has_no_new_members(self):
+        self.assertEqual(new_members(self.club, None).count(), 0)
+
+    def test_signups_are_split_by_month_into_new_and_returning(self):
+        self.membership(self.veteran, self.previous, signed_up_at=self.today - datetime.timedelta(days=200))
+        self.membership(self.veteran, self.season, signed_up_at=self.today)
+        self.membership(self.rookie, self.season, signed_up_at=self.today)
+
+        this_month = signup_split(self.club)[-1]
+
+        self.assertEqual(this_month["new"], 1)  # the rookie
+        self.assertEqual(this_month["returning"], 1)  # the veteran renewing
+
+    def test_a_first_ever_signup_counts_as_new_in_its_own_month(self):
+        self.membership(self.veteran, self.previous, signed_up_at=self.today - datetime.timedelta(days=200))
+
+        series = signup_split(self.club)
+
+        self.assertEqual(sum(month["new"] for month in series), 1)
+        self.assertEqual(sum(month["returning"] for month in series), 0)
+
+
+class ClubHealthTableTests(TestCase):
+    def setUp(self):
+        self.today = timezone.localdate()
+        self.club = Club.objects.create(name="Ajax United")
+        self.season = Season.objects.create(club=self.club, start_date=self.today - datetime.timedelta(days=30), end_date=self.today + datetime.timedelta(days=300))
+        self.member = Member.objects.create(first_name="Ada", last_name="Lovelace")
+
+    def health(self):
+        return clubs_with_health().get(pk=self.club.pk)
+
+    def test_the_whole_table_costs_one_query(self):
+        Club.objects.create(name="Feyenoord")
+
+        with self.assertNumQueries(1):
+            [(club.active_members, club.outstanding, club.teams_without_coach) for club in clubs_with_health()]
+
+    def test_money_is_not_inflated_by_other_joins(self):
+        # The reason each aggregate is its own subquery: a Sum and a Count spanning different
+        # joins multiply each other's rows, and the club's debt comes back doubled for every
+        # membership it happens to have.
+        for name in ("Bob", "Carol", "Dave"):
+            member = Member.objects.create(first_name=name, last_name="Bobson")
+            ClubMembership.objects.create(club=self.club, season=self.season, member=member, status=ClubMembership.StatusChoices.ACTIVE)
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("100.00"), status=Order.OrderStatus.PENDING)
+
+        health = self.health()
+
+        self.assertEqual(health.outstanding, Decimal("100.00"))  # not 300.00
+        self.assertEqual(health.active_members, 3)
+
+    def test_a_club_reports_its_missing_coaches(self):
+        Team.objects.create(club=self.club, name="U15")
+        managed = Team.objects.create(club=self.club, name="U17")
+        coach = Position.objects.create(club=self.club, name="Coach", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=managed, member=self.member, season=self.season, position=coach)
+
+        health = self.health()
+
+        self.assertEqual(health.team_count, 2)
+        self.assertEqual(health.teams_without_coach, 1)
+
+    def test_a_club_with_no_season_and_no_events_is_marked(self):
+        Season.objects.all().delete()
+
+        health = self.health()
+
+        self.assertFalse(health.has_season)
+        self.assertEqual(health.upcoming_events, 0)
+
+    def test_upcoming_events_only_count_the_next_thirty_days(self):
+        Event.objects.create(club=self.club, title="Soon", start=timezone.now() + datetime.timedelta(days=3))
+        Event.objects.create(club=self.club, title="Far", start=timezone.now() + datetime.timedelta(days=90))
+
+        self.assertEqual(self.health().upcoming_events, 1)
+
+    def test_the_dashboard_table_shows_health_not_vanity(self):
+        user = User.objects.create_user(email="root@example.com", password="pw-secret-123", is_staff=True)
+        enrol_mfa(user)
+        self.client.force_login(user)
+
+        response = self.client.get(reverse("controlpanel:dashboard"))
+
+        # Health, not vanity: Plan and Dues each name something to act on, next to the counts.
+        for column in ("Members", "Admins", "Teams", "Events", "Plan", "Dues"):
+            self.assertContains(response, f">{column}</th>")
+
+
+class ClubListHealthTests(ControlPanelTestBase):
+    def test_the_list_shows_the_same_health_columns_as_the_dashboard(self):
+        response = self.client.get(reverse("controlpanel:club_list"))
+
+        for column in ("Members", "Admins", "Teams", "Events", "Plan", "Dues"):
+            self.assertContains(response, f">{column}</th>")
+        self.assertTemplateUsed(response, "controlpanel/_club_health_table.html")
+
+    def test_an_archived_club_is_badged_archived_rather_than_dormant(self):
+        # Its subdomain does not resolve, so "nothing scheduled" is not news.
+        self.club.archive()
+
+        response = self.client.get(reverse("controlpanel:club_list"), {"archived": "1"})
+
+        self.assertContains(response, "Archived")
+        self.assertNotContains(response, "Dormant")
+
+    def test_searching_keeps_the_health_annotations(self):
+        response = self.client.get(reverse("controlpanel:club_list"), {"q": "Ajax"})
+
+        club = response.context["clubs"][0]
+
+        self.assertEqual(club.active_members, 0)
+        self.assertEqual(club.teams_without_coach, 0)
+
+    def test_the_list_does_not_fan_out_per_club(self):
+        for name in ("Feyenoord", "PSV", "Twente"):
+            Club.objects.create(name=name)
+
+        with self.assertNumQueries(1):
+            [(club.outstanding, club.upcoming_events) for club in clubs_with_health()]
+
+
+class TemplateCommentTests(TestCase):
+    def test_no_template_uses_a_multiline_hash_comment(self):
+        """Django's {# #} is single-line only — its lexer regex is not DOTALL, so a
+        multi-line one is not a comment at all: it renders to the page as text."""
+        templates = [path for path in pathlib.Path(settings.BASE_DIR).glob("**/templates/**/*.html") if ".venv" not in path.parts and "node_modules" not in path.parts]
+        offenders = [f"{path.relative_to(settings.BASE_DIR)}:{number}" for path in templates for number, line in enumerate(path.read_text().splitlines(), start=1) if "{#" in line and "#}" not in line]
+
+        self.assertTrue(templates)  # the glob must actually be finding our templates
+        self.assertEqual(offenders, [], "use {% comment %} for multi-line comments")
+
+
+class PlatformDuesMetricTests(TestCase):
+    """What the clubs owe US — kept strictly apart from what members owe their clubs."""
+
+    def setUp(self):
+        self.today = timezone.localdate()
+        self.club = Club.objects.create(name="Ajax United")
+        self.tier = Tier.objects.create(name="Standard")
+        TierPrice.objects.create(tier=self.tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def test_dues_owed_is_the_unpaid_balance_across_every_club(self):
+        subscribe(self.club, self.tier)
+        record_payment(self.club.dues.first(), Decimal("200.00"))
+
+        self.assertEqual(platform_attention()["dues_owed"], Decimal("300.00"))
+
+    def test_grace_and_overdue_are_counted_separately(self):
+        in_grace = Club.objects.create(name="Grace FC")
+        overdue = Club.objects.create(name="Overdue FC")
+        subscribe(in_grace, self.tier, start=self.today - datetime.timedelta(days=370))
+        subscribe(overdue, self.tier, start=self.today - datetime.timedelta(days=365 + GRACE_DAYS + 10))
+
+        attention = platform_attention()
+
+        self.assertEqual(attention["dues_in_grace"], 1)
+        self.assertEqual(attention["dues_overdue"], 1)
+
+    def test_clubs_on_no_tier_are_flagged(self):
+        self.assertEqual(platform_attention()["clubs_unbilled"], 1)
+
+        subscribe(self.club, self.tier)
+
+        self.assertEqual(platform_attention()["clubs_unbilled"], 0)
+
+    def test_renewals_pending_counts_clubs_about_to_lapse(self):
+        # ~0 in normal running; a number here means the renewal cron has stopped.
+        self.assertEqual(platform_attention()["renewals_pending"], 0)
+
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=350))  # ends in 15 days
+
+        self.assertEqual(platform_attention()["renewals_pending"], 1)
+
+    def test_the_dashboard_surfaces_pending_renewals(self):
+        # The whole point of the KPI: a club about to go free is visible, though nothing is
+        # owed yet, so no other figure on the page would show it.
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=350))
+        staff = User.objects.create_user(email="staff@example.com", password="pw-secret-123", is_staff=True)
+        enrol_mfa(staff)
+        self.client.force_login(staff)
+
+        self.assertContains(self.client.get(reverse("controlpanel:dashboard")), "awaiting renewal")
+
+    def test_platform_dues_and_club_shop_money_are_different_charts(self):
+        subscribe(self.club, self.tier)
+        record_payment(self.club.dues.first(), Decimal("500.00"))
+
+        charts = platform_charts()
+
+        self.assertEqual(charts["dues"][-1]["value"], 500.0)
+        self.assertEqual(charts["club_revenue"][-1]["value"], 0.0)  # never ours
+
+    def test_the_health_table_carries_the_plan_and_what_is_owed(self):
+        subscribe(self.club, self.tier)
+
+        club = clubs_with_health().get(pk=self.club.pk)
+
+        self.assertEqual(club.tier_name, "Standard")
+        self.assertEqual(club.dues_owed, Decimal("500.00"))
+
+    def test_a_fully_paid_club_shows_when_its_cover_ends(self):
+        # The end of the current paid period is the day grace would start if nothing renews.
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+        record_payment(due, due.amount)
+
+        club = clubs_with_health().get(pk=self.club.pk)
+
+        self.assertEqual(club.covered_until, due.period_end)
+        self.assertEqual(club.covered_status, Due.Status.PAID)
+
+    def test_a_waived_period_also_shows_its_cover_end(self):
+        # Waived is settled too — the club is covered for that time, so its end date shows,
+        # badged "waived" rather than "paid".
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+        waive(due)
+
+        club = clubs_with_health().get(pk=self.club.pk)
+
+        self.assertEqual(club.covered_until, due.period_end)
+        self.assertEqual(club.covered_status, Due.Status.WAIVED)
+
+    def test_a_club_that_owes_has_no_cover(self):
+        subscribe(self.club, self.tier)  # unpaid
+
+        club = clubs_with_health().get(pk=self.club.pk)
+        self.assertIsNone(club.covered_until)
+        self.assertIsNone(club.covered_status)
+
+    def test_the_health_table_still_costs_one_query_with_billing_on_it(self):
+        subscribe(self.club, self.tier)
+        subscribe(Club.objects.create(name="Feyenoord"), self.tier)
+
+        with self.assertNumQueries(1):
+            [(club.tier_name, club.dues_owed, club.outstanding) for club in clubs_with_health()]
+
+
+class BillingPanelTests(ControlPanelTestBase):
+    def setUp(self):
+        super().setUp()
+        self.today = timezone.localdate()
+        self.tier = Tier.objects.create(name="Standard")
+        TierPrice.objects.create(tier=self.tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def test_the_billing_page_lists_tiers_and_what_is_owed(self):
+        subscribe(self.club, self.tier)
+
+        response = self.client.get(reverse("controlpanel:billing"))
+
+        self.assertContains(response, "Standard")
+        self.assertContains(response, "500.00")
+
+    def test_a_tier_can_be_created_and_priced(self):
+        self.client.post(reverse("controlpanel:tier_create"), {"name": "Large", "description": "", "is_active": "on"})
+        tier = Tier.objects.get(name="Large")
+
+        self.client.post(reverse("controlpanel:tier_price_create", args=[tier.pk]), {"active_from": self.today.isoformat(), "amount": "900.00"})
+
+        self.assertEqual(tier.price_on(self.today), Decimal("900.00"))
+
+    def test_a_rate_change_does_not_rewrite_an_open_period(self):
+        subscribe(self.club, self.tier)
+
+        self.client.post(reverse("controlpanel:tier_price_create", args=[self.tier.pk]), {"active_from": self.today.isoformat(), "amount": "900.00"})
+
+        self.assertEqual(self.club.dues.first().amount, Decimal("500.00"))
+
+    def test_subscribing_a_club_opens_its_first_period(self):
+        self.client.post(reverse("controlpanel:club_subscribe", args=[self.club.pk]), {"tier": self.tier.pk, "auto_archive": "on", "notes": ""})
+
+        self.assertEqual(self.club.dues.count(), 1)
+        self.assertEqual(self.club.subscription.tier, self.tier)
+
+    def test_a_payment_can_be_recorded_and_settles_the_due(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        self.client.post(reverse("controlpanel:due_pay", args=[due.pk]), {"amount": "500.00", "method": "bank_transfer", "reference": "TRX-1", "paid_at": "", "note": ""})
+
+        due.refresh_from_db()
+        self.assertEqual(due.status, Due.Status.PAID)
+        self.assertEqual(due.payments.first().recorded_by, self.staff)
+
+    def test_a_part_payment_leaves_a_balance(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        self.client.post(reverse("controlpanel:due_pay", args=[due.pk]), {"amount": "200.00", "method": "bank_transfer", "reference": "", "paid_at": "", "note": ""})
+
+        due.refresh_from_db()
+        self.assertEqual(due.balance, Decimal("300.00"))
+
+    def test_a_billing_error_is_shown_rather_than_raised(self):
+        # A waived period cannot take a payment; the panel must say so, not 500.
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+        self.client.post(reverse("controlpanel:due_waive", args=[due.pk]))
+
+        response = self.client.post(reverse("controlpanel:due_pay", args=[due.pk]), {"amount": "50.00", "method": "cash", "reference": "", "paid_at": "", "note": ""}, follow=True)
+
+        self.assertContains(response, "cannot take a payment")
+
+    def test_a_period_can_be_waived(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        self.client.post(reverse("controlpanel:due_waive", args=[due.pk]))
+
+        due.refresh_from_db()
+        self.assertEqual(due.status, Due.Status.WAIVED)
+
+    def test_opening_a_period_continues_from_the_last_one(self):
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=400))
+        first = self.club.dues.first()
+
+        self.client.post(reverse("controlpanel:club_open_period", args=[self.club.pk]), {"start": ""})
+
+        latest = self.club.dues.order_by("-period_start").first()
+        self.assertEqual(latest.period_start, first.period_end + datetime.timedelta(days=1))
+
+    def test_reactivating_an_archived_club_restores_it(self):
+        subscribe(self.club, self.tier, start=self.today - datetime.timedelta(days=400))
+        self.club.archive()
+
+        self.client.post(reverse("controlpanel:club_open_period", args=[self.club.pk]), {"start": self.today.isoformat()})
+
+        self.club.refresh_from_db()
+        self.assertFalse(self.club.is_archived)
+
+    def test_the_club_page_shows_the_plan_and_its_periods(self):
+        subscribe(self.club, self.tier)
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "Standard")
+        self.assertContains(response, "INV-")
+
+    def test_an_invoice_downloads_as_a_pdf(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        with mock.patch("controlpanel.views.invoice_pdf", return_value=b"%PDF-1.7 fake"):
+            response = self.client.get(reverse("controlpanel:due_invoice", args=[due.pk]))
+
+        self.assertEqual(response["Content-Type"], "application/pdf")
+        self.assertIn(due.invoice.number, response["Content-Disposition"])
+
+    def test_a_missing_pdf_library_is_reported_rather_than_a_500(self):
+        # WeasyPrint needs native libs. Without them the button must explain itself.
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        with mock.patch("controlpanel.views.invoice_pdf", side_effect=BillingError("PDF rendering needs the native pango/cairo libraries.")):
+            response = self.client.get(reverse("controlpanel:due_invoice", args=[due.pk]), follow=True)
+
+        self.assertContains(response, "pango")
+
+
+class TrialPanelTests(ControlPanelTestBase):
+    """The club detail page's "Start trial" modal -- see
+    controlpanel.views.ClubStartTrialView / billing.services.dues.start_trial."""
+
+    def setUp(self):
+        super().setUp()
+        self.today = timezone.localdate()
+        self.trial_tier = Tier.objects.create(name="Trial")
+        TierPrice.objects.create(tier=self.trial_tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("50.00"))
+        self.tier = Tier.objects.create(name="Standard")
+        TierPrice.objects.create(tier=self.tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def start_trial(self, **data):
+        data = {"trial_tier": self.trial_tier.pk, "post_trial_tier": self.tier.pk, "trial_months": 2, "start": ""} | data
+        return self.client.post(reverse("controlpanel:club_trial_start", args=[self.club.pk]), data)
+
+    def test_starting_a_trial_opens_a_short_first_period(self):
+        response = self.start_trial()
+
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[self.club.pk]))
+        self.assertEqual(self.club.subscription.tier, self.trial_tier)
+        self.assertEqual(self.club.subscription.post_trial_tier, self.tier)
+        due = self.club.dues.first()
+        self.assertTrue(due.is_trial)
+        self.assertLess((due.period_end - due.period_start).days, 65)
+
+    def test_a_club_already_subscribed_cannot_be_started_on_a_trial(self):
+        subscribe(self.club, self.tier)
+
+        response = self.client.post(
+            reverse("controlpanel:club_trial_start", args=[self.club.pk]),
+            {"trial_tier": self.trial_tier.pk, "post_trial_tier": self.tier.pk, "trial_months": 2, "start": ""},
+            follow=True,
+        )
+
+        self.assertContains(response, "already subscribed")
+        self.assertEqual(self.club.dues.count(), 1)
+
+    def test_an_invalid_trial_length_redirects_back_with_an_error(self):
+        response = self.client.post(reverse("controlpanel:club_trial_start", args=[self.club.pk]), {"trial_tier": self.trial_tier.pk, "post_trial_tier": self.tier.pk, "trial_months": 0, "start": ""}, follow=True)
+
+        self.assertFalse(hasattr(self.club, "subscription"))
+        self.assertTrue(response.context["messages"])
+
+    def test_the_club_page_shows_the_active_trial(self):
+        self.start_trial()
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        self.assertContains(response, "On trial")
+        self.assertContains(response, "Standard")
+
+    def test_manually_changing_tier_mid_trial_clears_the_trial(self):
+        self.start_trial()
+        other = Tier.objects.create(name="Other")
+        TierPrice.objects.create(tier=other, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("300.00"))
+
+        self.client.post(reverse("controlpanel:club_subscribe", args=[self.club.pk]), {"tier": other.pk, "auto_archive": "on", "notes": ""})
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.subscription.tier, other)
+        self.assertIsNone(self.club.subscription.trial_ends_at)
+        self.assertIsNone(self.club.subscription.post_trial_tier)
+
+
+class BillingFormRenderTests(ControlPanelTestBase):
+    def setUp(self):
+        super().setUp()
+        self.today = timezone.localdate()
+        self.tier = Tier.objects.create(name="Standard")
+        TierPrice.objects.create(tier=self.tier, active_from=self.today - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def test_the_billing_forms_are_post_only(self):
+        # Every one of these is reachable only through a modal on the billing or club
+        # detail page: there is no standalone template to render on a GET.
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        for url in (
+            reverse("controlpanel:tier_create"),
+            reverse("controlpanel:tier_update", args=[self.tier.pk]),
+            reverse("controlpanel:tier_price_create", args=[self.tier.pk]),
+            reverse("controlpanel:club_subscribe", args=[self.club.pk]),
+            reverse("controlpanel:club_open_period", args=[self.club.pk]),
+            reverse("controlpanel:due_pay", args=[due.pk]),
+        ):
+            self.assertEqual(self.client.get(url).status_code, 405, url)
+
+    def test_the_billing_forms_redirect_with_a_message_on_invalid_input(self):
+        # Rejected input has nowhere to re-render — the modal that submitted it is on a
+        # page this view no longer serves — so it must bounce back with an error message
+        # rather than 500 or silently drop the submission.
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+
+        response = self.client.post(reverse("controlpanel:tier_create"), {"name": "", "description": "", "is_active": "on"}, follow=True)
+        self.assertRedirects(response, reverse("controlpanel:billing"))
+        self.assertContains(response, "This field is required")
+
+        response = self.client.post(reverse("controlpanel:due_pay", args=[due.pk]), {"amount": "not-a-number", "method": "bank_transfer", "reference": "", "paid_at": "", "note": ""}, follow=True)
+        self.assertRedirects(response, reverse("controlpanel:club_detail", args=[self.club.pk]))
+        self.assertContains(response, "Enter a number")
+
+    def test_the_payment_modal_defaults_to_the_outstanding_balance(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+        record_payment(due, Decimal("200.00"))
+        due.refresh_from_db()
+
+        response = self.client.get(reverse("controlpanel:club_detail", args=[self.club.pk]))
+
+        rendered_due = next(rendered for rendered in response.context["dues"] if rendered.pk == due.pk)
+        self.assertEqual(rendered_due.payment_form.initial["amount"], Decimal("300.00"))
+
+    def test_a_tier_can_be_renamed(self):
+        self.client.post(reverse("controlpanel:tier_update", args=[self.tier.pk]), {"name": "Standard plus", "description": "", "is_active": "on"})
+
+        self.tier.refresh_from_db()
+        self.assertEqual(self.tier.name, "Standard plus")
+
+    def test_changing_tier_leaves_the_open_period_alone(self):
+        # The current period keeps the amount it was issued at; the new rate bites next time.
+        subscribe(self.club, self.tier)
+        premium = Tier.objects.create(name="Premium")
+        TierPrice.objects.create(tier=premium, active_from=self.today, amount=Decimal("900.00"))
+
+        response = self.client.post(reverse("controlpanel:club_subscribe", args=[self.club.pk]), {"tier": premium.pk, "auto_archive": "on", "notes": ""}, follow=True)
+
+        self.club.refresh_from_db()
+        self.assertEqual(self.club.subscription.tier, premium)
+        self.assertEqual(self.club.dues.first().amount, Decimal("500.00"))
+        self.assertContains(response, "keeps the amount it was billed at")
+
+    def test_subscribing_to_an_unpriced_tier_reports_itself(self):
+        unpriced = Tier.objects.create(name="Enterprise")
+
+        response = self.client.post(reverse("controlpanel:club_subscribe", args=[self.club.pk]), {"tier": unpriced.pk, "auto_archive": "on", "notes": ""}, follow=True)
+
+        self.assertContains(response, "no price in force")
+
+    def test_billing_a_period_twice_reports_itself(self):
+        subscribe(self.club, self.tier)
+        start = self.club.dues.first().period_start
+
+        response = self.client.post(reverse("controlpanel:club_open_period", args=[self.club.pk]), {"start": start.isoformat()}, follow=True)
+
+        self.assertContains(response, "already billed")
+
+    def test_waiving_a_paid_period_reports_itself(self):
+        subscribe(self.club, self.tier)
+        due = self.club.dues.first()
+        record_payment(due, Decimal("500.00"))
+
+        response = self.client.post(reverse("controlpanel:due_waive", args=[due.pk]), follow=True)
+
+        self.assertContains(response, "remove them before waiving")
+
+
+class MaintenancePanelTests(ControlPanelTestBase):
+    def setUp(self):
+        super().setUp()
+        cache.clear()
+        self.addCleanup(cache.clear)
+
+    def test_closing_the_platform_records_who_did_it(self):
+        self.client.post(reverse("controlpanel:maintenance"), {"message": "Database upgrade."})
+
+        maintenance = Maintenance.current()
+        self.assertTrue(maintenance.is_active)
+        self.assertEqual(maintenance.message, "Database upgrade.")
+        self.assertEqual(maintenance.started_by, self.staff)
+
+    def test_posting_again_reopens_the_platform(self):
+        Maintenance.start(message="x", user=self.staff)
+
+        self.client.post(reverse("controlpanel:maintenance"), {})
+
+        self.assertFalse(Maintenance.is_on())
+
+    def test_every_panel_page_warns_while_the_platform_is_closed(self):
+        # Not a state to leave on by accident.
+        Maintenance.start(user=self.staff)
+
+        for url in (reverse("controlpanel:dashboard"), reverse("controlpanel:club_list"), reverse("controlpanel:features")):
+            self.assertContains(self.client.get(url), "closed for maintenance", msg_prefix=url)
+
+    def test_the_features_page_offers_the_switch(self):
+        response = self.client.get(reverse("controlpanel:features"))
+
+        self.assertContains(response, "Maintenance mode")
+        self.assertContains(response, "Close the platform")
diff --git a/controlpanel/urls.py b/controlpanel/urls.py
new file mode 100644
index 0000000..525ba45
--- /dev/null
+++ b/controlpanel/urls.py
@@ -0,0 +1,42 @@
+from django.urls import path
+
+from . import views
+
+app_name = "controlpanel"
+
+urlpatterns = [
+    path("", views.DashboardView.as_view(), name="dashboard"),
+    # Clubs
+    path("clubs/", views.ClubListView.as_view(), name="club_list"),
+    path("clubs/new/", views.ClubCreateView.as_view(), name="club_create"),
+    path("clubs/<uuid:pk>/", views.ClubDetailView.as_view(), name="club_detail"),
+    path("clubs/<uuid:pk>/edit/", views.ClubUpdateView.as_view(), name="club_update"),
+    path("clubs/<uuid:pk>/archive/", views.ClubArchiveView.as_view(), name="club_archive"),
+    path("clubs/<uuid:pk>/restore/", views.ClubRestoreView.as_view(), name="club_restore"),
+    path("clubs/<uuid:pk>/home-location/", views.ClubHomeLocationSetView.as_view(), name="club_home_location_set"),
+    path("clubs/<uuid:pk>/admins/add/", views.ClubAdminAddView.as_view(), name="club_admin_add"),
+    path("clubs/<uuid:pk>/admins/<uuid:role_pk>/remove/", views.ClubAdminRemoveView.as_view(), name="club_admin_remove"),
+    path("clubs/<uuid:pk>/features/<int:flag_pk>/toggle/", views.ClubFeatureToggleView.as_view(), name="club_feature_toggle"),
+    # Features
+    path("features/", views.FeatureListView.as_view(), name="features"),
+    path("features/maintenance/", views.MaintenanceView.as_view(), name="maintenance"),
+    path("features/flags/new/", views.FlagCreateView.as_view(), name="flag_create"),
+    path("features/flags/<int:pk>/edit/", views.FlagUpdateView.as_view(), name="flag_update"),
+    path("features/switches/<int:pk>/toggle/", views.SwitchToggleView.as_view(), name="switch_toggle"),
+    # Billing (platform charging the clubs)
+    path("billing/", views.BillingView.as_view(), name="billing"),
+    path("billing/tiers/new/", views.TierCreateView.as_view(), name="tier_create"),
+    path("billing/tiers/<uuid:pk>/edit/", views.TierUpdateView.as_view(), name="tier_update"),
+    path("billing/tiers/<uuid:pk>/prices/new/", views.TierPriceCreateView.as_view(), name="tier_price_create"),
+    path("billing/dues/<uuid:pk>/pay/", views.RecordPaymentView.as_view(), name="due_pay"),
+    path("billing/dues/<uuid:pk>/waive/", views.WaiveDueView.as_view(), name="due_waive"),
+    path("billing/dues/<uuid:pk>/invoice.pdf", views.InvoicePdfView.as_view(), name="due_invoice"),
+    path("clubs/<uuid:pk>/subscription/", views.SubscribeClubView.as_view(), name="club_subscribe"),
+    path("clubs/<uuid:pk>/trial/start/", views.ClubStartTrialView.as_view(), name="club_trial_start"),
+    path("clubs/<uuid:pk>/period/new/", views.OpenPeriodView.as_view(), name="club_open_period"),
+    # Platform admins (superusers only)
+    path("admins/", views.PlatformAdminListView.as_view(), name="admins"),
+    path("admins/add/", views.PlatformAdminAddView.as_view(), name="admin_add"),
+    path("admins/<uuid:pk>/update/", views.PlatformAdminUpdateView.as_view(), name="admin_update"),
+    path("admins/<uuid:pk>/revoke/", views.PlatformAdminRevokeView.as_view(), name="admin_revoke"),
+]
diff --git a/controlpanel/views.py b/controlpanel/views.py
new file mode 100644
index 0000000..c810a7e
--- /dev/null
+++ b/controlpanel/views.py
@@ -0,0 +1,641 @@
+from contextlib import contextmanager
+
+from django.contrib.auth import get_user_model
+from django.db.models import Count
+from django.http import HttpResponse
+from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
+from django.utils import timezone
+from django.utils.formats import date_format
+from django.views.generic import CreateView, DetailView, FormView, ListView, TemplateView, UpdateView, View
+from waffle import get_waffle_flag_model, get_waffle_switch_model
+
+from billing.models import Due, Tier, TierPrice
+from billing.services import BillingError
+from billing.services.dues import next_period_start, open_period, reactivate, record_payment, start_trial, subscribe, waive
+from billing.services.invoices import invoice_pdf, issue_invoice
+from club.models import Club, ClubRole
+from events.models import Location
+from features.models import Maintenance
+
+from .forms import ClubAdminForm, ClubForm, DuePaymentForm, FlagForm, HomeLocationForm, MaintenanceForm, OpenPeriodForm, PlatformAdminForm, SubscriptionForm, TierForm, TierPriceForm, TrialForm
+from .messages import notify
+from .mixins import PlatformStaffRequiredMixin, PlatformSuperuserRequiredMixin, RedirectOnInvalidMixin
+from .services.admins import grant_club_admin, revoke_club_admin
+from .services.platform_admins import (
+    PlatformAdminError,
+    grant_platform_access,
+    platform_admins,
+    revoke_platform_access,
+    set_platform_access,
+)
+from .services.statistics import club_attention, club_charts, club_statistics, clubs_with_health, flag_adoption, flags_for_club, onboarding_funnel, platform_attention, platform_charts, platform_totals
+
+Flag = get_waffle_flag_model()
+Switch = get_waffle_switch_model()
+
+
+@contextmanager
+def suppress_billing_errors(request, title="Billing error"):
+    """Turn a BillingError into an error message rather than letting it propagate.
+
+    Fits call sites that fall through to the same redirect on the happy and unhappy path
+    alike — the success message is set inside the block, the failure message by this
+    context manager, and whichever fired, the caller's next line runs unchanged.
+    """
+    try:
+        yield
+    except BillingError as error:
+        notify(request, f"e|{title}|{error}")
+
+
+class DashboardView(PlatformStaffRequiredMixin, TemplateView):
+    template_name = "controlpanel/dashboard.html"
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(
+            nav="dashboard",
+            totals=platform_totals(),
+            attention=platform_attention(),
+            funnel=onboarding_funnel(),
+            flags=flag_adoption(),
+            charts=platform_charts(),
+            clubs=clubs_with_health(),
+            today=timezone.localdate(),
+            **kwargs,
+        )
+
+
+class ClubListView(PlatformStaffRequiredMixin, ListView):
+    template_name = "controlpanel/club_list.html"
+    context_object_name = "clubs"
+
+    @property
+    def show_archived(self):
+        return self.request.GET.get("archived") == "1"
+
+    def get_queryset(self):
+        clubs = Club.objects.archived() if self.show_archived else Club.objects.active()
+        search = self.request.GET.get("q", "").strip()
+        if search:
+            clubs = clubs.filter(name__icontains=search)
+        return clubs_with_health(clubs)
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(nav="clubs", show_archived=self.show_archived, search=self.request.GET.get("q", ""), today=timezone.localdate(), **kwargs)
+
+
+class ClubCreateView(PlatformStaffRequiredMixin, CreateView):
+    model = Club
+    form_class = ClubForm
+    template_name = "controlpanel/club_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        notify(self.request, f"s|Club created|Club “{self.object}” created.")
+        return response
+
+    def get_success_url(self):
+        return reverse("controlpanel:club_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(nav="clubs", **kwargs)
+
+
+class ClubUpdateView(PlatformStaffRequiredMixin, UpdateView):
+    model = Club
+    form_class = ClubForm
+    template_name = "controlpanel/club_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        notify(self.request, f"s|Club updated|Club “{self.object}” updated.")
+        return response
+
+    def get_success_url(self):
+        return reverse("controlpanel:club_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(nav="clubs", update_view=True, **kwargs)
+
+
+class ClubDetailView(PlatformStaffRequiredMixin, DetailView):
+    model = Club
+    template_name = "controlpanel/club_detail.html"
+    context_object_name = "club"
+
+    def get_context_data(self, **kwargs):
+        subscription = getattr(self.object, "subscription", None)
+        next_start = next_period_start(self.object)
+
+        # Bound per-row so each due's "Add payment" modal can render its own form without
+        # the template calling DuePaymentForm(initial=...) itself.
+        dues = list(self.object.dues.select_related("tier", "invoice").prefetch_related("payments"))
+        for due in dues:
+            if due.is_owing:
+                due.payment_form = DuePaymentForm(initial={"amount": due.balance})
+
+        home_location = Location.objects.filter(club=self.object, is_home=True).first()
+
+        return super().get_context_data(
+            home_location=home_location,
+            home_location_form=HomeLocationForm(instance=home_location),
+            nav="clubs",
+            groups=club_statistics(self.object),
+            attention=club_attention(self.object),
+            charts=club_charts(self.object),
+            subscription=subscription,
+            dues=dues,
+            today=timezone.localdate(),
+            admins=ClubRole.objects.filter(club=self.object, role=ClubRole.Roles.ADMIN).select_related("member", "member__user"),
+            admin_form=ClubAdminForm(),
+            flags=flags_for_club(self.object),
+            open_period_form=OpenPeriodForm(),
+            open_period_blurb=f"Next period starts {date_format(next_start, 'j M Y')} unless you say otherwise. By default it continues from the end of the last one, so a lapsed year is still owed — pick a start date to forgive the gap.",
+            subscription_form=SubscriptionForm(instance=subscription) if subscription else SubscriptionForm(),
+            trial_form=TrialForm(),
+            **kwargs,
+        )
+
+
+class ClubArchiveView(PlatformStaffRequiredMixin, View):
+    """Clubs are archived, never destroyed — their data (and invoices) are kept."""
+
+    def post(self, request, pk):
+        club = get_object_or_404(Club, pk=pk)
+        club.archive()
+        notify(request, f"w|Club archived|Club “{club}” archived. Its subdomain no longer resolves.")
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class ClubRestoreView(PlatformStaffRequiredMixin, View):
+    def post(self, request, pk):
+        club = get_object_or_404(Club, pk=pk)
+        club.restore()
+        notify(request, f"s|Club restored|Club “{club}” restored.")
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class ClubAdminAddView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Add admin" modal on the club detail page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission."""
+
+    form_class = ClubAdminForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def club(self):
+        return get_object_or_404(Club, pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        role = grant_club_admin(self.club, **form.cleaned_data)
+        notify(self.request, f"s|Admin added|{role.member} is now an admin of {role.club}. They must set up two-factor authentication before they can sign in.")
+        return redirect("controlpanel:club_detail", pk=self.kwargs["pk"])
+
+
+class ClubHomeLocationSetView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Create or update the club's home Location -- reachable only via the "Home
+    location" modal on the club detail page. Binds to the existing home Location
+    (if any) so submitting the form edits it in place rather than ever creating
+    a second one; ``unique_home_location_per_club`` backs that up at the DB level."""
+
+    form_class = HomeLocationForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def club(self):
+        return get_object_or_404(Club, pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"instance": Location.objects.filter(club=self.club, is_home=True).first()}
+
+    def form_valid(self, form):
+        location = form.save(commit=False)
+        location.club = self.club
+        location.is_home = True
+        location.save()
+        notify(self.request, f"s|Home location set|{location} is now {self.club}'s home location.")
+        return redirect("controlpanel:club_detail", pk=self.kwargs["pk"])
+
+
+class ClubAdminRemoveView(PlatformStaffRequiredMixin, View):
+    def post(self, request, pk, role_pk):
+        role = get_object_or_404(ClubRole, pk=role_pk, club_id=pk, role=ClubRole.Roles.ADMIN)
+        member = role.member
+        revoke_club_admin(role)
+        notify(request, f"w|Admin removed|{member} is no longer an admin of this club.")
+        return redirect("controlpanel:club_detail", pk=pk)
+
+
+class ClubFeatureToggleView(PlatformStaffRequiredMixin, View):
+    """Turn a feature on or off for one club."""
+
+    def post(self, request, pk, flag_pk):
+        club = get_object_or_404(Club, pk=pk)
+        flag = get_object_or_404(Flag, pk=flag_pk)
+
+        if flag.clubs.filter(pk=club.pk).exists():
+            flag.clubs.remove(club)
+            notify(request, f"w|Feature disabled|“{flag.name}” turned off for {club}.")
+        else:
+            flag.clubs.add(club)
+            notify(request, f"s|Feature enabled|“{flag.name}” turned on for {club}.")
+
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class FeatureListView(PlatformStaffRequiredMixin, TemplateView):
+    template_name = "controlpanel/features.html"
+
+    def get_context_data(self, **kwargs):
+        # Bound per-row so each flag's "Edit" modal can render its own form: the template
+        # can't call FlagForm(instance=flag) itself, so the form rides along on the flag.
+        flags = list(Flag.objects.prefetch_related("clubs").order_by("name"))
+        for flag in flags:
+            flag.edit_form = FlagForm(instance=flag)
+
+        return super().get_context_data(
+            nav="features",
+            flags=flags,
+            flag_form=FlagForm(),
+            switches=Switch.objects.order_by("name"),
+            maintenance=Maintenance.current(),
+            maintenance_form=MaintenanceForm(),
+            **kwargs,
+        )
+
+
+class MaintenanceView(PlatformStaffRequiredMixin, View):
+    """Close the platform, or open it again."""
+
+    def post(self, request):
+        if Maintenance.is_on():
+            Maintenance.stop()
+            notify(request, "s|Maintenance ended|The clubs are back.")
+        else:
+            form = MaintenanceForm(request.POST)
+            message = form.cleaned_data["message"] if form.is_valid() else ""
+            Maintenance.start(message=message, user=request.user)
+            notify(request, "w|Platform closed|Every club subdomain now serves a maintenance page, and the scheduled jobs stand down.")
+
+        return redirect("controlpanel:features")
+
+
+class FlagCreateView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, CreateView):
+    """Reachable only via the "New feature" modal on the features page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission."""
+
+    model = Flag
+    form_class = FlagForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:features"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        notify(self.request, f"s|Feature created|Feature “{self.object.name}” created.")
+        return response
+
+    def get_success_url(self):
+        return reverse("controlpanel:features")
+
+
+class FlagUpdateView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, UpdateView):
+    """Reachable only via a flag's "Edit" modal on the features page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission."""
+
+    model = Flag
+    form_class = FlagForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:features"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        notify(self.request, f"s|Feature updated|Feature “{self.object.name}” updated.")
+        return response
+
+    def get_success_url(self):
+        return reverse("controlpanel:features")
+
+
+class SwitchToggleView(PlatformStaffRequiredMixin, View):
+    """Global kill-switch: on or off for the whole platform."""
+
+    def post(self, request, pk):
+        switch = get_object_or_404(Switch, pk=pk)
+        switch.active = not switch.active
+        switch.save()
+        title = "Switch on" if switch.active else "Switch off"
+        notify(request, f"s|{title}|Switch “{switch.name}” is now {'on' if switch.active else 'off'}.")
+        return redirect("controlpanel:features")
+
+
+class PlatformAdminListView(PlatformSuperuserRequiredMixin, TemplateView):
+    template_name = "controlpanel/admins.html"
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(nav="admins", admins=platform_admins(), admin_form=PlatformAdminForm(), **kwargs)
+
+
+class PlatformAdminAddView(PlatformSuperuserRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Grant access" modal on the admins page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission."""
+
+    form_class = PlatformAdminForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:admins"
+
+    def form_valid(self, form):
+        user = grant_platform_access(form.cleaned_data["email"], is_superuser=form.cleaned_data["is_superuser"])
+        notify(self.request, f"s|Platform access granted|{user.email} now has platform access. They must set up two-factor authentication before they can sign in.")
+        return redirect("controlpanel:admins")
+
+
+class PlatformAdminUpdateView(PlatformSuperuserRequiredMixin, View):
+    def post(self, request, pk):
+        user = get_object_or_404(get_user_model(), pk=pk)
+        try:
+            set_platform_access(
+                request.user,
+                user,
+                is_staff=request.POST.get("is_staff") == "1",
+                is_superuser=request.POST.get("is_superuser") == "1",
+            )
+        except PlatformAdminError as error:
+            notify(request, f"e|Couldn't update access|{error}")
+        else:
+            notify(request, f"s|Access updated|Updated platform access for {user.email}.")
+        return redirect("controlpanel:admins")
+
+
+class PlatformAdminRevokeView(PlatformSuperuserRequiredMixin, View):
+    def post(self, request, pk):
+        user = get_object_or_404(get_user_model(), pk=pk)
+        try:
+            revoke_platform_access(request.user, user)
+        except PlatformAdminError as error:
+            notify(request, f"e|Couldn't revoke access|{error}")
+        else:
+            notify(request, f"w|Access revoked|{user.email} no longer has platform access.")
+        return redirect("controlpanel:admins")
+
+
+class BillingView(PlatformStaffRequiredMixin, TemplateView):
+    """Tiers and their prices, plus every period we are owed money for."""
+
+    template_name = "controlpanel/billing.html"
+
+    def get_context_data(self, **kwargs):
+        today = timezone.localdate()
+
+        # Bound per-row so each "Edit" / "New price" modal can render its own form: the
+        # template can't call TierForm(instance=tier) itself, so the form rides along on
+        # the object it belongs to.
+        tiers = list(Tier.objects.prefetch_related("prices").annotate(club_count=Count("subscriptions")))
+        for tier in tiers:
+            tier.edit_form = TierForm(instance=tier)
+            tier.price_form = TierPriceForm()
+
+        owing = list(Due.objects.filter(status__in=Due.OWING).select_related("club", "tier").order_by("grace_until"))
+        for due in owing:
+            due.payment_form = DuePaymentForm(initial={"amount": due.balance})
+
+        return super().get_context_data(
+            nav="billing",
+            tiers=tiers,
+            tier_form=TierForm(),
+            owing=owing,
+            today=today,
+            **kwargs,
+        )
+
+
+class TierCreateView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, CreateView):
+    """Reachable only via the "New plan" modal on the billing page — POST-only, and there
+    is no standalone template to render on GET or on a rejected submission."""
+
+    model = Tier
+    form_class = TierForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:billing"
+
+    def get_success_url(self):
+        notify(self.request, f"s|Plan created|Tier “{self.object}” created. Give it a price before billing anyone.")
+        return reverse("controlpanel:billing")
+
+
+class TierUpdateView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, UpdateView):
+    """Reachable only via a tier's "Edit" modal on the billing page — POST-only, and there
+    is no standalone template to render on GET or on a rejected submission."""
+
+    model = Tier
+    form_class = TierForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:billing"
+
+    def get_success_url(self):
+        notify(self.request, f"s|Plan updated|Tier “{self.object}” updated.")
+        return reverse("controlpanel:billing")
+
+
+class TierPriceCreateView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, CreateView):
+    """A rate change is a new dated price, never an edit of the old one — periods already
+    billed keep the amount they were billed at.
+
+    Reachable only via a tier's "New price" modal on the billing page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission.
+    """
+
+    model = TierPrice
+    form_class = TierPriceForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:billing"
+
+    @property
+    def tier(self):
+        return get_object_or_404(Tier, pk=self.kwargs["pk"])
+
+    def form_valid(self, form):
+        form.instance.tier = self.tier
+        response = super().form_valid(form)
+        notify(self.request, f"s|Price added|{self.tier} is €{self.object.amount} for periods opening from {self.object.active_from}.")
+        return response
+
+    def get_success_url(self):
+        return reverse("controlpanel:billing")
+
+
+class SubscribeClubView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Put a club on a tier, which opens its first period.
+
+    Reachable only via the "Change plan" modal on the club detail page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission.
+    """
+
+    form_class = SubscriptionForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def club(self):
+        return get_object_or_404(Club, pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.club.pk}
+
+    def get_form_kwargs(self):
+        kwargs = super().get_form_kwargs()
+        subscription = getattr(self.club, "subscription", None)
+        if subscription:
+            kwargs["instance"] = subscription
+        return kwargs
+
+    def form_valid(self, form):
+        club = self.club
+        existing = getattr(club, "subscription", None)
+        with suppress_billing_errors(self.request, title="Couldn't change plan"):
+            if existing:
+                # Changing tier does not re-bill: the current period keeps the amount it was
+                # issued at, and the new rate applies from the next one.
+                was_on_trial = existing.trial_ends_at is not None
+                subscription = form.save(commit=False)
+                subscription.club = club
+                if was_on_trial:
+                    # A manual tier change while on a trial is a deliberate override --
+                    # left in place, the trial fields would silently swap the tier again
+                    # later, onto a plan the admin didn't just choose.
+                    subscription.trial_ends_at = None
+                    subscription.post_trial_tier = None
+                subscription.save()
+                notify(self.request, f"s|Plan changed|{club} is now on {subscription.tier}. The current period keeps the amount it was billed at.")
+            else:
+                subscribe(club, form.cleaned_data["tier"], start=form.cleaned_data.get("start"), auto_archive=form.cleaned_data["auto_archive"], auto_renew=form.cleaned_data["auto_renew"])
+                notify(self.request, f"s|Billing started|{club} is on {form.cleaned_data['tier']}. Its first period is open.")
+
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class ClubStartTrialView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Put a club with no subscription yet on a short trial -- reachable only via the
+    "Start trial" modal on the club detail page, shown alongside "Start billing" only
+    while the club has no subscription. POST-only, no standalone template."""
+
+    form_class = TrialForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def club(self):
+        return get_object_or_404(Club, pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        club = self.club
+        with suppress_billing_errors(self.request, title="Couldn't start trial"):
+            start_trial(
+                club,
+                form.cleaned_data["trial_tier"],
+                post_trial_tier=form.cleaned_data["post_trial_tier"],
+                trial_months=form.cleaned_data["trial_months"],
+                start=form.cleaned_data.get("start"),
+            )
+            notify(self.request, f"s|Trial started|{club} is on a {form.cleaned_data['trial_months']}-month trial of {form.cleaned_data['trial_tier']}, then switches to {form.cleaned_data['post_trial_tier']}.")
+
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class RecordPaymentView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via a due's "Record payment" modal on the club or billing page —
+    POST-only, and there is no standalone template to render on GET or on a rejected
+    submission."""
+
+    form_class = DuePaymentForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def due(self):
+        return get_object_or_404(Due.objects.select_related("club", "tier"), pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.due.club_id}
+
+    def form_valid(self, form):
+        due = self.due
+        with suppress_billing_errors(self.request, title="Couldn't record payment"):
+            record_payment(
+                due,
+                form.cleaned_data["amount"],
+                method=form.cleaned_data["method"],
+                reference=form.cleaned_data["reference"],
+                paid_at=form.cleaned_data["paid_at"],
+                note=form.cleaned_data["note"],
+                user=self.request.user,
+            )
+            due.refresh_from_db()
+            notify(self.request, f"s|Payment recorded|€{form.cleaned_data['amount']} recorded. {due.get_status_display().capitalize()} — €{due.balance} outstanding.")
+
+        return redirect("controlpanel:club_detail", pk=due.club_id)
+
+
+class WaiveDueView(PlatformStaffRequiredMixin, View):
+    def post(self, request, pk):
+        due = get_object_or_404(Due, pk=pk)
+        with suppress_billing_errors(request, title="Couldn't waive period"):
+            waive(due)
+            notify(request, f"w|Period waived|Period {due.period_start} to {due.period_end} waived. Nothing is owed and the club will not be archived for it.")
+
+        return redirect("controlpanel:club_detail", pk=due.club_id)
+
+
+class OpenPeriodView(PlatformStaffRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Renew a club, or reactivate an archived one.
+
+    Reachable only via the "Open period" modal on the club detail page — POST-only, and
+    there is no standalone template to render on GET or on a rejected submission.
+    """
+
+    form_class = OpenPeriodForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "controlpanel:club_detail"
+
+    @property
+    def club(self):
+        return get_object_or_404(Club, pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.club.pk}
+
+    def form_valid(self, form):
+        club = self.club
+        start = form.cleaned_data.get("start")
+        with suppress_billing_errors(self.request, title="Couldn't open period"):
+            due = reactivate(club, start=start) if club.is_archived else open_period(club, start=start)
+            notify(self.request, f"s|Period opened|Period {due.period_start} to {due.period_end} opened for €{due.amount}. Invoice {due.invoice.number}.")
+
+        return redirect("controlpanel:club_detail", pk=club.pk)
+
+
+class InvoicePdfView(PlatformStaffRequiredMixin, View):
+    def get(self, request, pk):
+        due = get_object_or_404(Due.objects.select_related("club", "tier", "invoice"), pk=pk)
+        invoice = issue_invoice(due)
+        try:
+            pdf = invoice_pdf(invoice)
+        except BillingError as error:
+            # The native PDF libraries are missing: say so rather than 500.
+            notify(request, f"e|PDF unavailable|{error}")
+            return redirect("controlpanel:club_detail", pk=due.club_id)
+
+        response = HttpResponse(pdf, content_type="application/pdf")
+        response["Content-Disposition"] = f'attachment; filename="{invoice.number}.pdf"'
+        return response
diff --git a/deploy/backup.sh b/deploy/backup.sh
new file mode 100755
index 0000000..410973e
--- /dev/null
+++ b/deploy/backup.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Back up what carries state: the database, and the uploads if they are still on local disk.
+#
+#   deploy/backup.sh /var/backups/rosterchief
+#
+# Runs from cron (see DEPLOYMENT.md). Exits non-zero on any failure, so cron mails you —
+# a backup script that fails quietly is worse than no backup script, because you will
+# believe you have backups.
+set -Eeuo pipefail
+
+DEST="${1:-/var/backups/rosterchief}"
+COMPOSE="${COMPOSE:-docker compose}"
+KEEP_DAYS="${KEEP_DAYS:-14}"
+STAMP="$(date +%F-%H%M)"
+
+mkdir -p "$DEST"
+
+# --- database ---------------------------------------------------------------
+# Written to a temporary name and moved into place only on success: a truncated dump that
+# looks like a backup is the trap this avoids.
+DB_TMP="$DEST/.db-$STAMP.sql.gz.part"
+DB_OUT="$DEST/db-$STAMP.sql.gz"
+
+$COMPOSE exec -T db pg_dump --clean --if-exists -U "${POSTGRES_USER:-rosterchief}" "${POSTGRES_DB:-rosterchief}" | gzip > "$DB_TMP"
+gzip -t "$DB_TMP"                     # the archive is readable
+[ -s "$DB_TMP" ]                      # ...and not empty
+mv "$DB_TMP" "$DB_OUT"
+
+# --- uploads ----------------------------------------------------------------
+# Only while media is local. Once AWS_STORAGE_BUCKET_NAME is set the bucket's own versioning
+# is the backup, and this step is skipped.
+if [ -z "${AWS_STORAGE_BUCKET_NAME:-}" ]; then
+    MEDIA_OUT="$DEST/media-$STAMP.tar.gz"
+    $COMPOSE exec -T web tar -cz -C /app media | cat > "$MEDIA_OUT.part"
+    mv "$MEDIA_OUT.part" "$MEDIA_OUT"
+fi
+
+# --- retention --------------------------------------------------------------
+find "$DEST" -name 'db-*.sql.gz' -mtime "+$KEEP_DAYS" -delete
+find "$DEST" -name 'media-*.tar.gz' -mtime "+$KEEP_DAYS" -delete
+find "$DEST" -name '*.part' -mtime +1 -delete
+
+echo "$(date -Iseconds) backup ok: $(basename "$DB_OUT") ($(du -h "$DB_OUT" | cut -f1))"
+
+# --- offsite ----------------------------------------------------------------
+# A backup on the same disk as the database is not a backup: it survives a bad migration, but
+# not the server. Set BACKUP_REMOTE to an rclone remote to copy it off the box.
+if [ -n "${BACKUP_REMOTE:-}" ]; then
+    rclone copy "$DEST" "$BACKUP_REMOTE" --max-age "${KEEP_DAYS}d"
+    echo "$(date -Iseconds) copied to $BACKUP_REMOTE"
+fi
diff --git a/deploy/caddy/Caddyfile b/deploy/caddy/Caddyfile
new file mode 100644
index 0000000..a4d4a53
--- /dev/null
+++ b/deploy/caddy/Caddyfile
@@ -0,0 +1,33 @@
+{
+	email {$ACME_EMAIL}
+}
+
+# The bare domain (control panel, admin, auth) and every club subdomain, on one certificate.
+{$ROSTERCHIEF_BASE_DOMAIN}, *.{$ROSTERCHIEF_BASE_DOMAIN} {
+	tls {
+		dns cloudflare {$CLOUDFLARE_API_TOKEN}
+	}
+
+	encode zstd gzip
+
+	# Club logos, served straight off the shared volume — no gunicorn worker involved. Only
+	# matters while storage is local disk; once AWS_STORAGE_BUCKET_NAME is set, club.logo.url
+	# points at the bucket directly and this block simply never matches. A missing file 404s
+	# here exactly as django.views.static.serve would, so there is no need to fall through.
+	handle_path /media/* {
+		root * /srv/media
+		file_server
+	}
+
+	# X-Forwarded-Proto is what SECURE_PROXY_SSL_HEADER reads. Without it Django believes every
+	# request is plain HTTP: request.is_secure() goes false, WebAuthn disagrees with the browser
+	# about the origin, and the SSL redirect becomes a loop.
+	reverse_proxy web:8000 {
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Real-IP {remote_host}
+	}
+
+	log {
+		output stdout
+	}
+}
diff --git a/deploy/caddy/Dockerfile b/deploy/caddy/Dockerfile
new file mode 100644
index 0000000..5d1b48d
--- /dev/null
+++ b/deploy/caddy/Dockerfile
@@ -0,0 +1,9 @@
+# Caddy with a DNS plugin. The stock image cannot solve a DNS-01 challenge, and DNS-01 is the
+# only way Let's Encrypt issues the *.rosterchief.app wildcard that subdomain tenancy needs.
+#
+# Swap the module if your DNS lives elsewhere: caddy-dns/route53, caddy-dns/digitalocean, ...
+FROM caddy:2-builder AS builder
+RUN xcaddy build --with github.com/caddy-dns/cloudflare
+
+FROM caddy:2
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
diff --git a/deploy/deploy-dev.sh b/deploy/deploy-dev.sh
new file mode 100755
index 0000000..59a570c
--- /dev/null
+++ b/deploy/deploy-dev.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Deploy the test instance to the dev server, behind its existing Caddy.
+#
+#   deploy/deploy-dev.sh            # deploy the current branch
+#   BRANCH=main deploy/deploy-dev.sh
+#   deploy/deploy-dev.sh --push     # push the branch first, then deploy
+#
+# Runs FROM your machine, works ON the server over one SSH session: it fetches the pushed
+# branch, builds the image, runs migrations explicitly (never from the entrypoint — a
+# starting gunicorn worker is a bad place to discover a failed migration), restarts web, and
+# waits for /healthz. Any step failing aborts the whole thing with a non-zero exit.
+set -Eeuo pipefail
+
+# --- config (override via env) ----------------------------------------------
+SSH_HOST="${SSH_HOST:-home.siebens.org}"
+SSH_USER="${SSH_USER:-bernard}"
+REMOTE_DIR="${REMOTE_DIR:-/home/bernard/RosterChief}"
+BRANCH="${BRANCH:-$(git rev-parse --abbrev-ref HEAD)}"
+COMPOSE_FILE="${COMPOSE_FILE:-compose.behind-proxy.yaml}"
+# The published port lives in the server's .env (WEB_PORT), so it is read there, not here —
+# see the remote block. This default only applies if that file omits it, matching compose's
+# own `${WEB_PORT:-8001}`.
+DEFAULT_WEB_PORT="${DEFAULT_WEB_PORT:-8001}"
+
+SSH_TARGET="${SSH_USER}@${SSH_HOST}"
+
+say() { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31mERROR:\033[0m %s\n' "$*" >&2; exit 1; }
+
+# --- preflight, locally -----------------------------------------------------
+# The server deploys what is on the git remote, so unpushed commits would silently ship stale
+# code. Catch that here rather than after a confusing "why isn't my change live" round trip.
+git rev-parse --verify --quiet "origin/${BRANCH}" >/dev/null \
+    || die "origin/${BRANCH} does not exist. Push the branch first, or pass --push."
+
+if [ "${1:-}" = "--push" ]; then
+    say "Pushing ${BRANCH} to origin"
+    git push origin "${BRANCH}"
+elif [ -n "$(git rev-list "origin/${BRANCH}..HEAD" 2>/dev/null)" ]; then
+    die "Local ${BRANCH} is ahead of origin — the server would deploy stale code. Push first, or run with --push."
+fi
+
+say "Deploying ${BRANCH} to ${SSH_TARGET}:${REMOTE_DIR}"
+
+# --- the work, on the server ------------------------------------------------
+# One SSH session runs the whole remote script; args are passed positionally so nothing has to
+# be re-quoted inside the heredoc.
+ssh -o ConnectTimeout=10 "${SSH_TARGET}" bash -s -- "${REMOTE_DIR}" "${BRANCH}" "${COMPOSE_FILE}" "${DEFAULT_WEB_PORT}" <<'REMOTE'
+set -Eeuo pipefail
+REMOTE_DIR="$1"; BRANCH="$2"; COMPOSE_FILE="$3"; DEFAULT_WEB_PORT="$4"
+
+step() { printf '\033[1;34m  ->\033[0m %s\n' "$*"; }
+
+cd "$REMOTE_DIR" 2>/dev/null || { echo "ERROR: $REMOTE_DIR not found. Clone the repo there first."; exit 1; }
+[ -d .git ] || { echo "ERROR: $REMOTE_DIR is not a git checkout."; exit 1; }
+
+# The env files carry secrets and are never committed, so they must already be on the server.
+# Fail loudly rather than boot a half-configured stack.
+[ -f .env.production ] || { echo "ERROR: .env.production missing (Django config). Copy from .env.production.example."; exit 1; }
+[ -f .env ]            || { echo "ERROR: .env missing (compose vars: POSTGRES_PASSWORD, ...). Copy from .env.compose.example."; exit 1; }
+
+dc() { docker compose -f "$COMPOSE_FILE" "$@"; }
+
+# The health probe must hit the port the container actually publishes, which is WEB_PORT in
+# the same .env compose reads. Parse it the way compose does — last assignment wins, quotes
+# and inline whitespace stripped — and fall back to the compose default when it is unset.
+WEB_PORT="$(sed -n 's/^[[:space:]]*WEB_PORT[[:space:]]*=[[:space:]]*//p' .env | tail -1 | tr -d '"'"'"' \r')"
+WEB_PORT="${WEB_PORT:-$DEFAULT_WEB_PORT}"
+HEALTH_URL="http://127.0.0.1:${WEB_PORT}/healthz"
+
+# reset --hard, not pull: a deploy target only receives deploys, so make it exactly match the
+# remote branch rather than risk a merge conflict from drift no one meant to leave there.
+step "Fetching ${BRANCH}"
+git fetch --quiet origin
+git checkout --quiet "$BRANCH"
+git reset --hard --quiet "origin/${BRANCH}"
+echo "     at $(git rev-parse --short HEAD) — $(git log -1 --pretty=%s)"
+
+step "Building image"
+dc build
+
+# Bring the data services up first and wait for Postgres, so the migration below has something
+# to connect to on a cold start.
+step "Starting db + redis"
+dc up -d db redis
+
+step "Running migrations"
+# -T and </dev/null are load-bearing: this whole script IS ssh's stdin (a heredoc), and
+# `compose run` without them attaches that stdin to the container — swallowing every command
+# below it, so web never restarts and the script exits 0 having done half the job.
+dc run --rm -T web python manage.py migrate --noinput </dev/null
+
+# Recreate only web, with the freshly built image. db and redis keep running untouched.
+step "Restarting web"
+dc up -d --no-deps web
+
+step "Waiting for /healthz on :${WEB_PORT}"
+for attempt in $(seq 1 20); do
+    if curl -fsS "$HEALTH_URL" >/dev/null 2>&1; then
+        echo "     healthy after ${attempt} check(s)"
+        exit 0
+    fi
+    sleep 3
+done
+
+echo "ERROR: health check never passed. Recent web logs:"
+dc logs --tail 40 web
+exit 1
+REMOTE
+
+say "Done. https://<your-test-domain>/healthz should return ok."
diff --git a/deploy/restore-check.sh b/deploy/restore-check.sh
new file mode 100755
index 0000000..dbe73cb
--- /dev/null
+++ b/deploy/restore-check.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Restore the latest dump into a throwaway database and count the rows.
+#
+#   deploy/restore-check.sh [/var/backups/rosterchief]
+#
+# The only line in the backup cron that proves the others work. A dump you have never
+# restored is a hypothesis, not a backup.
+set -Eeuo pipefail
+
+DEST="${1:-/var/backups/rosterchief}"
+COMPOSE="${COMPOSE:-docker compose}"
+USER_NAME="${POSTGRES_USER:-rosterchief}"
+SCRATCH="restore_check_$(date +%s)"
+
+LATEST="$(ls -1t "$DEST"/db-*.sql.gz 2>/dev/null | head -1)"
+[ -n "$LATEST" ] || { echo "no dump found in $DEST"; exit 1; }
+
+cleanup() { $COMPOSE exec -T db dropdb -U "$USER_NAME" --if-exists "$SCRATCH" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+$COMPOSE exec -T db createdb -U "$USER_NAME" "$SCRATCH"
+gunzip -c "$LATEST" | $COMPOSE exec -T db psql -q -U "$USER_NAME" "$SCRATCH" >/dev/null
+
+# A restore that produces an empty schema exits 0 and tells you nothing. Ask it something.
+CLUBS="$($COMPOSE exec -T db psql -tAq -U "$USER_NAME" "$SCRATCH" -c 'SELECT count(*) FROM club_club')"
+USERS="$($COMPOSE exec -T db psql -tAq -U "$USER_NAME" "$SCRATCH" -c 'SELECT count(*) FROM authentication_user')"
+
+[ "$USERS" -gt 0 ] || { echo "restore check FAILED: $(basename "$LATEST") restored no users"; exit 1; }
+
+echo "$(date -Iseconds) restore ok: $(basename "$LATEST") -> $CLUBS clubs, $USERS users"
diff --git a/events/__init__.py b/events/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/events/admin.py b/events/admin.py
new file mode 100644
index 0000000..048db51
--- /dev/null
+++ b/events/admin.py
@@ -0,0 +1,104 @@
+from django import forms
+from django.contrib import admin
+from django.utils.translation import gettext_lazy as _
+
+from .models import Attendance, Competition, Event, EventSeries, Location, Opponent
+
+
+@admin.register(Opponent)
+class OpponentAdmin(admin.ModelAdmin):
+    list_display = ["name", "club"]
+    list_filter = ["club"]
+    search_fields = ["name"]
+
+
+@admin.register(Location)
+class LocationAdmin(admin.ModelAdmin):
+    list_display = ["name", "city", "club"]
+    list_filter = ["club"]
+    search_fields = ["name", "city"]
+
+
+class AttendanceInline(admin.TabularInline):
+    model = Attendance
+    extra = 0
+    raw_id_fields = ["member"]
+
+
+@admin.register(EventSeries)
+class EventSeriesAdmin(admin.ModelAdmin):
+    list_display = ["title", "kind", "rrule", "dtstart", "until", "generated_until", "club"]
+    list_filter = ["kind", "club"]
+    search_fields = ["title"]
+    autocomplete_fields = ["location", "opponent", "teams", "invited_members", "excluded_members"]
+    fieldsets = [
+        [None, {"fields": ["title", "kind"]}],
+        [_("Recurrence"), {"fields": ["rrule", "dtstart", "until", "excluded_dates", "generated_until"]}],
+        [_("Timing"), {"fields": ["duration", "gathering_offset", "deadline_offset"]}],
+        [_("Audience"), {"fields": ["teams", "invited_members", "excluded_members"]}],
+        [_("Where"), {"fields": ["location", "opponent"]}],
+    ]
+
+
+class EventAdminForm(forms.ModelForm):
+    """The `competition` field is a plain CharField on Event (it just stores a
+    name), but the admin should only ever offer a competition this club is
+    actually allowed to use -- one whose feature flag is active for it, set
+    from the control panel's Features page. A competition with no flag never
+    appears at all."""
+
+    class Meta:
+        model = Event
+        fields = [
+            "title", "kind", "season", "series", "detached", "cancelled", "teams", "invited_members", "excluded_members",
+            "start", "end", "gathering", "deadline", "location", "opponent",
+            "competition", "external_game_id", "score_for", "score_against", "is_live",
+        ]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        club = self.instance.club if self.instance.club_id else None
+        competitions = Competition.objects.filter(flag__isnull=False).select_related("flag")
+        if club is not None:
+            competitions = [competition for competition in competitions if competition.flag.is_active_for_club(club)]
+        self.fields["competition"] = forms.ChoiceField(
+            choices=[("", "---------"), *[(competition.name, competition.name) for competition in competitions]],
+            required=False,
+            label=self.fields["competition"].label,
+            help_text=_("Only competitions whose feature flag is active for this club are offered here."),
+        )
+
+
+@admin.register(Event)
+class EventAdmin(admin.ModelAdmin):
+    form = EventAdminForm
+    list_display = ["title", "kind", "start", "season", "series", "detached", "club"]
+    list_filter = ["kind", "club", "teams", "detached", "cancelled"]
+    search_fields = ["title"]
+    date_hierarchy = "start"
+    autocomplete_fields = ["season", "series", "location", "opponent", "teams", "invited_members", "excluded_members"]
+    inlines = [AttendanceInline]
+    fieldsets = [
+        [None, {"fields": ["title", "kind", "season"]}],
+        [_("Series"), {"fields": ["series", "detached", "cancelled"]}],
+        [_("Audience"), {"fields": ["teams", "invited_members", "excluded_members"]}],
+        [_("When"), {"fields": ["start", "end", "gathering", "deadline"]}],
+        [_("Where"), {"fields": ["location", "opponent"]}],
+        [_("Game"), {"fields": ["competition", "external_game_id", "score_for", "score_against", "is_live"]}],
+    ]
+
+
+@admin.register(Competition)
+class CompetitionAdmin(admin.ModelAdmin):
+    list_display = ["name", "sport_type", "module", "flag"]
+    list_filter = ["sport_type"]
+    search_fields = ["name", "module"]
+    raw_id_fields = ["flag"]
+
+
+@admin.register(Attendance)
+class AttendanceAdmin(admin.ModelAdmin):
+    list_display = ["event", "member", "status", "showed_up"]
+    list_filter = ["status", "showed_up", "event__kind"]
+    search_fields = ["event__title", "member__first_name", "member__last_name"]
+    raw_id_fields = ["event", "member"]
diff --git a/events/api.py b/events/api.py
new file mode 100644
index 0000000..5df94f9
--- /dev/null
+++ b/events/api.py
@@ -0,0 +1,139 @@
+"""Public read-only game endpoints -- see api/urls.py for how this is
+mounted. Also owns GET /teams/{team_id}/games/: it's an Event query through
+and through, so the query logic and GameOut schema live here rather than
+being duplicated in teams/api.py.
+"""
+
+import uuid
+from datetime import datetime
+
+from django.db.models import Q
+from django.utils import timezone
+from ninja import Router, Schema
+from ninja.errors import HttpError
+
+from api.errors import require_club
+from club.services.access import current_season
+from teams.models import Team
+
+from .models import Event
+
+router = Router(tags=["games"])
+
+DEFAULT_UPCOMING_COUNT = 10
+MAX_UPCOMING_COUNT = 50
+
+#: /games/upcoming/ covers anything worth putting on a public fixture list --
+#: not just Game, but Tournament too. The other game endpoints (live,
+#: per-team) stay Game-only: is_live/score_for/score_against are genuinely
+#: game-specific (events/models.py), so a tournament wouldn't have anything
+#: meaningful to show there anyway.
+UPCOMING_KINDS = [Event.EventKind.GAME, Event.EventKind.TOURNAMENT]
+
+
+class LocationOut(Schema):
+    name: str
+    address: str
+    city: str
+    zip_code: str
+    country: str
+    is_home: bool
+
+
+class GameOut(Schema):
+    id: uuid.UUID
+    start: datetime
+    location: LocationOut | None
+    home_team: str | None
+    away_team: str | None
+    competition: str
+    is_live: bool
+    status: str  # "upcoming" | "live" | "finished"
+    home_score: int | None
+    away_score: int | None
+
+
+def _to_game_out(event, team=None) -> GameOut:
+    if team is None:
+        # .first() would re-query even with teams prefetched; go through the
+        # prefetch cache instead.
+        related_teams = list(event.teams.all())
+        team = related_teams[0] if related_teams else None
+
+    team_name = team.name if team is not None else None
+    opponent_name = event.opponent.name if event.opponent_id else None
+
+    if event.is_home_game:
+        home_team, away_team = team_name, opponent_name
+        home_score, away_score = event.score_for, event.score_against
+    else:
+        home_team, away_team = opponent_name, team_name
+        home_score, away_score = event.score_against, event.score_for
+
+    if event.is_live:
+        status = "live"
+    elif event.start > timezone.now():
+        status = "upcoming"
+    else:
+        status = "finished"
+
+    location = None
+    if event.location_id:
+        location = LocationOut(name=event.location.name, address=event.location.address, city=event.location.city, zip_code=event.location.zip_code, country=str(event.location.country), is_home=event.location.is_home)
+
+    return GameOut(
+        id=event.pk,
+        start=event.start,
+        location=location,
+        home_team=home_team,
+        away_team=away_team,
+        competition=event.competition,
+        is_live=event.is_live,
+        status=status,
+        home_score=home_score,
+        away_score=away_score,
+    )
+
+
+@router.get("/games/upcoming/", response=list[GameOut], summary="Upcoming games")
+def list_upcoming_games(request, count: int = DEFAULT_UPCOMING_COUNT):
+    """The next `count` non-cancelled upcoming games and tournaments, club-wide."""
+    club = require_club(request)
+    count = max(1, min(count, MAX_UPCOMING_COUNT))
+
+    events = Event.objects.filter(club=club, kind__in=UPCOMING_KINDS, cancelled=False, start__gte=timezone.now()).select_related("opponent", "location").prefetch_related("teams").order_by("start")[:count]
+
+    return [_to_game_out(event) for event in events]
+
+
+@router.get("/games/live/", response=list[GameOut], summary="Live games")
+def list_live_games(request):
+    club = require_club(request)
+
+    events = Event.objects.filter(club=club, kind=Event.EventKind.GAME, cancelled=False, is_live=True).select_related("opponent", "location").prefetch_related("teams").order_by("start")
+
+    return [_to_game_out(event) for event in events]
+
+
+@router.get("/teams/{team_id}/games/", response=list[GameOut], summary="A team's current-season games")
+def list_team_games(request, team_id: uuid.UUID):
+    """All of this team's current-season games, past and upcoming -- past ones
+    include both teams' scores. Same "explicit season, else derived from
+    start date" scoping management.views.EventListView already applies."""
+    club = require_club(request)
+    team = Team.objects.filter(club=club, pk=team_id).first()
+    if team is None:
+        raise HttpError(404, "No such team.")
+
+    season = current_season(club)
+    if season is None:
+        return []
+
+    events = (
+        Event.objects.filter(club=club, teams=team, kind=Event.EventKind.GAME, cancelled=False)
+        .filter(Q(season=season) | Q(season__isnull=True, start__date__gte=season.start_date, start__date__lte=season.end_date))
+        .select_related("opponent", "location")
+        .order_by("start")
+    )
+
+    return [_to_game_out(event, team=team) for event in events]
diff --git a/events/apps.py b/events/apps.py
new file mode 100644
index 0000000..01eac98
--- /dev/null
+++ b/events/apps.py
@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class EventsConfig(AppConfig):
+    name = "events"
+
+    def ready(self):
+        from . import signals  # noqa: F401
diff --git a/events/competition/__init__.py b/events/competition/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/events/competition/base.py b/events/competition/base.py
new file mode 100644
index 0000000..c435eed
--- /dev/null
+++ b/events/competition/base.py
@@ -0,0 +1,19 @@
+from typing import TypedDict
+
+from ..models import Event
+
+
+class GameInformation(TypedDict):
+    live: bool
+    scoreA: int
+    scoreB: int
+
+
+class CompetitionBaseClass:
+    url: str
+
+    def __init__(self):
+        self.url = "http://localhost"
+
+    def update_game_information(self, event: Event) -> None:
+        raise NotImplementedError
diff --git a/events/competition/hockey.py b/events/competition/hockey.py
new file mode 100644
index 0000000..88d1b9e
--- /dev/null
+++ b/events/competition/hockey.py
@@ -0,0 +1,90 @@
+from urllib.parse import urljoin
+
+import requests
+
+from ..models import Event
+from .base import CompetitionBaseClass
+
+
+class RBIHF(CompetitionBaseClass):
+    def __init__(self):
+        super().__init__()
+        self.url = "https://rbihf.be/modules/league/ajax/time.php"
+
+    def update_game_information(self, event: Event) -> None:
+        season = "{start}{end}".format(start=event.season.start_date.strftime("%y"), end=event.season.end_date.strftime("%y"))
+
+        payload = {"gameNr": event.external_game_id, "season": season}
+        headers = {
+            "Cookie": "language=en",
+            "Postman-Token": "rosterchief",
+            "Host": "www.rbihf.be",
+            "User-Agent": "PostmanRuntime/7.37.0",
+            "Accept": "application/json",
+            "Accept-Encoding": "gzip,deflate,br",
+            "Connection": "keep-alive",
+            "Referer": f"https://rbihf.be/game/{event.external_game_id}",
+            "X-Requested-With": "XMLHttpRequest",
+        }
+
+        req = requests.get(self.url, params=payload, headers=headers)
+
+        if req.status_code == 200:
+            game_data = req.json()
+
+            event.is_live = game_data["live"]
+
+            if event.is_home_game:
+                event.score_for = game_data["scoreA"]
+                event.score_against = game_data["scoreB"]
+            else:
+                event.score_for = game_data["scoreB"]
+                event.score_against = game_data["scoreA"]
+
+            event.save(update_fields=["is_live", "score_for", "score_against"])
+
+
+class CEHL(CompetitionBaseClass):
+    def __init__(self):
+        super().__init__()
+        self.url = "https://www.cehl.eu/ajax/"
+
+    def update_game_information(self, event: Event) -> None:
+        season = "{start}{end}".format(start=event.season.start_date.strftime("%y"), end=event.season.end_date.strftime("%y"))
+
+        referer_url = urljoin("https://www.cehl.eu", f"game/{season}/{event.external_game_id}")
+        timeline_url = urljoin(self.url, "timeline.php")
+        score_url = urljoin(self.url, "score.php")
+
+        payload = {"nr": event.external_game_id, "season": season}
+        headers = {
+            "Cookie": "language=en",
+            "Postman-Token": "rosterchief",
+            "Host": "www.cehl.eu",
+            "User-Agent": "PostmanRuntime/7.37.0",
+            "Accept": "*/*",
+            "Accept-Encoding": "gzip,deflate,br",
+            "Connection": "close",
+            "Referer": referer_url,
+            "X-Requested-With": "XMLHttpRequest",
+        }
+
+        timeline_req = requests.get(timeline_url, params=payload, headers=headers)
+        score_req = requests.get(score_url, params=payload, headers=headers)
+
+        if timeline_req.status_code == 200:
+            event.is_live = timeline_req.json()["live"] == 1
+
+        if score_req.status_code == 200:
+            game_data = score_req.json()
+
+            if event.is_home_game:
+                event.score_for = game_data["scoreA"]
+                event.score_against = game_data["scoreB"]
+
+            else:
+                event.score_for = game_data["scoreB"]
+                event.score_against = game_data["scoreA"]
+
+        if timeline_req.status_code == 200 or score_req.status_code == 200:
+            event.save(update_fields=["is_live", "score_for", "score_against"])
diff --git a/events/management/__init__.py b/events/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/events/management/commands/__init__.py b/events/management/commands/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/events/management/commands/extend_event_series.py b/events/management/commands/extend_event_series.py
new file mode 100644
index 0000000..f7fdeb7
--- /dev/null
+++ b/events/management/commands/extend_event_series.py
@@ -0,0 +1,19 @@
+from events.models import EventSeries
+from events.services import generate_occurrences, horizon
+from features.commands import MaintenanceAwareCommand
+
+
+class Command(MaintenanceAwareCommand):
+    help = "Materialise recurring event occurrences up to the rolling horizon."
+
+    def handle(self, *args, **options):
+        until = horizon()
+        total = 0
+
+        for series in EventSeries.objects.all():
+            created = generate_occurrences(series, until)
+            total += len(created)
+            if created:
+                self.stdout.write(f"{series}: generated {len(created)} occurrence(s).")
+
+        self.stdout.write(self.style.SUCCESS(f"Done. Generated {total} occurrence(s) across {EventSeries.objects.count()} series."))
diff --git a/events/migrations/0001_initial.py b/events/migrations/0001_initial.py
new file mode 100644
index 0000000..5cf0a2f
--- /dev/null
+++ b/events/migrations/0001_initial.py
@@ -0,0 +1,87 @@
+# Generated by Django 6.0.6 on 2026-07-12 15:22
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('teams', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Location',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('address', models.CharField(max_length=255, verbose_name='address')),
+                ('city', models.CharField(max_length=255, verbose_name='city')),
+                ('zip_code', models.CharField(max_length=255, verbose_name='zip code')),
+                ('country', models.CharField(max_length=255, verbose_name='country')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'location',
+                'verbose_name_plural': 'locations',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Opponent',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('logo', models.ImageField(blank=True, upload_to='opponents', verbose_name='logo')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'opponent',
+                'verbose_name_plural': 'opponents',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Event',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('kind', models.CharField(choices=[('training', 'training'), ('match', 'match'), ('tournament', 'tournament'), ('meeting', 'meeting'), ('social', 'social'), ('other', 'other')], default='other', max_length=10, verbose_name='kind')),
+                ('title', models.CharField(max_length=255, verbose_name='title')),
+                ('start', models.DateTimeField(verbose_name='start')),
+                ('end', models.DateTimeField(blank=True, null=True, verbose_name='end')),
+                ('gathering', models.DateTimeField(blank=True, null=True, verbose_name='gathering')),
+                ('deadline', models.DateTimeField(blank=True, null=True, verbose_name='deadline')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('team', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='events', to='teams.team', verbose_name='team')),
+                ('location', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='events', to='events.location', verbose_name='location')),
+                ('opponent', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='events', to='events.opponent', verbose_name='opponent')),
+            ],
+            options={
+                'verbose_name': 'event',
+                'verbose_name_plural': 'events',
+                'ordering': ['-start'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Attendance',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('status', models.CharField(choices=[('present', 'present'), ('absent', 'absent'), ('excused', 'excused'), ('selected', 'selected'), ('not_selected', 'not selected'), ('maybe', 'maybe'), ('no_response', 'no response')], default='no_response', max_length=20, verbose_name='status')),
+                ('note', models.TextField(blank=True, verbose_name='note')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='attendances', to='members.member', verbose_name='member')),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='attendances', to='events.event', verbose_name='event')),
+            ],
+            options={
+                'verbose_name': 'attendance',
+                'verbose_name_plural': 'attendances',
+                'ordering': ['event', 'member__last_name', 'member__first_name'],
+                'constraints': [models.UniqueConstraint(fields=('event', 'member'), name='unique_attendance_per_event_per_member')],
+            },
+        ),
+    ]
diff --git a/events/migrations/0002_add_event_audience.py b/events/migrations/0002_add_event_audience.py
new file mode 100644
index 0000000..af3f9f4
--- /dev/null
+++ b/events/migrations/0002_add_event_audience.py
@@ -0,0 +1,37 @@
+# Generated by Django 6.0.6 on 2026-07-12 15:38
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('events', '0001_initial'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('teams', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='event',
+            name='excluded_members',
+            field=models.ManyToManyField(blank=True, related_name='excluded_from_events', to='members.member', verbose_name='excluded members'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='invited_members',
+            field=models.ManyToManyField(blank=True, related_name='invited_to_events', to='members.member', verbose_name='invited members'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='season',
+            field=models.ForeignKey(blank=True, help_text='Season whose team rosters define the audience; derived from the start date when left blank.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='events', to='club.season', verbose_name='season'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='teams',
+            field=models.ManyToManyField(blank=True, related_name='scheduled_events', to='teams.team', verbose_name='teams'),
+        ),
+    ]
diff --git a/events/migrations/0003_copy_team_to_teams.py b/events/migrations/0003_copy_team_to_teams.py
new file mode 100644
index 0000000..0513bec
--- /dev/null
+++ b/events/migrations/0003_copy_team_to_teams.py
@@ -0,0 +1,29 @@
+# Generated by Django 6.0.6 on 2026-07-12 15:38
+
+from django.db import migrations
+
+
+def copy_team_to_teams(apps, schema_editor):
+    Event = apps.get_model("events", "Event")
+    for event in Event.objects.exclude(team__isnull=True).iterator():
+        event.teams.add(event.team_id)
+
+
+def copy_teams_to_team(apps, schema_editor):
+    Event = apps.get_model("events", "Event")
+    for event in Event.objects.iterator():
+        first_team = event.teams.first()
+        if first_team is not None:
+            event.team = first_team
+            event.save(update_fields=["team"])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0002_add_event_audience'),
+    ]
+
+    operations = [
+        migrations.RunPython(copy_team_to_teams, copy_teams_to_team),
+    ]
diff --git a/events/migrations/0004_remove_event_team.py b/events/migrations/0004_remove_event_team.py
new file mode 100644
index 0000000..402fa3a
--- /dev/null
+++ b/events/migrations/0004_remove_event_team.py
@@ -0,0 +1,17 @@
+# Generated by Django 6.0.6 on 2026-07-12 15:38
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0003_copy_team_to_teams'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='event',
+            name='team',
+        ),
+    ]
diff --git a/events/migrations/0005_event_series.py b/events/migrations/0005_event_series.py
new file mode 100644
index 0000000..5671fe7
--- /dev/null
+++ b/events/migrations/0005_event_series.py
@@ -0,0 +1,57 @@
+# Generated by Django 6.0.6 on 2026-07-12 15:47
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('events', '0004_remove_event_team'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('teams', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='event',
+            name='cancelled',
+            field=models.BooleanField(default=False, verbose_name='cancelled'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='detached',
+            field=models.BooleanField(default=False, help_text='Edited independently; excluded from series-wide updates and regeneration.', verbose_name='detached'),
+        ),
+        migrations.CreateModel(
+            name='EventSeries',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('rrule', models.CharField(help_text='RFC 5545 RRULE, e.g. FREQ=WEEKLY;BYDAY=MO,WE.', max_length=255, verbose_name='recurrence rule')),
+                ('dtstart', models.DateTimeField(verbose_name='first occurrence')),
+                ('duration', models.DurationField(blank=True, help_text="Length of each occurrence; sets each event's end.", null=True, verbose_name='duration')),
+                ('excluded_dates', models.JSONField(blank=True, default=list, help_text='ISO start datetimes of occurrences removed from the series (EXDATEs).', verbose_name='excluded dates')),
+                ('generated_until', models.DateTimeField(blank=True, help_text='Occurrences have been materialised up to this point.', null=True, verbose_name='generated until')),
+                ('kind', models.CharField(choices=[('training', 'training'), ('match', 'match'), ('tournament', 'tournament'), ('meeting', 'meeting'), ('social', 'social'), ('other', 'other')], default='other', max_length=10, verbose_name='kind')),
+                ('title', models.CharField(max_length=255, verbose_name='title')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('excluded_members', models.ManyToManyField(blank=True, related_name='excluded_from_event_series', to='members.member', verbose_name='excluded members')),
+                ('invited_members', models.ManyToManyField(blank=True, related_name='invited_to_event_series', to='members.member', verbose_name='invited members')),
+                ('location', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='event_series', to='events.location', verbose_name='location')),
+                ('opponent', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='event_series', to='events.opponent', verbose_name='opponent')),
+                ('teams', models.ManyToManyField(blank=True, related_name='event_series', to='teams.team', verbose_name='teams')),
+            ],
+            options={
+                'verbose_name': 'event series',
+                'verbose_name_plural': 'event series',
+                'ordering': ['title'],
+            },
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='series',
+            field=models.ForeignKey(blank=True, help_text='The recurring series this occurrence belongs to; blank for one-off events.', null=True, on_delete=django.db.models.deletion.CASCADE, related_name='occurrences', to='events.eventseries', verbose_name='series'),
+        ),
+    ]
diff --git a/events/migrations/0006_event_series_offsets.py b/events/migrations/0006_event_series_offsets.py
new file mode 100644
index 0000000..3f3c10f
--- /dev/null
+++ b/events/migrations/0006_event_series_offsets.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-07-12 16:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0005_event_series'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='eventseries',
+            name='deadline_offset',
+            field=models.DurationField(blank=True, help_text="How long before the start each occurrence's sign-up deadline is.", null=True, verbose_name='deadline offset'),
+        ),
+        migrations.AddField(
+            model_name='eventseries',
+            name='gathering_offset',
+            field=models.DurationField(blank=True, help_text="How long before the start each occurrence's gathering time is.", null=True, verbose_name='gathering offset'),
+        ),
+    ]
diff --git a/events/migrations/0007_event_series_until.py b/events/migrations/0007_event_series_until.py
new file mode 100644
index 0000000..299b554
--- /dev/null
+++ b/events/migrations/0007_event_series_until.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-12 17:21
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0006_event_series_offsets'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='eventseries',
+            name='until',
+            field=models.DateTimeField(blank=True, help_text="Series end: no occurrences are generated after this. Leave blank for open-ended (bounded by the rule's own COUNT/UNTIL, if any).", null=True, verbose_name='until'),
+        ),
+    ]
diff --git a/events/migrations/0008_event_created_by.py b/events/migrations/0008_event_created_by.py
new file mode 100644
index 0000000..a71a4d7
--- /dev/null
+++ b/events/migrations/0008_event_created_by.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-12 21:43
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0007_event_series_until'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='event',
+            name='created_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='created_events', to='members.member', verbose_name='created by'),
+        ),
+    ]
diff --git a/events/migrations/0009_attendance_created_attendance_modified_event_created_and_more.py b/events/migrations/0009_attendance_created_attendance_modified_event_created_and_more.py
new file mode 100644
index 0000000..4a3a4d3
--- /dev/null
+++ b/events/migrations/0009_attendance_created_attendance_modified_event_created_and_more.py
@@ -0,0 +1,69 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0008_event_created_by'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='attendance',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565980, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='attendance',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 565998, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='eventseries',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566017, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='eventseries',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='location',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566033, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='location',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='opponent',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566050, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='opponent',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+    ]
diff --git a/events/migrations/0010_attendance_showed_up.py b/events/migrations/0010_attendance_showed_up.py
new file mode 100644
index 0000000..8ca25f2
--- /dev/null
+++ b/events/migrations/0010_attendance_showed_up.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-08-03 20:55
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0009_attendance_created_attendance_modified_event_created_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='attendance',
+            name='showed_up',
+            field=models.BooleanField(blank=True, default=None, help_text='Recorded by a check-in, separate from the RSVP status above. Blank means no check-in has been recorded yet.', null=True, verbose_name='showed up'),
+        ),
+    ]
diff --git a/events/migrations/0011_location_is_home_and_more.py b/events/migrations/0011_location_is_home_and_more.py
new file mode 100644
index 0000000..4bf2339
--- /dev/null
+++ b/events/migrations/0011_location_is_home_and_more.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-08-04 09:37
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0017_club_season_duration_months_club_season_start'),
+        ('events', '0010_attendance_showed_up'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='location',
+            name='is_home',
+            field=models.BooleanField(default=False, help_text="The club's own ground, set from the control panel -- lets an event's location tell a home game from an away one.", verbose_name='home location'),
+        ),
+        migrations.AddConstraint(
+            model_name='location',
+            constraint=models.UniqueConstraint(condition=models.Q(('is_home', True)), fields=('club',), name='unique_home_location_per_club'),
+        ),
+    ]
diff --git a/events/migrations/0012_alter_location_country.py b/events/migrations/0012_alter_location_country.py
new file mode 100644
index 0000000..30aa30b
--- /dev/null
+++ b/events/migrations/0012_alter_location_country.py
@@ -0,0 +1,19 @@
+# Generated by Django 6.0.6 on 2026-08-04 09:45
+
+import django_countries.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0011_location_is_home_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='location',
+            name='country',
+            field=django_countries.fields.CountryField(max_length=2, verbose_name='country'),
+        ),
+    ]
diff --git a/events/migrations/0013_alter_event_kind_alter_eventseries_kind.py b/events/migrations/0013_alter_event_kind_alter_eventseries_kind.py
new file mode 100644
index 0000000..12744a2
--- /dev/null
+++ b/events/migrations/0013_alter_event_kind_alter_eventseries_kind.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-08-04 11:24
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0012_alter_location_country'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='event',
+            name='kind',
+            field=models.CharField(choices=[('training', 'Training'), ('match', 'Match'), ('tournament', 'Tournament'), ('meeting', 'Meeting'), ('social', 'Social'), ('other', 'Other')], default='other', max_length=10, verbose_name='kind'),
+        ),
+        migrations.AlterField(
+            model_name='eventseries',
+            name='kind',
+            field=models.CharField(choices=[('training', 'Training'), ('match', 'Match'), ('tournament', 'Tournament'), ('meeting', 'Meeting'), ('social', 'Social'), ('other', 'Other')], default='other', max_length=10, verbose_name='kind'),
+        ),
+    ]
diff --git a/events/migrations/0014_event_competition_event_external_game_id_and_more.py b/events/migrations/0014_event_competition_event_external_game_id_and_more.py
new file mode 100644
index 0000000..ce2b36d
--- /dev/null
+++ b/events/migrations/0014_event_competition_event_external_game_id_and_more.py
@@ -0,0 +1,73 @@
+# Generated by Django 6.0.6 on 2026-08-04 11:28
+
+from django.db import migrations, models
+
+
+def rename_match_to_game(apps, schema_editor):
+    Event = apps.get_model('events', 'Event')
+    EventSeries = apps.get_model('events', 'EventSeries')
+    Event.objects.filter(kind='match').update(kind='game')
+    EventSeries.objects.filter(kind='match').update(kind='game')
+
+
+def rename_game_to_match(apps, schema_editor):
+    Event = apps.get_model('events', 'Event')
+    EventSeries = apps.get_model('events', 'EventSeries')
+    Event.objects.filter(kind='game').update(kind='match')
+    EventSeries.objects.filter(kind='game').update(kind='match')
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0013_alter_event_kind_alter_eventseries_kind'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='event',
+            name='competition',
+            field=models.CharField(blank=True, help_text='The league, cup or competition this game is part of.', max_length=255, verbose_name='competition'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='external_game_id',
+            field=models.CharField(blank=True, help_text="This game's id in an external competition data source, for automatic score fetching later.", max_length=255, verbose_name='external game ID'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='is_live',
+            field=models.BooleanField(default=False, help_text='The game is currently in progress.', verbose_name='live'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='score_against',
+            field=models.PositiveSmallIntegerField(blank=True, null=True, verbose_name='score (opponent)'),
+        ),
+        migrations.AddField(
+            model_name='event',
+            name='score_for',
+            field=models.PositiveSmallIntegerField(blank=True, null=True, verbose_name='score (us)'),
+        ),
+        migrations.AlterField(
+            model_name='event',
+            name='deadline',
+            field=models.DateTimeField(blank=True, null=True, verbose_name='registration deadline'),
+        ),
+        migrations.AlterField(
+            model_name='event',
+            name='kind',
+            field=models.CharField(choices=[('training', 'Training'), ('game', 'Game'), ('tournament', 'Tournament'), ('meeting', 'Meeting'), ('social', 'Social'), ('other', 'Other')], default='other', max_length=10, verbose_name='kind'),
+        ),
+        migrations.AlterField(
+            model_name='eventseries',
+            name='deadline_offset',
+            field=models.DurationField(blank=True, help_text="How long before the start each occurrence's registration deadline is.", null=True, verbose_name='registration deadline offset'),
+        ),
+        migrations.AlterField(
+            model_name='eventseries',
+            name='kind',
+            field=models.CharField(choices=[('training', 'Training'), ('game', 'Game'), ('tournament', 'Tournament'), ('meeting', 'Meeting'), ('social', 'Social'), ('other', 'Other')], default='other', max_length=10, verbose_name='kind'),
+        ),
+        migrations.RunPython(rename_match_to_game, rename_game_to_match),
+    ]
diff --git a/events/migrations/0015_alter_attendance_status.py b/events/migrations/0015_alter_attendance_status.py
new file mode 100644
index 0000000..9806fc1
--- /dev/null
+++ b/events/migrations/0015_alter_attendance_status.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-08-04 13:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0014_event_competition_event_external_game_id_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='attendance',
+            name='status',
+            field=models.CharField(choices=[('present', 'Present'), ('absent', 'Absent'), ('excused', 'Excused'), ('selected', 'Selected'), ('not_selected', 'Not selected'), ('maybe', 'Maybe'), ('no_response', 'No response')], default='no_response', max_length=20, verbose_name='status'),
+        ),
+    ]
diff --git a/events/migrations/0016_competition.py b/events/migrations/0016_competition.py
new file mode 100644
index 0000000..de87485
--- /dev/null
+++ b/events/migrations/0016_competition.py
@@ -0,0 +1,21 @@
+# Generated by Django 6.0.6 on 2026-08-04 21:22
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0015_alter_attendance_status'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Competition',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=250)),
+                ('module', models.CharField(max_length=250)),
+            ],
+        ),
+    ]
diff --git a/events/migrations/0017_auto_20260804_2322.py b/events/migrations/0017_auto_20260804_2322.py
new file mode 100644
index 0000000..3a00f3f
--- /dev/null
+++ b/events/migrations/0017_auto_20260804_2322.py
@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-08-04 21:22
+
+from django.db import migrations
+
+
+def create_competiton_group(apps, schema_editor):
+    Competition = apps.get_model("events", "Competition")
+    
+    try:
+        Competition.objects.create(name="RBIHF", module="events.competition.hockey")
+        Competition.objects.create(name="CEHL", module="events.competition.hockey")
+    
+    except:
+        pass
+
+
+def remove_competiton_group(apps, schema_editor):
+    Competition = apps.get_model("events", "Competition")
+    
+    try:
+        Competition.objects.get(name="RBIHF", module="events.competition.hockey").delete()
+        Competition.objects.get(name="CEHL", module="events.competition.hockey")
+    
+    except:
+        pass
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('events', '0016_competition'),
+    ]
+    
+    operations = [migrations.RunPython(create_competiton_group, remove_competiton_group)]
diff --git a/events/migrations/0018_alter_competition_options_competition_flag.py b/events/migrations/0018_alter_competition_options_competition_flag.py
new file mode 100644
index 0000000..77a4c2c
--- /dev/null
+++ b/events/migrations/0018_alter_competition_options_competition_flag.py
@@ -0,0 +1,43 @@
+# Generated by Django 6.0.6 on 2026-08-04 21:32
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+def create_flags_for_seeded_competitions(apps, schema_editor):
+    """RBIHF/CEHL (0017's data migration) predate the flag field -- give them one
+    each so they're actually selectable (unflagged competitions never show up
+    in the Event admin's dropdown) instead of silently invisible."""
+    Competition = apps.get_model("events", "Competition")
+    Flag = apps.get_model(*settings.WAFFLE_FLAG_MODEL.split("."))
+
+    for competition in Competition.objects.filter(flag__isnull=True):
+        flag, _created = Flag.objects.get_or_create(name=competition.name)
+        competition.flag = flag
+        competition.save(update_fields=["flag"])
+
+
+def noop(apps, schema_editor):
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0017_auto_20260804_2322'),
+        migrations.swappable_dependency(settings.WAFFLE_FLAG_MODEL),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='competition',
+            options={'ordering': ['name'], 'verbose_name': 'competition', 'verbose_name_plural': 'competitions'},
+        ),
+        migrations.AddField(
+            model_name='competition',
+            name='flag',
+            field=models.ForeignKey(blank=True, help_text="Which clubs this competition is offered to -- set (or leave blank to hide it everywhere) from the control panel's Features page. A competition with no flag never shows up on the Event admin's competition dropdown.", null=True, on_delete=django.db.models.deletion.PROTECT, related_name='competitions', to=settings.WAFFLE_FLAG_MODEL, verbose_name='feature flag'),
+        ),
+        migrations.RunPython(create_flags_for_seeded_competitions, noop),
+    ]
diff --git a/events/migrations/0019_competition_sport_type.py b/events/migrations/0019_competition_sport_type.py
new file mode 100644
index 0000000..6b366dc
--- /dev/null
+++ b/events/migrations/0019_competition_sport_type.py
@@ -0,0 +1,31 @@
+# Generated by Django 6.0.6 on 2026-08-04 22:09
+
+from django.db import migrations, models
+
+
+def mark_seeded_hockey_competitions(apps, schema_editor):
+    """RBIHF/CEHL (0017's data migration) predate sport_type -- they're both ice
+    hockey leagues (see events/competition/hockey.py), so backfill them rather
+    than leaving them at the generic "other" default."""
+    Competition = apps.get_model("events", "Competition")
+    Competition.objects.filter(name__in=["RBIHF", "CEHL"]).update(sport_type="ice_hockey")
+
+
+def noop(apps, schema_editor):
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('events', '0018_alter_competition_options_competition_flag'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='competition',
+            name='sport_type',
+            field=models.CharField(choices=[('ice_hockey', 'Ice hockey'), ('other', 'Other')], default='other', help_text='Which sport this competition is for.', max_length=20, verbose_name='sport'),
+        ),
+        migrations.RunPython(mark_seeded_hockey_competitions, noop),
+    ]
diff --git a/events/migrations/__init__.py b/events/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/events/models.py b/events/models.py
new file mode 100644
index 0000000..a8f0204
--- /dev/null
+++ b/events/models.py
@@ -0,0 +1,203 @@
+from django.conf import settings
+from django.db import models
+from django.db.models import Q
+from django.utils.translation import gettext_lazy as _
+from django_countries.fields import CountryField
+
+from club.models import Club, Season
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel, validate_club_scope
+from teams.models import Team
+
+
+class Opponent(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    logo = models.ImageField(_("logo"), upload_to="opponents", blank=True)
+
+    class Meta:
+        verbose_name = _("opponent")
+        verbose_name_plural = _("opponents")
+        ordering = ["name"]
+
+    def __str__(self):
+        return self.name
+
+
+class Location(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    address = models.CharField(_("address"), max_length=255)
+    city = models.CharField(_("city"), max_length=255)
+    zip_code = models.CharField(_("zip code"), max_length=255)
+    country = CountryField(_("country"))
+    is_home = models.BooleanField(
+        _("home location"),
+        default=False,
+        help_text=_("The club's own ground, set from the control panel -- lets an event's location tell a home game from an away one."),
+    )
+
+    class Meta:
+        verbose_name = _("location")
+        verbose_name_plural = _("locations")
+        ordering = ["name"]
+        constraints = [
+            models.UniqueConstraint(fields=["club"], condition=Q(is_home=True), name="unique_home_location_per_club"),
+        ]
+
+    def __str__(self):
+        return self.name
+
+
+class Event(ClubScopedModel):
+    class EventKind(models.TextChoices):
+        TRAINING = "training", _("Training")
+        GAME = "game", _("Game")
+        TOURNAMENT = "tournament", _("Tournament")
+        MEETING = "meeting", _("Meeting")
+        SOCIAL = "social", _("Social")
+        OTHER = "other", _("Other")
+
+    series = models.ForeignKey("EventSeries", on_delete=models.CASCADE, related_name="occurrences", null=True, blank=True, verbose_name=_("series"), help_text=_("The recurring series this occurrence belongs to; blank for one-off events."))
+    detached = models.BooleanField(_("detached"), default=False, help_text=_("Edited independently; excluded from series-wide updates and regeneration."))
+    cancelled = models.BooleanField(_("cancelled"), default=False)
+
+    teams = models.ManyToManyField(Team, related_name="scheduled_events", blank=True, verbose_name=_("teams"))
+    invited_members = models.ManyToManyField(Member, related_name="invited_to_events", blank=True, verbose_name=_("invited members"))
+    excluded_members = models.ManyToManyField(Member, related_name="excluded_from_events", blank=True, verbose_name=_("excluded members"))
+    season = models.ForeignKey(Season, on_delete=models.SET_NULL, related_name="events", null=True, blank=True, verbose_name=_("season"), help_text=_("Season whose team rosters define the audience; derived from the start date when left blank."))
+
+    kind = models.CharField(_("kind"), max_length=10, choices=EventKind.choices, default=EventKind.OTHER)
+    title = models.CharField(_("title"), max_length=255)
+
+    start = models.DateTimeField(_("start"))
+    end = models.DateTimeField(_("end"), blank=True, null=True)
+    gathering = models.DateTimeField(_("gathering"), blank=True, null=True)
+    deadline = models.DateTimeField(_("registration deadline"), blank=True, null=True)
+
+    location = models.ForeignKey(Location, on_delete=models.SET_NULL, related_name="events", null=True, blank=True, verbose_name=_("location"))
+    opponent = models.ForeignKey(Opponent, on_delete=models.SET_NULL, related_name="events", null=True, blank=True, verbose_name=_("opponent"))
+    created_by = models.ForeignKey(Member, on_delete=models.SET_NULL, related_name="created_events", null=True, blank=True, verbose_name=_("created by"))
+
+    # Game-specific -- meaningless for other kinds, so all optional. external_game_id
+    # is this game's id in an external competition/fixture data source, for a later
+    # automatic score-fetcher to key off; nothing populates it yet.
+    competition = models.CharField(_("competition"), max_length=255, blank=True, help_text=_("The league, cup or competition this game is part of."))
+    external_game_id = models.CharField(_("external game ID"), max_length=255, blank=True, help_text=_("This game's id in an external competition data source, for automatic score fetching later."))
+    score_for = models.PositiveSmallIntegerField(_("score (us)"), null=True, blank=True)
+    score_against = models.PositiveSmallIntegerField(_("score (opponent)"), null=True, blank=True)
+    is_live = models.BooleanField(_("live"), default=False, help_text=_("The game is currently in progress."))
+
+    class Meta:
+        verbose_name = _("event")
+        verbose_name_plural = _("events")
+        ordering = ["-start"]
+
+    def __str__(self):
+        return self.title
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("season", "location", "opponent"))
+
+    @property
+    def is_home_game(self) -> bool:
+        """Whether this game is being played at the club's own ground
+        (Location.is_home) -- False for anything that isn't a game, or a game
+        with no location set, or one at an away/neutral location."""
+        return self.kind == self.EventKind.GAME and self.location_id is not None and self.location.is_home
+
+
+class EventSeries(ClubScopedModel):
+    """A recurring event definition that materialises concrete Event rows."""
+
+    rrule = models.CharField(_("recurrence rule"), max_length=255, help_text=_("RFC 5545 RRULE, e.g. FREQ=WEEKLY;BYDAY=MO,WE."))
+    dtstart = models.DateTimeField(_("first occurrence"))
+    until = models.DateTimeField(_("until"), null=True, blank=True, help_text=_("Series end: no occurrences are generated after this. Leave blank for open-ended (bounded by the rule's own COUNT/UNTIL, if any)."))
+    duration = models.DurationField(_("duration"), null=True, blank=True, help_text=_("Length of each occurrence; sets each event's end."))
+    gathering_offset = models.DurationField(_("gathering offset"), null=True, blank=True, help_text=_("How long before the start each occurrence's gathering time is."))
+    deadline_offset = models.DurationField(_("registration deadline offset"), null=True, blank=True, help_text=_("How long before the start each occurrence's registration deadline is."))
+    excluded_dates = models.JSONField(_("excluded dates"), default=list, blank=True, help_text=_("ISO start datetimes of occurrences removed from the series (EXDATEs)."))
+    generated_until = models.DateTimeField(_("generated until"), null=True, blank=True, help_text=_("Occurrences have been materialised up to this point."))
+
+    # Template copied onto each generated occurrence.
+    kind = models.CharField(_("kind"), max_length=10, choices=Event.EventKind.choices, default=Event.EventKind.OTHER)
+    title = models.CharField(_("title"), max_length=255)
+    location = models.ForeignKey(Location, on_delete=models.SET_NULL, related_name="event_series", null=True, blank=True, verbose_name=_("location"))
+    opponent = models.ForeignKey(Opponent, on_delete=models.SET_NULL, related_name="event_series", null=True, blank=True, verbose_name=_("opponent"))
+    teams = models.ManyToManyField(Team, related_name="event_series", blank=True, verbose_name=_("teams"))
+    invited_members = models.ManyToManyField(Member, related_name="invited_to_event_series", blank=True, verbose_name=_("invited members"))
+    excluded_members = models.ManyToManyField(Member, related_name="excluded_from_event_series", blank=True, verbose_name=_("excluded members"))
+
+    class Meta:
+        verbose_name = _("event series")
+        verbose_name_plural = _("event series")
+        ordering = ["title"]
+
+    def __str__(self):
+        return self.title
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("location", "opponent"))
+
+
+class Attendance(UUIDModel):
+    class AttendanceStatus(models.TextChoices):
+        PRESENT = "present", _("Present")
+        ABSENT = "absent", _("Absent")
+        EXCUSED = "excused", _("Excused")
+        SELECTED = "selected", _("Selected")
+        NOT_SELECTED = "not_selected", _("Not selected")
+        MAYBE = "maybe", _("Maybe")
+        NO_RESPONSE = "no_response", _("No response")
+
+    event = models.ForeignKey(Event, on_delete=models.CASCADE, related_name="attendances", verbose_name=_("event"))
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="attendances", verbose_name=_("member"))
+    status = models.CharField(_("status"), max_length=20, choices=AttendanceStatus.choices, default=AttendanceStatus.NO_RESPONSE)
+    showed_up = models.BooleanField(
+        _("showed up"),
+        null=True,
+        blank=True,
+        default=None,
+        help_text=_("Recorded by a check-in, separate from the RSVP status above. Blank means no check-in has been recorded yet."),
+    )
+    note = models.TextField(_("note"), blank=True)
+
+    class Meta:
+        verbose_name = _("attendance")
+        verbose_name_plural = _("attendances")
+        ordering = ["event", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["event", "member"], name="unique_attendance_per_event_per_member"),
+        ]
+
+    def __str__(self):
+        return f"{self.event} - {self.member}"
+
+
+class Competition(models.Model):
+    """A competition has a name with a specific URL to fetch data from. These are managed centrally."""
+
+    name = models.CharField(max_length=250)
+    module = models.CharField(max_length=250)
+    sport_type = models.CharField(
+        _("sport"),
+        max_length=20,
+        choices=Club.SportType.choices,
+        default=Club.SportType.OTHER,
+        help_text=_("Which sport this competition is for."),
+    )
+    flag = models.ForeignKey(
+        settings.WAFFLE_FLAG_MODEL,
+        on_delete=models.PROTECT,
+        null=True,
+        blank=True,
+        related_name="competitions",
+        verbose_name=_("feature flag"),
+        help_text=_("Which clubs this competition is offered to -- set (or leave blank to hide it everywhere) from the control panel's Features page. A competition with no flag never shows up on the Event admin's competition dropdown."),
+    )
+
+    class Meta:
+        verbose_name = _("competition")
+        verbose_name_plural = _("competitions")
+        ordering = ["name"]
+
+    def __str__(self):
+        return self.name
diff --git a/events/services/__init__.py b/events/services/__init__.py
new file mode 100644
index 0000000..38c1135
--- /dev/null
+++ b/events/services/__init__.py
@@ -0,0 +1,35 @@
+from .attendance import (
+    effective_members,
+    player_attendance_rankings,
+    players_who_missed_recent_practices,
+    record_check_in,
+    sync_event_attendances,
+    team_attendance_rate,
+    team_no_shows,
+)
+from .recurrence import (
+    apply_template,
+    cancel_occurrence,
+    detach_occurrence,
+    generate_occurrences,
+    horizon,
+    occurrence_datetimes,
+    propagate_series,
+)
+
+__all__ = [
+    "apply_template",
+    "cancel_occurrence",
+    "detach_occurrence",
+    "effective_members",
+    "generate_occurrences",
+    "horizon",
+    "occurrence_datetimes",
+    "player_attendance_rankings",
+    "players_who_missed_recent_practices",
+    "propagate_series",
+    "record_check_in",
+    "sync_event_attendances",
+    "team_attendance_rate",
+    "team_no_shows",
+]
diff --git a/events/services/attendance.py b/events/services/attendance.py
new file mode 100644
index 0000000..03383a8
--- /dev/null
+++ b/events/services/attendance.py
@@ -0,0 +1,142 @@
+"""Keep an event's attendance rows in sync with its effective audience.
+
+The audience of an event is the union of the current rosters of its ``teams``
+(for the event's season) plus any individually ``invited_members``, minus any
+``excluded_members``. Attendance rows are reconciled against that set, but only
+for events that are still in the future — history is never rewritten.
+"""
+
+from django.db.models import Count, Q
+from django.utils import timezone
+
+from club.models import Season
+from events.models import Attendance, Event
+from members.models import Member
+from teams.models import TeamMembership
+
+
+def resolve_season(event):
+    """The season whose rosters define the event's audience."""
+    if event.season_id is not None:
+        return event.season
+    return Season.covering(event.club, event.start.date())
+
+
+def effective_members(event):
+    """Return the ``Member`` queryset invited to ``event``."""
+    member_ids: set = set()
+
+    season = resolve_season(event)
+    if season is not None:
+        team_ids = list(event.teams.values_list("id", flat=True))
+        if team_ids:
+            member_ids.update(TeamMembership.objects.filter(team_id__in=team_ids, season=season).values_list("member_id", flat=True))
+
+    member_ids.update(event.invited_members.values_list("id", flat=True))
+    member_ids.difference_update(event.excluded_members.values_list("id", flat=True))
+
+    return Member.objects.filter(id__in=member_ids)
+
+
+def sync_event_attendances(event):
+    """Reconcile ``event``'s attendance rows with its effective audience.
+
+    No-op for events that have already started. New members get a
+    ``NO_RESPONSE`` row; members no longer invited have their row removed
+    outright (hard reconcile).
+    """
+    if event.start < timezone.now():
+        return
+
+    desired_ids = set(effective_members(event).values_list("id", flat=True))
+    existing_ids = set(event.attendances.values_list("member_id", flat=True))
+
+    to_add = desired_ids - existing_ids
+    if to_add:
+        Attendance.objects.bulk_create([Attendance(event=event, member_id=member_id) for member_id in to_add])
+
+    to_remove = existing_ids - desired_ids
+    if to_remove:
+        event.attendances.filter(member_id__in=to_remove).delete()
+
+
+def record_check_in(attendance, *, showed_up):
+    """Record whether ``attendance``'s member actually showed up, separate from
+    their RSVP status -- the hook a future check-in UI (the coaches app) writes
+    through. Nothing in this codebase calls this yet; it exists so a no-show can
+    be recorded the moment something does."""
+    attendance.showed_up = showed_up
+    attendance.save(update_fields=["showed_up"])
+
+
+def team_attendance_rate(team, season):
+    """Turnout for ``team`` in ``season``: present / (present + absent) among
+    past events -- same definition as
+    controlpanel.services.statistics.attendance_rates, just scoped to one team
+    instead of the whole club."""
+    counts = Attendance.objects.filter(event__teams=team, event__season=season, event__start__lt=timezone.now()).aggregate(
+        present=Count("id", filter=Q(status=Attendance.AttendanceStatus.PRESENT)),
+        absent=Count("id", filter=Q(status=Attendance.AttendanceStatus.ABSENT)),
+    )
+    answered = counts["present"] + counts["absent"]
+    return round(100 * counts["present"] / answered) if answered else None
+
+
+def player_attendance_rankings(team, season, *, minimum_responses=3):
+    """Each player's turnout this season, best first:
+    ``[{"member": Member, "rate": int, "responses": int}, ...]``. Excludes
+    anyone with fewer than ``minimum_responses`` present/absent replies -- one
+    absence out of one invite would otherwise read as "0%, worst on the team."
+    """
+    rows = (
+        Attendance.objects.filter(
+            event__teams=team,
+            event__season=season,
+            event__start__lt=timezone.now(),
+            status__in=[Attendance.AttendanceStatus.PRESENT, Attendance.AttendanceStatus.ABSENT],
+        )
+        .values("member")
+        .annotate(present=Count("id", filter=Q(status=Attendance.AttendanceStatus.PRESENT)), responses=Count("id"))
+        .filter(responses__gte=minimum_responses)
+    )
+
+    members_by_id = Member.objects.in_bulk([row["member"] for row in rows])
+    rankings = [{"member": members_by_id[row["member"]], "rate": round(100 * row["present"] / row["responses"]), "responses": row["responses"]} for row in rows]
+    rankings.sort(key=lambda entry: entry["rate"], reverse=True)
+    return rankings
+
+
+def players_who_missed_recent_practices(team, season, *, count=2):
+    """Members absent or silent (not excused) on *every one* of the team's
+    ``count`` most recent past training-kind events this season. Empty if the
+    team has fewer than ``count`` past practices logged yet -- not enough
+    history to call anyone out."""
+    practices = list(Event.objects.filter(teams=team, season=season, kind=Event.EventKind.TRAINING, start__lt=timezone.now()).order_by("-start")[:count])
+    if len(practices) < count:
+        return Member.objects.none()
+
+    flagged = (Attendance.AttendanceStatus.ABSENT, Attendance.AttendanceStatus.NO_RESPONSE)
+    missed_by_member = None
+    for practice in practices:
+        missed_here = set(Attendance.objects.filter(event=practice, status__in=flagged).values_list("member_id", flat=True))
+        missed_by_member = missed_here if missed_by_member is None else missed_by_member & missed_here
+
+    return Member.objects.filter(pk__in=missed_by_member).order_by("last_name", "first_name")
+
+
+def team_no_shows(team, season):
+    """Attendance rows where the member RSVPed present/selected but was
+    checked in as showed_up=False -- most recent first. Each entry carries
+    both the member and the event: a no-show is about a specific missed
+    occasion, not a season-long rate. Never inferred from a missing check-in --
+    with nothing checking anyone in yet, that would flag every "present" RSVP."""
+    return (
+        Attendance.objects.filter(
+            event__teams=team,
+            event__season=season,
+            status__in=[Attendance.AttendanceStatus.PRESENT, Attendance.AttendanceStatus.SELECTED],
+            showed_up=False,
+        )
+        .select_related("member", "event")
+        .order_by("-event__start")
+    )
diff --git a/events/services/competitions.py b/events/services/competitions.py
new file mode 100644
index 0000000..0efc982
--- /dev/null
+++ b/events/services/competitions.py
@@ -0,0 +1,46 @@
+"""Refreshing a game's score/status from its competition's own data source.
+
+Event.competition (free text) and Event.external_game_id (that source's id for this
+fixture) exist so a real integration has somewhere to key off later -- nothing
+fetches anything yet. This is that integration's landing spot: the button and view
+that call it already exist (management/views.py::EventFetchGameInfoView), so wiring
+up a real data source later is a matter of replacing fetch_game_info's body, not
+building the UI around it.
+"""
+
+import importlib
+
+from events.models import Competition
+
+
+class CompetitionFetchError(Exception):
+    """A game's info could not be fetched from its competition's data source."""
+
+
+def fetch_game_info(event) -> bool:
+    """Refresh `event`'s score/live status from its competition's data source.
+
+    Gated on that competition's own feature flag being active for the event's
+    club: the management form's competition dropdown deliberately shows every
+    competition regardless of flag (see management.forms.EventForm), so this is
+    where per-club access actually gets enforced. No flag, an inactive one, or
+    a competition name that matches nothing -- there's no data source this club
+    is allowed to use, so this quietly does nothing and returns False rather
+    than erroring: missing access isn't a failure to report.
+
+    Returns whether a fetch was actually attempted.
+    """
+    competition = Competition.objects.filter(name=event.competition).select_related("flag").first()
+    if competition is None or competition.flag is None or not competition.flag.is_active_for_club(event.club):
+        return False
+
+    try:
+        module = importlib.import_module(competition.module)
+        competition = getattr(module, competition.name)
+
+        competition().update_game_information(event=event)
+
+        return True
+
+    except Exception as error:
+        raise CompetitionFetchError("No competition data source is configured yet -- there's nothing to fetch from.") from error
diff --git a/events/services/rbihf_import.py b/events/services/rbihf_import.py
new file mode 100644
index 0000000..a043d24
--- /dev/null
+++ b/events/services/rbihf_import.py
@@ -0,0 +1,297 @@
+"""Importing a team's fixture list from RBIHF's own website.
+
+RBIHF publishes a team's schedule at ``https://www.rbihf.be/league/team/<id>`` --
+an HTML page, not an API, scraped with BeautifulSoup. This is the create/update/
+delete counterpart to ``events.services.competitions.fetch_game_info``, which
+only ever refreshes a single *existing* game's score: this is how those `Event`
+rows get created in the first place.
+
+Two-step flow, mirroring ``management.bulk_import`` (the member Excel import):
+``build_plan`` is pure with respect to the outside world once it has the raw
+HTML (no further network calls), so a view can render a preview from it and
+then re-run it unchanged at confirm time -- see management/views.py.
+"""
+
+import re
+from dataclasses import dataclass, field
+from datetime import datetime
+
+import requests
+from bs4 import BeautifulSoup
+from django.db import transaction
+from django.db.models import Q
+from django.utils import timezone
+
+from events.models import Event, Location, Opponent
+
+TEAM_URL_RE = re.compile(r"^https://(?:www\.)?rbihf\.be/league/team/(?P<team_id>\d+)/?$")
+
+REQUEST_HEADERS = {
+    "Cookie": "language=en",
+    "User-Agent": "Mozilla/5.0 (compatible; RosterChief/1.0)",
+    "Accept": "text/html",
+}
+REQUEST_TIMEOUT_SECONDS = 15
+
+
+class RBIHFImportError(Exception):
+    """The page couldn't be fetched, or didn't look like an RBIHF team schedule."""
+
+
+def extract_team_id(url: str) -> str:
+    match = TEAM_URL_RE.match(url.strip())
+    if not match:
+        raise RBIHFImportError("That doesn't look like an RBIHF team page -- expected something like https://www.rbihf.be/league/team/4460.")
+    return match.group("team_id")
+
+
+def fetch_html(url: str) -> str:
+    try:
+        response = requests.get(url, headers=REQUEST_HEADERS, timeout=REQUEST_TIMEOUT_SECONDS)
+    except requests.RequestException as error:
+        raise RBIHFImportError(f"Could not reach {url}: {error}") from error
+
+    if response.status_code != 200:
+        raise RBIHFImportError(f"{url} returned HTTP {response.status_code}.")
+
+    return response.text
+
+
+@dataclass
+class ScrapedFixture:
+    external_game_id: str
+    start: datetime
+    is_home: bool
+    opponent_name: str
+    venue_text: str
+
+
+def _team_id_from_href(href: str) -> str | None:
+    match = re.search(r"/league/team/(\d+)", href or "")
+    return match.group(1) if match else None
+
+
+def parse_fixtures(html: str, team_id: str) -> tuple[str, list[ScrapedFixture]]:
+    """Returns (the scraped team's own display name, its upcoming fixtures)."""
+    soup = BeautifulSoup(html, "html.parser")
+
+    team_heading = soup.find("h2")
+    if team_heading is None:
+        raise RBIHFImportError("Could not find a team name on this page -- is this really an RBIHF team page?")
+    team_name = team_heading.get_text(strip=True)
+
+    games_heading = soup.find(id="games-upcoming")
+    if games_heading is None:
+        raise RBIHFImportError("Could not find an “Upcoming games” table on this page.")
+    table = games_heading.find_next("table")
+    if table is None:
+        raise RBIHFImportError("Could not find an “Upcoming games” table on this page.")
+
+    fixtures = []
+    for row in table.find_all("tr"):
+        cells = row.find_all("td")
+        if len(cells) < 6:
+            continue  # the header row (<th>s) and any stray rows
+
+        game_link = cells[0].find("a")
+        game_id = game_link.get_text(strip=True) if game_link else cells[0].get_text(strip=True)
+        if not game_id:
+            continue
+
+        date_text = cells[1].get_text(strip=True)
+        hour_text = cells[2].get_text(strip=True)
+        try:
+            naive_start = datetime.strptime(f"{date_text} {hour_text}", "%Y-%m-%d %H:%M")
+        except ValueError:
+            continue  # a row that doesn't match the expected shape -- skip rather than blow up the whole import
+        start = timezone.make_aware(naive_start)
+
+        venue_text = cells[3].get_text(strip=True)
+
+        home_link, visit_link = cells[4].find("a"), cells[5].find("a")
+        if home_link is None or visit_link is None:
+            continue
+
+        home_id = _team_id_from_href(home_link.get("href", ""))
+        visit_id = _team_id_from_href(visit_link.get("href", ""))
+
+        if home_id == team_id:
+            is_home, opponent_name = True, visit_link.get("title") or visit_link.get_text(strip=True)
+        elif visit_id == team_id:
+            is_home, opponent_name = False, home_link.get("title") or home_link.get_text(strip=True)
+        else:
+            continue  # neither side is the team we asked about -- inconsistent row, skip it
+
+        fixtures.append(ScrapedFixture(external_game_id=game_id, start=start, is_home=is_home, opponent_name=opponent_name, venue_text=venue_text))
+
+    return team_name, fixtures
+
+
+def suggested_location(club, fixture: ScrapedFixture):
+    if fixture.is_home:
+        return Location.objects.filter(club=club, is_home=True).first()
+
+    venue = fixture.venue_text.strip()
+    if not venue:
+        return None
+    return Location.objects.filter(club=club).filter(Q(city__iexact=venue) | Q(name__iexact=venue)).first()
+
+
+def suggested_opponent(club, fixture: ScrapedFixture):
+    """A case-insensitive name match among the club's existing Opponents, if
+    any -- RBIHF's own spelling doesn't always match punctuation/casing
+    already on file (e.g. "Rivals FC" vs "Rivals F.C."), and get_or_create's
+    exact-string match alone would just create a near-duplicate instead of
+    reusing it."""
+    name = fixture.opponent_name.strip()
+    if not name:
+        return None
+    return Opponent.objects.filter(club=club, name__iexact=name).first()
+
+
+@dataclass
+class PlannedCreate:
+    fixture: ScrapedFixture
+    suggested_location: Location | None
+    suggested_opponent: Opponent | None = None
+
+
+@dataclass
+class PlannedUpdate:
+    fixture: ScrapedFixture
+    event: Event
+    changes: dict = field(default_factory=dict)  # field name -> (old, new), display-ready strings
+    suggested_location: Location | None = None
+    suggested_opponent: Opponent | None = None
+
+
+@dataclass
+class ImportPlan:
+    club: object
+    team: object
+    scraped_team_name: str
+    location_choices: object  # QuerySet[Location], evaluated once for the template
+    opponent_choices: object = None  # QuerySet[Opponent], evaluated once for the template
+    to_create: list[PlannedCreate] = field(default_factory=list)
+    to_update: list[PlannedUpdate] = field(default_factory=list)
+    to_delete: list[Event] = field(default_factory=list)
+    unchanged_count: int = 0
+
+
+def _describe_changes(event, fixture: ScrapedFixture) -> dict:
+    changes = {}
+    if event.start != fixture.start:
+        changes["start"] = (event.start, fixture.start)
+    existing_opponent = event.opponent.name if event.opponent_id else ""
+    if existing_opponent != fixture.opponent_name:
+        changes["opponent"] = (existing_opponent, fixture.opponent_name)
+    return changes
+
+
+def build_plan(club, team, rbihf_team_id: str, html: str) -> ImportPlan:
+    """Parses ``html`` (already fetched -- see ``fetch_html``) and diffs it
+    against this club/team's existing RBIHF events. Pure with respect to the
+    network: safe to call twice against the same stashed HTML (preview, then
+    confirm) and get an identical result modulo whatever changed in the DB
+    between the two calls."""
+    scraped_team_name, fixtures = parse_fixtures(html, rbihf_team_id)
+    location_choices = list(Location.objects.filter(club=club).order_by("name"))
+    opponent_choices = list(Opponent.objects.filter(club=club).order_by("name"))
+
+    existing_by_game_id = {event.external_game_id: event for event in Event.objects.filter(club=club, teams=team, competition="RBIHF").exclude(external_game_id="").select_related("opponent", "location")}
+
+    plan = ImportPlan(club=club, team=team, scraped_team_name=scraped_team_name, location_choices=location_choices, opponent_choices=opponent_choices)
+
+    seen_game_ids = set()
+    for fixture in fixtures:
+        seen_game_ids.add(fixture.external_game_id)
+        existing = existing_by_game_id.get(fixture.external_game_id)
+
+        if existing is None:
+            plan.to_create.append(PlannedCreate(fixture=fixture, suggested_location=suggested_location(club, fixture), suggested_opponent=suggested_opponent(club, fixture)))
+            continue
+
+        changes = _describe_changes(existing, fixture)
+        if changes:
+            # Prefer whatever location/opponent is already on the event -- a
+            # previous run's manual pick -- over re-guessing, so a re-import
+            # doesn't silently discard it. Only fall back to a fresh guess
+            # when nothing's set yet.
+            default_location = existing.location if existing.location_id else suggested_location(club, fixture)
+            default_opponent = existing.opponent if existing.opponent_id else suggested_opponent(club, fixture)
+            plan.to_update.append(PlannedUpdate(fixture=fixture, event=existing, changes=changes, suggested_location=default_location, suggested_opponent=default_opponent))
+        else:
+            plan.unchanged_count += 1
+
+    now = timezone.now()
+    for game_id, event in existing_by_game_id.items():
+        if game_id not in seen_game_ids and event.start >= now:
+            plan.to_delete.append(event)
+
+    return plan
+
+
+def apply_plan(plan: ImportPlan, locations_by_game_id: dict, opponents_by_game_id: dict | None = None) -> dict:
+    """Applies everything in ``plan``, resolving each create/update row's
+    location from ``locations_by_game_id`` and opponent from
+    ``opponents_by_game_id`` (both external_game_id -> pk as a plain string,
+    or None/""). A pk that doesn't belong to ``plan.club`` -- or isn't a real
+    pk at all -- is silently ignored rather than trusted: this is user input
+    straight from the confirm POST, not derived data. Compared as strings
+    since the input is whatever a <select> submitted, not already a UUID.
+
+    Blank/missing means different things for the two: no location is a valid,
+    final state (an away game with no venue on file yet), but a game always
+    needs *an* opponent -- so blank there falls back to the same
+    find-or-create-by-scraped-name this always did, rather than leaving it
+    unset."""
+    opponents_by_game_id = opponents_by_game_id or {}
+    locations_by_id = {str(location.pk): location for location in plan.location_choices}
+    opponents_by_id = {str(opponent.pk): opponent for opponent in plan.opponent_choices}
+
+    def resolve_location(game_id):
+        location_id = locations_by_game_id.get(game_id)
+        if not location_id:
+            return None
+        return locations_by_id.get(str(location_id))
+
+    def resolve_opponent(fixture):
+        opponent_id = opponents_by_game_id.get(fixture.external_game_id)
+        if opponent_id:
+            opponent = opponents_by_id.get(str(opponent_id))
+            if opponent is not None:
+                return opponent
+        opponent, _created = Opponent.objects.get_or_create(club=plan.club, name=fixture.opponent_name)
+        return opponent
+
+    created = updated = deleted = 0
+
+    with transaction.atomic():
+        for planned in plan.to_create:
+            opponent = resolve_opponent(planned.fixture)
+            event = Event.objects.create(
+                club=plan.club,
+                title=f"vs {opponent.name}",
+                kind=Event.EventKind.GAME,
+                start=planned.fixture.start,
+                competition="RBIHF",
+                external_game_id=planned.fixture.external_game_id,
+                opponent=opponent,
+                location=resolve_location(planned.fixture.external_game_id),
+            )
+            event.teams.add(plan.team)
+            created += 1
+
+        for planned in plan.to_update:
+            event = planned.event
+            event.start = planned.fixture.start
+            event.opponent = resolve_opponent(planned.fixture)
+            event.location = resolve_location(planned.fixture.external_game_id)
+            event.save(update_fields=["start", "opponent", "location"])
+            updated += 1
+
+        for event in plan.to_delete:
+            event.delete()
+            deleted += 1
+
+    return {"created": created, "updated": updated, "deleted": deleted}
diff --git a/events/services/recurrence.py b/events/services/recurrence.py
new file mode 100644
index 0000000..e54973e
--- /dev/null
+++ b/events/services/recurrence.py
@@ -0,0 +1,112 @@
+"""Materialise concrete Event rows from a recurring EventSeries.
+
+Occurrences are real Event rows (so attendance attaches directly). The series
+holds the RRULE, an anchor ``dtstart``, and a set of ``excluded_dates``
+(EXDATEs). Rows are generated up to a rolling horizon; a single occurrence can
+be cancelled (adds an EXDATE + removes the row) or detached (edited
+independently, so series-wide updates skip it).
+"""
+
+from datetime import timedelta
+
+from dateutil.rrule import rrulestr
+from django.utils import timezone
+
+from events.models import Event
+
+HORIZON_DAYS = 90
+
+
+def horizon():
+    return timezone.now() + timedelta(days=HORIZON_DAYS)
+
+
+def occurrence_datetimes(series, until):
+    """Expand the series' RRULE from its anchor up to ``until``, minus EXDATEs.
+
+    ``until`` is the generation horizon; the series' own ``until`` (its formal
+    end) further caps it, whichever comes first.
+    """
+    if series.until is not None and series.until < until:
+        until = series.until
+
+    rule = rrulestr(series.rrule, dtstart=series.dtstart)
+    excluded = set(series.excluded_dates)
+
+    result = []
+    for occurrence in rule:
+        if occurrence > until:
+            break
+        if occurrence.isoformat() in excluded:
+            continue
+        result.append(occurrence)
+    return result
+
+
+def apply_template(series, event):
+    """Copy the series template (and audience) onto ``event`` and save it.
+
+    Setting the audience M2M fires the sync signal, so attendance follows.
+    """
+    event.kind = series.kind
+    event.title = series.title
+    event.location = series.location
+    event.opponent = series.opponent
+    event.end = event.start + series.duration if series.duration is not None else None
+    event.gathering = event.start - series.gathering_offset if series.gathering_offset is not None else None
+    event.deadline = event.start - series.deadline_offset if series.deadline_offset is not None else None
+    event.save()
+
+    event.teams.set(series.teams.all())
+    event.invited_members.set(series.invited_members.all())
+    event.excluded_members.set(series.excluded_members.all())
+
+
+def generate_occurrences(series, until=None):
+    """Materialise any missing occurrences up to ``until`` (default: horizon)."""
+    until = until or horizon()
+    existing = set(series.occurrences.values_list("start", flat=True))
+
+    created = []
+    for start in occurrence_datetimes(series, until):
+        if start in existing:
+            continue
+        event = Event(club=series.club, series=series, start=start)
+        apply_template(series, event)
+        created.append(event)
+
+    series.generated_until = until
+    series.save(update_fields=["generated_until"])
+    return created
+
+
+def cancel_occurrence(event, *, hard_delete=True):
+    """Drop a single occurrence and record an EXDATE so it isn't regenerated."""
+    series = event.series
+    if series is not None:
+        iso = event.start.isoformat()
+        if iso not in series.excluded_dates:
+            series.excluded_dates = [*series.excluded_dates, iso]
+            series.save(update_fields=["excluded_dates"])
+
+    if hard_delete:
+        event.delete()
+    else:
+        event.cancelled = True
+        event.save(update_fields=["cancelled"])
+
+
+def detach_occurrence(event):
+    """Mark an occurrence as edited independently of the series."""
+    event.detached = True
+    event.save(update_fields=["detached"])
+
+
+def propagate_series(series):
+    """Re-apply the series template to its non-detached future occurrences."""
+    now = timezone.now()
+    updated = []
+    for event in series.occurrences.filter(detached=False, start__gte=now):
+        apply_template(series, event)
+        updated.append(event)
+    return updated
diff --git a/events/signals.py b/events/signals.py
new file mode 100644
index 0000000..ab3b015
--- /dev/null
+++ b/events/signals.py
@@ -0,0 +1,60 @@
+"""Signal wiring that keeps attendance in sync with the event audience.
+
+Registered from ``EventsConfig.ready``. Two triggers:
+
+* editing an event (its ``start``, or its ``teams`` / ``invited_members`` /
+  ``excluded_members``) re-syncs that event;
+* adding or removing a member from a team roster re-syncs that team's future
+  events.
+"""
+
+from django.core.exceptions import ValidationError
+from django.db.models.signals import m2m_changed, post_delete, post_save
+from django.dispatch import receiver
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from events.models import Event, EventSeries
+from events.services import sync_event_attendances
+from teams.models import Team, TeamMembership
+
+M2M_SYNC_ACTIONS = {"post_add", "post_remove", "post_clear"}
+
+
+@receiver(m2m_changed, sender=Event.teams.through)
+@receiver(m2m_changed, sender=EventSeries.teams.through)
+def validate_teams_same_club(sender, instance, action, reverse, pk_set, **kwargs):
+    # Reject teams from another club before they're attached (forward adds only;
+    # the reverse direction — team.scheduled_events.add(...) — is not a used path).
+    if action != "pre_add" or reverse:
+        return
+    if Team.objects.filter(pk__in=pk_set).exclude(club_id=instance.club_id).exists():
+        raise ValidationError(_("Teams must belong to the same club as the event."))
+
+
+@receiver(post_save, sender=Event)
+def sync_on_event_save(sender, instance, **kwargs):
+    sync_event_attendances(instance)
+
+
+@receiver(m2m_changed, sender=Event.teams.through)
+@receiver(m2m_changed, sender=Event.invited_members.through)
+@receiver(m2m_changed, sender=Event.excluded_members.through)
+def sync_on_audience_change(sender, instance, action, reverse, model, pk_set, **kwargs):
+    if action not in M2M_SYNC_ACTIONS:
+        return
+
+    if isinstance(instance, Event):
+        sync_event_attendances(instance)
+    else:
+        # Reverse relation edited (e.g. member.invited_to_events.add(event)).
+        for event in Event.objects.filter(pk__in=pk_set or []):
+            sync_event_attendances(event)
+
+
+@receiver(post_save, sender=TeamMembership)
+@receiver(post_delete, sender=TeamMembership)
+def sync_on_roster_change(sender, instance, **kwargs):
+    now = timezone.now()
+    for event in Event.objects.filter(teams=instance.team_id, start__gte=now).distinct():
+        sync_event_attendances(event)
diff --git a/events/tests.py b/events/tests.py
new file mode 100644
index 0000000..420c088
--- /dev/null
+++ b/events/tests.py
@@ -0,0 +1,895 @@
+from datetime import timedelta
+from io import StringIO
+
+from django.core.exceptions import ValidationError
+from django.core.management import call_command
+from django.db import IntegrityError
+from django.test import TestCase
+from django.utils import timezone
+from waffle import get_waffle_flag_model
+
+from club.models import Club, Season
+from members.models import Member
+from teams.models import Position, Team, TeamMembership
+
+from .admin import EventAdminForm
+from .models import Attendance, Competition, Event, EventSeries, Location, Opponent
+from .services import (
+    cancel_occurrence,
+    detach_occurrence,
+    effective_members,
+    generate_occurrences,
+    occurrence_datetimes,
+    player_attendance_rankings,
+    players_who_missed_recent_practices,
+    propagate_series,
+    record_check_in,
+    team_attendance_rate,
+    team_no_shows,
+)
+from .services.rbihf_import import RBIHFImportError, apply_plan, build_plan, extract_team_id, parse_fixtures, suggested_location, suggested_opponent
+
+
+class EventsTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        today = timezone.localdate()
+        self.season = Season.objects.create(
+            club=self.club,
+            start_date=today - timedelta(days=30),
+            end_date=today + timedelta(days=300),
+        )
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.position = Position.objects.create(club=self.club, name="Forward", short_name="FW")
+        self.alice = Member.objects.create(first_name="Alice", last_name="Ash")
+        self.bob = Member.objects.create(first_name="Bob", last_name="Birch")
+        TeamMembership.objects.create(team=self.team, member=self.alice, season=self.season, position=self.position)
+        TeamMembership.objects.create(team=self.team, member=self.bob, season=self.season, position=self.position)
+        self.future = timezone.now() + timedelta(days=7)
+
+    def make_event(self, **kwargs):
+        kwargs.setdefault("club", self.club)
+        kwargs.setdefault("title", "Training")
+        kwargs.setdefault("start", self.future)
+        if "season" not in kwargs:
+            kwargs["season"] = self.season
+        return Event.objects.create(**kwargs)
+
+    def attendee_ids(self, event):
+        return set(event.attendances.values_list("member_id", flat=True))
+
+
+class EventModelTests(EventsTestBase):
+    def test_str_methods(self):
+        opponent = Opponent.objects.create(club=self.club, name="Rivals FC")
+        location = Location.objects.create(club=self.club, name="Arena", address="1 St", city="Town", zip_code="1000", country="BE")
+        event = self.make_event(title="Big Match")
+        attendance = Attendance.objects.create(event=event, member=self.alice)
+
+        self.assertEqual(str(opponent), "Rivals FC")
+        self.assertEqual(str(location), "Arena")
+        self.assertEqual(str(event), "Big Match")
+        self.assertEqual(str(attendance), "Big Match - Alice Ash")
+
+    def test_attendance_is_unique_per_event_and_member(self):
+        event = self.make_event()
+        Attendance.objects.create(event=event, member=self.alice)
+
+        with self.assertRaises(IntegrityError):
+            Attendance.objects.create(event=event, member=self.alice)
+
+    def test_is_home_game(self):
+        home_ground = Location.objects.create(club=self.club, name="Home Ground", address="1 St", city="Town", zip_code="1000", country="BE", is_home=True)
+        away_ground = Location.objects.create(club=self.club, name="Away Ground", address="2 St", city="Town", zip_code="1000", country="BE")
+
+        home_game = self.make_event(kind=Event.EventKind.GAME, location=home_ground)
+        away_game = self.make_event(kind=Event.EventKind.GAME, location=away_ground)
+        game_with_no_location = self.make_event(kind=Event.EventKind.GAME)
+        training_at_home_ground = self.make_event(kind=Event.EventKind.TRAINING, location=home_ground)
+
+        self.assertTrue(home_game.is_home_game)
+        self.assertFalse(away_game.is_home_game)
+        self.assertFalse(game_with_no_location.is_home_game)
+        self.assertFalse(training_at_home_ground.is_home_game)
+
+
+class CompetitionModelTests(EventsTestBase):
+    def test_sport_type_defaults_to_other(self):
+        competition = Competition.objects.create(name="Local League", module="events.competition.other")
+
+        self.assertEqual(competition.sport_type, Club.SportType.OTHER)
+
+    def test_the_seeded_hockey_competitions_are_backfilled_as_ice_hockey(self):
+        # Migration 0019's data migration backfills the two competitions seeded
+        # by 0017 (both real ice hockey leagues) rather than leaving them at the
+        # generic "other" default.
+        for name in ["RBIHF", "CEHL"]:
+            with self.subTest(name=name):
+                self.assertEqual(Competition.objects.get(name=name).sport_type, Club.SportType.ICE_HOCKEY)
+
+
+class EventAdminFormCompetitionTests(EventsTestBase):
+    """`competition` is a plain CharField, but the admin should only ever offer
+    competitions this club is actually allowed to use -- see events/admin.py."""
+
+    def setUp(self):
+        super().setUp()
+        Flag = get_waffle_flag_model()
+        self.active_flag = Flag.objects.create(name="active-competition")
+        self.active_flag.clubs.add(self.club)
+        self.inactive_flag = Flag.objects.create(name="inactive-competition")
+        self.active_competition = Competition.objects.create(name="Active Cup", module="events.competition.active", flag=self.active_flag)
+        self.inactive_competition = Competition.objects.create(name="Inactive Cup", module="events.competition.inactive", flag=self.inactive_flag)
+        self.flagless_competition = Competition.objects.create(name="Flagless Cup", module="events.competition.flagless")
+
+    def test_a_flagless_competition_never_appears(self):
+        form = EventAdminForm(instance=Event())
+        choices = dict(form.fields["competition"].choices)
+
+        self.assertNotIn("Flagless Cup", choices)
+
+    def test_a_brand_new_event_offers_every_flagged_competition_unfiltered(self):
+        # The club is unknown until the event is actually saved (see
+        # EventClubScopeTests for the same "club_id is None pre-save" timing issue
+        # elsewhere), so a new event can't be filtered by club yet -- it falls back
+        # to showing everything with a flag rather than crashing or showing nothing.
+        form = EventAdminForm(instance=Event())
+        choices = dict(form.fields["competition"].choices)
+
+        self.assertIn("Active Cup", choices)
+        self.assertIn("Inactive Cup", choices)
+
+    def test_an_existing_event_only_offers_competitions_active_for_its_club(self):
+        event = self.make_event(kind=Event.EventKind.GAME)
+        form = EventAdminForm(instance=event)
+        choices = dict(form.fields["competition"].choices)
+
+        self.assertIn("Active Cup", choices)
+        self.assertNotIn("Inactive Cup", choices)
+        self.assertNotIn("Flagless Cup", choices)
+
+
+class EffectiveMembersTests(EventsTestBase):
+    def test_union_of_team_invited_minus_excluded(self):
+        carol = Member.objects.create(first_name="Carol", last_name="Cedar")
+        event = self.make_event()
+        event.teams.set([self.team])
+        event.invited_members.set([carol])
+        event.excluded_members.set([self.bob])
+
+        self.assertEqual(
+            set(effective_members(event).values_list("id", flat=True)),
+            {self.alice.id, carol.id},
+        )
+
+    def test_season_is_derived_from_start_date(self):
+        event = self.make_event(season=None)
+        event.teams.set([self.team])
+
+        self.assertEqual(self.attendee_ids(event), {self.alice.id, self.bob.id})
+
+    def test_no_covering_season_yields_no_team_members(self):
+        event = self.make_event(season=None, start=timezone.now() + timedelta(days=5000))
+        event.teams.set([self.team])
+
+        self.assertEqual(event.attendances.count(), 0)
+
+
+class AttendanceSyncTests(EventsTestBase):
+    def test_setting_teams_creates_attendance_for_roster(self):
+        event = self.make_event()
+        event.teams.set([self.team])
+
+        self.assertEqual(self.attendee_ids(event), {self.alice.id, self.bob.id})
+
+    def test_invited_member_gets_attendance(self):
+        carol = Member.objects.create(first_name="Carol", last_name="Cedar")
+        event = self.make_event()
+        event.invited_members.set([carol])
+
+        self.assertEqual(self.attendee_ids(event), {carol.id})
+
+    def test_reverse_invited_relation_syncs(self):
+        carol = Member.objects.create(first_name="Carol", last_name="Cedar")
+        event = self.make_event()
+        carol.invited_to_events.add(event)
+
+        self.assertIn(carol.id, self.attendee_ids(event))
+
+    def test_excluding_member_removes_attendance(self):
+        event = self.make_event()
+        event.teams.set([self.team])
+        event.excluded_members.set([self.alice])
+
+        self.assertEqual(self.attendee_ids(event), {self.bob.id})
+
+    def test_hard_reconcile_removes_even_responded_rows(self):
+        event = self.make_event()
+        event.teams.set([self.team])
+        attendance = event.attendances.get(member=self.alice)
+        attendance.status = Attendance.AttendanceStatus.PRESENT
+        attendance.save()
+
+        event.excluded_members.set([self.alice])
+
+        self.assertFalse(event.attendances.filter(member=self.alice).exists())
+
+    def test_past_event_is_not_synced(self):
+        event = self.make_event(start=timezone.now() - timedelta(days=1))
+        event.teams.set([self.team])
+
+        self.assertEqual(event.attendances.count(), 0)
+
+
+class RosterChangeSyncTests(EventsTestBase):
+    def test_adding_roster_member_syncs_future_events(self):
+        event = self.make_event()
+        event.teams.set([self.team])
+        dave = Member.objects.create(first_name="Dave", last_name="Dogwood")
+
+        TeamMembership.objects.create(team=self.team, member=dave, season=self.season, position=self.position)
+
+        self.assertIn(dave.id, self.attendee_ids(event))
+
+    def test_removing_roster_member_syncs_future_events(self):
+        event = self.make_event()
+        event.teams.set([self.team])
+
+        TeamMembership.objects.get(team=self.team, member=self.alice).delete()
+
+        self.assertNotIn(self.alice.id, self.attendee_ids(event))
+
+    def test_roster_change_leaves_past_events_untouched(self):
+        past = self.make_event(start=timezone.now() - timedelta(days=1))
+        past.teams.add(self.team)
+        Attendance.objects.create(event=past, member=self.alice)
+
+        TeamMembership.objects.get(team=self.team, member=self.alice).delete()
+
+        self.assertTrue(past.attendances.filter(member=self.alice).exists())
+
+
+class RecurrenceTestBase(EventsTestBase):
+    def setUp(self):
+        super().setUp()
+        self.anchor = (timezone.now() + timedelta(days=1)).replace(microsecond=0)
+
+    def make_series(self, **kwargs):
+        kwargs.setdefault("club", self.club)
+        kwargs.setdefault("title", "Weekly Training")
+        kwargs.setdefault("kind", Event.EventKind.TRAINING)
+        kwargs.setdefault("rrule", "FREQ=WEEKLY;COUNT=4")
+        kwargs.setdefault("dtstart", self.anchor)
+        kwargs.setdefault("duration", timedelta(hours=2))
+        series = EventSeries.objects.create(**kwargs)
+        series.teams.set([self.team])
+        return series
+
+
+class OccurrenceExpansionTests(RecurrenceTestBase):
+    def test_str(self):
+        self.assertEqual(str(self.make_series()), "Weekly Training")
+
+    def test_weekly_expansion(self):
+        series = self.make_series()
+
+        dts = occurrence_datetimes(series, self.anchor + timedelta(days=30))
+
+        self.assertEqual(dts[0], self.anchor)
+        self.assertEqual(dts[1], self.anchor + timedelta(weeks=1))
+        self.assertEqual(len(dts), 4)
+
+    def test_until_bounds_expansion(self):
+        series = self.make_series()
+
+        dts = occurrence_datetimes(series, self.anchor + timedelta(days=10))
+
+        self.assertEqual(len(dts), 2)
+
+    def test_excluded_dates_are_skipped(self):
+        series = self.make_series()
+        skipped = self.anchor + timedelta(weeks=1)
+        series.excluded_dates = [skipped.isoformat()]
+        series.save()
+
+        dts = occurrence_datetimes(series, self.anchor + timedelta(days=30))
+
+        self.assertNotIn(skipped, dts)
+        self.assertEqual(len(dts), 3)
+
+    def test_series_until_caps_expansion(self):
+        series = self.make_series(rrule="FREQ=WEEKLY", until=self.anchor + timedelta(days=10))
+
+        dts = occurrence_datetimes(series, self.anchor + timedelta(days=90))
+
+        # Only the anchor and the first weekly repeat fall on/before `until`.
+        self.assertEqual(dts, [self.anchor, self.anchor + timedelta(weeks=1)])
+        self.assertTrue(all(dt <= series.until for dt in dts))
+
+
+class GenerateOccurrencesTests(RecurrenceTestBase):
+    def test_materialises_occurrences_with_template_and_attendance(self):
+        series = self.make_series()
+
+        created = generate_occurrences(series, self.anchor + timedelta(days=30))
+
+        self.assertEqual(len(created), 4)
+        first = series.occurrences.order_by("start").first()
+        self.assertEqual(first.start, self.anchor)
+        self.assertEqual(first.end, self.anchor + timedelta(hours=2))
+        self.assertEqual(first.title, "Weekly Training")
+        self.assertEqual(first.kind, Event.EventKind.TRAINING)
+        # Audience copied from the series, so attendance follows the roster.
+        self.assertEqual(set(first.attendances.values_list("member_id", flat=True)), {self.alice.id, self.bob.id})
+        series.refresh_from_db()
+        self.assertIsNotNone(series.generated_until)
+
+    def test_generation_is_idempotent(self):
+        series = self.make_series()
+        until = self.anchor + timedelta(days=30)
+
+        generate_occurrences(series, until)
+        generate_occurrences(series, until)
+
+        self.assertEqual(series.occurrences.count(), 4)
+
+    def test_generation_stops_at_series_until(self):
+        series = self.make_series(rrule="FREQ=WEEKLY", until=self.anchor + timedelta(days=10))
+
+        generate_occurrences(series)
+
+        self.assertEqual(series.occurrences.count(), 2)
+
+    def test_gathering_and_deadline_come_from_offsets(self):
+        series = self.make_series(gathering_offset=timedelta(minutes=30), deadline_offset=timedelta(days=1))
+
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+
+        first = series.occurrences.order_by("start").first()
+        self.assertEqual(first.gathering, self.anchor - timedelta(minutes=30))
+        self.assertEqual(first.deadline, self.anchor - timedelta(days=1))
+
+    def test_without_offsets_gathering_and_deadline_are_blank(self):
+        series = self.make_series()
+
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+
+        first = series.occurrences.order_by("start").first()
+        self.assertIsNone(first.gathering)
+        self.assertIsNone(first.deadline)
+
+
+class SingleOccurrenceTests(RecurrenceTestBase):
+    def test_cancel_deletes_and_prevents_regeneration(self):
+        series = self.make_series()
+        until = self.anchor + timedelta(days=30)
+        generate_occurrences(series, until)
+        target = series.occurrences.order_by("start")[1]
+        target_start = target.start
+
+        cancel_occurrence(target)
+        self.assertFalse(series.occurrences.filter(start=target_start).exists())
+
+        generate_occurrences(series, until)
+        self.assertFalse(series.occurrences.filter(start=target_start).exists())
+        self.assertEqual(series.occurrences.count(), 3)
+
+    def test_cancel_soft_marks_cancelled(self):
+        series = self.make_series()
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+        target = series.occurrences.order_by("start").first()
+
+        cancel_occurrence(target, hard_delete=False)
+
+        target.refresh_from_db()
+        self.assertTrue(target.cancelled)
+        self.assertIn(target.start.isoformat(), series.excluded_dates)
+
+    def test_detached_occurrence_is_left_untouched_by_propagation(self):
+        series = self.make_series()
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+        detached = series.occurrences.order_by("start").first()
+        detach_occurrence(detached)
+
+        series.title = "Renamed"
+        series.save()
+        propagate_series(series)
+
+        detached.refresh_from_db()
+        self.assertEqual(detached.title, "Weekly Training")
+        other = series.occurrences.exclude(pk=detached.pk).order_by("start").first()
+        self.assertEqual(other.title, "Renamed")
+
+    def test_propagation_updates_audience_and_attendance(self):
+        series = self.make_series()
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+        carol = Member.objects.create(first_name="Carol", last_name="Cedar")
+        series.invited_members.set([carol])
+
+        propagate_series(series)
+
+        event = series.occurrences.order_by("start").first()
+        self.assertIn(carol.id, set(event.attendances.values_list("member_id", flat=True)))
+
+    def test_propagation_updates_timing_offsets(self):
+        series = self.make_series()
+        generate_occurrences(series, self.anchor + timedelta(days=30))
+        series.gathering_offset = timedelta(minutes=45)
+        series.save()
+
+        propagate_series(series)
+
+        first = series.occurrences.order_by("start").first()
+        self.assertEqual(first.gathering, self.anchor - timedelta(minutes=45))
+
+
+class ExtendSeriesCommandTests(RecurrenceTestBase):
+    def test_command_generates_occurrences(self):
+        series = self.make_series()
+        out = StringIO()
+
+        call_command("extend_event_series", stdout=out)
+
+        self.assertEqual(series.occurrences.count(), 4)
+        self.assertIn("Done.", out.getvalue())
+
+
+class EventClubScopeTests(EventsTestBase):
+    def setUp(self):
+        super().setUp()
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        today = timezone.localdate()
+        self.other_season = Season.objects.create(club=self.other, start_date=today - timedelta(days=30), end_date=today + timedelta(days=300))
+        self.other_location = Location.objects.create(club=self.other, name="Arena", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.other_opponent = Opponent.objects.create(club=self.other, name="Rivals")
+        self.other_team = Team.objects.create(club=self.other, name="First", short_name="1")
+
+    def test_event_rejects_cross_club_season(self):
+        event = Event(club=self.club, title="Match", start=self.future, season=self.other_season)
+        with self.assertRaises(ValidationError) as ctx:
+            event.full_clean()
+        self.assertIn("season", ctx.exception.error_dict)
+
+    def test_event_rejects_cross_club_location(self):
+        event = Event(club=self.club, title="Match", start=self.future, location=self.other_location)
+        with self.assertRaises(ValidationError) as ctx:
+            event.full_clean()
+        self.assertIn("location", ctx.exception.error_dict)
+
+    def test_event_accepts_same_club_fields(self):
+        Event(club=self.club, title="Match", start=self.future, season=self.season).full_clean()
+
+    def test_event_rejects_cross_club_team(self):
+        event = Event.objects.create(club=self.club, title="Match", start=self.future, season=self.season)
+        with self.assertRaises(ValidationError):
+            event.teams.add(self.other_team)
+
+    def test_event_accepts_same_club_team(self):
+        event = Event.objects.create(club=self.club, title="Match", start=self.future, season=self.season)
+        event.teams.add(self.team)
+        self.assertIn(self.team, event.teams.all())
+
+    def test_series_rejects_cross_club_opponent(self):
+        series = EventSeries(club=self.club, title="Weekly", rrule="FREQ=WEEKLY", dtstart=self.future, opponent=self.other_opponent)
+        with self.assertRaises(ValidationError) as ctx:
+            series.full_clean()
+        self.assertIn("opponent", ctx.exception.error_dict)
+
+    def test_series_rejects_cross_club_team(self):
+        series = EventSeries.objects.create(club=self.club, title="Weekly", rrule="FREQ=WEEKLY", dtstart=self.future)
+        with self.assertRaises(ValidationError):
+            series.teams.add(self.other_team)
+
+
+class TeamAttendanceStatsTests(EventsTestBase):
+    """events.services.attendance's team+season-scoped stats -- the queries
+    behind management.views.TeamDetailView's attendance panel."""
+
+    def make_past_training(self, days_ago, **kwargs):
+        # Past-start events are never auto-synced (see test_past_event_is_not_synced
+        # above), so attendance rows have to be created by hand here.
+        kwargs.setdefault("kind", Event.EventKind.TRAINING)
+        event = self.make_event(start=timezone.now() - timedelta(days=days_ago), **kwargs)
+        event.teams.add(self.team)
+        return event
+
+    def set_status(self, event, member, status):
+        attendance, _created = Attendance.objects.update_or_create(event=event, member=member, defaults={"status": status})
+        return attendance
+
+    def test_record_check_in_sets_showed_up(self):
+        event = self.make_past_training(1)
+        attendance = self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+
+        record_check_in(attendance, showed_up=False)
+
+        attendance.refresh_from_db()
+        self.assertFalse(attendance.showed_up)
+
+    def test_team_attendance_rate_excludes_excused_and_no_response(self):
+        event = self.make_past_training(1)
+        self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(event, self.bob, Attendance.AttendanceStatus.ABSENT)
+
+        self.assertEqual(team_attendance_rate(self.team, self.season), 50)
+
+    def test_team_attendance_rate_is_none_with_no_past_events(self):
+        self.assertIsNone(team_attendance_rate(self.team, self.season))
+
+    def test_rankings_exclude_players_below_the_response_minimum(self):
+        event = self.make_past_training(1)
+        self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(event, self.bob, Attendance.AttendanceStatus.ABSENT)
+
+        rankings = player_attendance_rankings(self.team, self.season, minimum_responses=2)
+
+        self.assertEqual(rankings, [])
+
+    def test_rankings_rank_best_first(self):
+        e1 = self.make_past_training(10)
+        e2 = self.make_past_training(3)
+        self.set_status(e1, self.alice, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(e2, self.alice, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(e1, self.bob, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(e2, self.bob, Attendance.AttendanceStatus.ABSENT)
+
+        rankings = player_attendance_rankings(self.team, self.season, minimum_responses=2)
+
+        self.assertEqual([entry["member"] for entry in rankings], [self.alice, self.bob])
+        self.assertEqual(rankings[0]["rate"], 100)
+        self.assertEqual(rankings[1]["rate"], 50)
+
+    def test_missed_recent_practices_needs_full_history(self):
+        self.make_past_training(3)  # only one practice logged so far
+
+        self.assertFalse(players_who_missed_recent_practices(self.team, self.season, count=2).exists())
+
+    def test_missed_recent_practices_flags_absence_on_both(self):
+        e1 = self.make_past_training(10)
+        e2 = self.make_past_training(3)
+        self.set_status(e1, self.alice, Attendance.AttendanceStatus.ABSENT)
+        self.set_status(e2, self.alice, Attendance.AttendanceStatus.NO_RESPONSE)
+        self.set_status(e1, self.bob, Attendance.AttendanceStatus.PRESENT)
+        self.set_status(e2, self.bob, Attendance.AttendanceStatus.ABSENT)
+
+        missed = players_who_missed_recent_practices(self.team, self.season, count=2)
+
+        self.assertEqual(list(missed), [self.alice])
+
+    def test_missed_recent_practices_excludes_an_excused_absence(self):
+        e1 = self.make_past_training(10)
+        e2 = self.make_past_training(3)
+        self.set_status(e1, self.alice, Attendance.AttendanceStatus.EXCUSED)
+        self.set_status(e2, self.alice, Attendance.AttendanceStatus.ABSENT)
+
+        missed = players_who_missed_recent_practices(self.team, self.season, count=2)
+
+        self.assertNotIn(self.alice, missed)
+
+    def test_no_shows_requires_an_explicit_check_in(self):
+        event = self.make_past_training(1)
+        self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+
+        # Nobody has been checked in at all -- must not read as a no-show.
+        self.assertEqual(list(team_no_shows(self.team, self.season)), [])
+
+    def test_no_shows_flags_a_present_rsvp_checked_in_as_absent(self):
+        event = self.make_past_training(1)
+        attendance = self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+        record_check_in(attendance, showed_up=False)
+
+        no_shows = team_no_shows(self.team, self.season)
+
+        self.assertEqual(len(no_shows), 1)
+        self.assertEqual(no_shows[0].member, self.alice)
+        self.assertEqual(no_shows[0].event, event)
+
+    def test_a_confirmed_check_in_is_not_a_no_show(self):
+        event = self.make_past_training(1)
+        attendance = self.set_status(event, self.alice, Attendance.AttendanceStatus.PRESENT)
+        record_check_in(attendance, showed_up=True)
+
+        self.assertEqual(list(team_no_shows(self.team, self.season)), [])
+
+
+RBIHF_TEAM_ID = "4460"
+RBIHF_TEAM_NAME = "Sportoase Antwerp Phantoms"
+
+
+def rbihf_sample_html(rows):
+    """A trimmed stand-in for an RBIHF team page (https://www.rbihf.be/league/team/<id>)
+    -- structure confirmed against the real page while designing this feature.
+    ``rows`` is a list of dicts: game_id, date ("YYYY-MM-DD"), hour ("HH:MM"),
+    venue, home_id, home_name, visit_id, visit_name."""
+    row_html = "".join(
+        f'<tr><td class="game-nr"><a href="/game/{r["game_id"]}" title="Game {r["game_id"]}">{r["game_id"]}</a></td>'
+        f'<td class="date">{r["date"]}</td><td class="hour">{r["hour"]}</td><td>{r["venue"]}</td>'
+        f'<td><a href="/league/team/{r["home_id"]}" title="{r["home_name"]}">{r["home_name"]}</a></td>'
+        f'<td><a href="/league/team/{r["visit_id"]}" title="{r["visit_name"]}">{r["visit_name"]}</a></td></tr>'
+        for r in rows
+    )
+    return f"""<html><body>
+    <div class="block"><div class="block-header"><h2>{RBIHF_TEAM_NAME}</h2></div></div>
+    <div class="block"><div class="block-header"><h2 id="games-upcoming">Upcoming games</h2></div>
+    <div class="block-content"><table>
+    <tr><th class="game-nr">#</th><th class="date">Date</th><th class="hour">Hour</th><th>Location</th><th>Home</th><th>Visit</th></tr>
+    {row_html}
+    </table></div></div>
+    </body></html>"""
+
+
+class RBIHFParseFixturesTests(TestCase):
+    """Pure parsing, no network, no DB -- events.services.rbihf_import.parse_fixtures."""
+
+    def test_parses_team_name_and_fixtures(self):
+        html = rbihf_sample_html(
+            [
+                {"game_id": "5002", "date": "2026-09-12", "hour": "12:15", "venue": "Deurne", "home_id": RBIHF_TEAM_ID, "home_name": RBIHF_TEAM_NAME, "visit_id": "4464", "visit_name": "Amsterdam Tigers"},
+                {"game_id": "5010", "date": "2026-09-20", "hour": "18:30", "venue": "Antwerp Ice Rink", "home_id": "4500", "home_name": "Brussels Bears", "visit_id": RBIHF_TEAM_ID, "visit_name": RBIHF_TEAM_NAME},
+            ]
+        )
+
+        team_name, fixtures = parse_fixtures(html, RBIHF_TEAM_ID)
+
+        self.assertEqual(team_name, RBIHF_TEAM_NAME)
+        self.assertEqual(len(fixtures), 2)
+
+    def test_resolves_home_fixture_correctly(self):
+        html = rbihf_sample_html([{"game_id": "5002", "date": "2026-09-12", "hour": "12:15", "venue": "Deurne", "home_id": RBIHF_TEAM_ID, "home_name": RBIHF_TEAM_NAME, "visit_id": "4464", "visit_name": "Amsterdam Tigers"}])
+
+        _team_name, fixtures = parse_fixtures(html, RBIHF_TEAM_ID)
+
+        self.assertTrue(fixtures[0].is_home)
+        self.assertEqual(fixtures[0].opponent_name, "Amsterdam Tigers")
+        self.assertEqual(fixtures[0].venue_text, "Deurne")
+        self.assertEqual(fixtures[0].external_game_id, "5002")
+
+    def test_resolves_away_fixture_correctly(self):
+        html = rbihf_sample_html([{"game_id": "5010", "date": "2026-09-20", "hour": "18:30", "venue": "Antwerp Ice Rink", "home_id": "4500", "home_name": "Brussels Bears", "visit_id": RBIHF_TEAM_ID, "visit_name": RBIHF_TEAM_NAME}])
+
+        _team_name, fixtures = parse_fixtures(html, RBIHF_TEAM_ID)
+
+        self.assertFalse(fixtures[0].is_home)
+        self.assertEqual(fixtures[0].opponent_name, "Brussels Bears")
+
+    def test_a_row_where_neither_side_matches_is_skipped(self):
+        html = rbihf_sample_html([{"game_id": "9999", "date": "2026-09-20", "hour": "18:30", "venue": "Elsewhere", "home_id": "1", "home_name": "Team One", "visit_id": "2", "visit_name": "Team Two"}])
+
+        _team_name, fixtures = parse_fixtures(html, RBIHF_TEAM_ID)
+
+        self.assertEqual(fixtures, [])
+
+    def test_missing_games_table_raises(self):
+        with self.assertRaises(RBIHFImportError):
+            parse_fixtures("<html><body><h2>Some Team</h2></body></html>", RBIHF_TEAM_ID)
+
+
+class RBIHFExtractTeamIdTests(TestCase):
+    def test_accepts_the_documented_shape(self):
+        self.assertEqual(extract_team_id("https://www.rbihf.be/league/team/4460"), "4460")
+
+    def test_accepts_without_www(self):
+        self.assertEqual(extract_team_id("https://rbihf.be/league/team/4460"), "4460")
+
+    def test_rejects_a_different_host(self):
+        with self.assertRaises(RBIHFImportError):
+            extract_team_id("https://evil.example.com/league/team/4460")
+
+    def test_rejects_a_different_path(self):
+        with self.assertRaises(RBIHFImportError):
+            extract_team_id("https://www.rbihf.be/leagues")
+
+
+class RBIHFImportPlanTests(EventsTestBase):
+    def setUp(self):
+        super().setUp()
+        self.home_location = Location.objects.create(club=self.club, name="Home Arena", address="1 St", city="Antwerp", zip_code="1000", country="BE", is_home=True)
+        self.away_location = Location.objects.create(club=self.club, name="Deurne Ice Hall", address="2 St", city="Deurne", zip_code="2100", country="BE")
+
+    def home_fixture_row(self, game_id="5002", date="2026-09-12"):
+        return {"game_id": game_id, "date": date, "hour": "12:15", "venue": "Deurne", "home_id": RBIHF_TEAM_ID, "home_name": RBIHF_TEAM_NAME, "visit_id": "4464", "visit_name": "Amsterdam Tigers"}
+
+    # -- suggested_location --------------------------------------------------
+
+    def test_suggested_location_for_a_home_fixture_is_the_clubs_home_location(self):
+        _team_name, fixtures = parse_fixtures(rbihf_sample_html([self.home_fixture_row()]), RBIHF_TEAM_ID)
+
+        self.assertEqual(suggested_location(self.club, fixtures[0]), self.home_location)
+
+    def test_suggested_location_for_an_away_fixture_matches_by_city(self):
+        row = {"game_id": "5010", "date": "2026-09-20", "hour": "18:30", "venue": "Deurne", "home_id": "4500", "home_name": "Brussels Bears", "visit_id": RBIHF_TEAM_ID, "visit_name": RBIHF_TEAM_NAME}
+        _team_name, fixtures = parse_fixtures(rbihf_sample_html([row]), RBIHF_TEAM_ID)
+
+        self.assertEqual(suggested_location(self.club, fixtures[0]), self.away_location)
+
+    def test_suggested_location_is_none_when_nothing_matches(self):
+        row = {"game_id": "5010", "date": "2026-09-20", "hour": "18:30", "venue": "Nowhere Familiar", "home_id": "4500", "home_name": "Brussels Bears", "visit_id": RBIHF_TEAM_ID, "visit_name": RBIHF_TEAM_NAME}
+        _team_name, fixtures = parse_fixtures(rbihf_sample_html([row]), RBIHF_TEAM_ID)
+
+        self.assertIsNone(suggested_location(self.club, fixtures[0]))
+
+    # -- suggested_opponent ---------------------------------------------------
+
+    def test_suggested_opponent_matches_case_insensitively(self):
+        opponent = Opponent.objects.create(club=self.club, name="AMSTERDAM TIGERS")
+        _team_name, fixtures = parse_fixtures(rbihf_sample_html([self.home_fixture_row()]), RBIHF_TEAM_ID)
+
+        self.assertEqual(suggested_opponent(self.club, fixtures[0]), opponent)
+
+    def test_suggested_opponent_is_none_when_nothing_matches(self):
+        _team_name, fixtures = parse_fixtures(rbihf_sample_html([self.home_fixture_row()]), RBIHF_TEAM_ID)
+
+        self.assertIsNone(suggested_opponent(self.club, fixtures[0]))
+
+    # -- build_plan ------------------------------------------------------------
+
+    def test_a_new_fixture_is_planned_as_a_create(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        self.assertEqual(len(plan.to_create), 1)
+        self.assertEqual(plan.to_create[0].fixture.external_game_id, "5002")
+        self.assertEqual(plan.to_create[0].suggested_location, self.home_location)
+
+    def test_an_identical_existing_fixture_is_unchanged(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        self.assertEqual(plan_again.to_create, [])
+        self.assertEqual(plan_again.to_update, [])
+        self.assertEqual(plan_again.unchanged_count, 1)
+
+    def test_a_changed_fixture_is_planned_as_an_update_with_a_diff(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        changed_row = self.home_fixture_row()
+        changed_row["hour"] = "20:00"  # same game id, different time
+        changed_html = rbihf_sample_html([changed_row])
+
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, changed_html)
+
+        self.assertEqual(len(plan_again.to_update), 1)
+        self.assertIn("start", plan_again.to_update[0].changes)
+
+    def test_a_future_fixture_no_longer_listed_is_planned_for_deletion(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, rbihf_sample_html([]))
+
+        self.assertEqual(len(plan_again.to_delete), 1)
+        self.assertEqual(plan_again.to_delete[0].external_game_id, "5002")
+
+    def test_a_past_fixture_no_longer_listed_is_not_deleted(self):
+        # "Upcoming games" naturally stops listing a game once it's happened --
+        # that's not a signal it was cancelled.
+        past_row = self.home_fixture_row(date="2020-01-01")
+        html = rbihf_sample_html([past_row])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, rbihf_sample_html([]))
+
+        self.assertEqual(plan_again.to_delete, [])
+
+    def test_a_fixture_for_a_different_team_is_not_touched(self):
+        other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, other_team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        # Re-running for *our* team should see no existing RBIHF events at all
+        # for it -- the one that exists belongs to other_team.
+        plan_for_our_team = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        self.assertEqual(len(plan_for_our_team.to_create), 1)
+
+    # -- apply_plan --------------------------------------------------------
+
+    def test_apply_plan_creates_events_with_the_expected_fields(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        result = apply_plan(plan, {"5002": str(self.home_location.pk)})
+
+        self.assertEqual(result, {"created": 1, "updated": 0, "deleted": 0})
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.kind, Event.EventKind.GAME)
+        self.assertEqual(event.competition, "RBIHF")
+        self.assertEqual(event.opponent.name, "Amsterdam Tigers")
+        self.assertEqual(event.location, self.home_location)
+        self.assertIn(self.team, event.teams.all())
+        self.assertTrue(event.is_home_game)
+
+    def test_apply_plan_ignores_a_location_id_from_another_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        foreign_location = Location.objects.create(club=other_club, name="Not ours", address="x", city="x", zip_code="x", country="BE")
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        apply_plan(plan, {"5002": str(foreign_location.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertIsNone(event.location)
+
+    def test_apply_plan_uses_an_explicitly_chosen_opponent_instead_of_the_scraped_name(self):
+        renamed = Opponent.objects.create(club=self.club, name="Amsterdam Tigers HC")
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        apply_plan(plan, {}, {"5002": str(renamed.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.opponent, renamed)
+        self.assertEqual(Opponent.objects.filter(club=self.club, name="Amsterdam Tigers").count(), 0)
+
+    def test_apply_plan_ignores_an_opponent_id_from_another_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        foreign_opponent = Opponent.objects.create(club=other_club, name="Not ours")
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+
+        apply_plan(plan, {}, {"5002": str(foreign_opponent.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        # Falls back to find-or-create by the scraped name, not the foreign row.
+        self.assertEqual(event.opponent.name, "Amsterdam Tigers")
+
+    def test_apply_plan_preserves_a_previously_chosen_opponent_on_update(self):
+        renamed = Opponent.objects.create(club=self.club, name="Amsterdam Tigers HC")
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {}, {"5002": str(renamed.pk)})
+
+        # Re-run with a changed start time (something else triggers the update).
+        # build_plan should suggest (pre-select) the event's existing opponent
+        # rather than re-guessing from the scraped name -- a real <select>
+        # always resubmits whichever option is pre-selected, so that's what's
+        # passed to apply_plan here too, not a blank dict.
+        changed_row = self.home_fixture_row()
+        changed_row["hour"] = "20:00"
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, rbihf_sample_html([changed_row]))
+        self.assertEqual(plan_again.to_update[0].suggested_opponent, renamed)
+        apply_plan(plan_again, {}, {"5002": str(renamed.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.opponent, renamed)
+
+    def test_apply_plan_updates_only_start_opponent_and_location(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        event.end = self.future
+        event.gathering = self.future
+        event.score_for = 3
+        event.save()
+
+        changed_row = self.home_fixture_row()
+        changed_row["hour"] = "20:00"
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, rbihf_sample_html([changed_row]))
+        apply_plan(plan_again, {})
+
+        event.refresh_from_db()
+        self.assertEqual(timezone.localtime(event.start).strftime("%H:%M"), "20:00")
+        self.assertIsNotNone(event.end)
+        self.assertIsNotNone(event.gathering)
+        self.assertEqual(event.score_for, 3)
+
+    def test_apply_plan_deletes_only_whats_in_to_delete(self):
+        html = rbihf_sample_html([self.home_fixture_row()])
+        plan = build_plan(self.club, self.team, RBIHF_TEAM_ID, html)
+        apply_plan(plan, {})
+
+        plan_again = build_plan(self.club, self.team, RBIHF_TEAM_ID, rbihf_sample_html([]))
+        result = apply_plan(plan_again, {})
+
+        self.assertEqual(result, {"created": 0, "updated": 0, "deleted": 1})
+        self.assertFalse(Event.objects.filter(club=self.club, external_game_id="5002").exists())
diff --git a/events/views.py b/events/views.py
new file mode 100644
index 0000000..60f00ef
--- /dev/null
+++ b/events/views.py
@@ -0,0 +1 @@
+# Create your views here.
diff --git a/features/__init__.py b/features/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/features/admin.py b/features/admin.py
new file mode 100644
index 0000000..8fc6ab2
--- /dev/null
+++ b/features/admin.py
@@ -0,0 +1,17 @@
+from django.contrib import admin
+
+from .models import Flag, Maintenance
+
+
+@admin.register(Flag)
+class FlagAdmin(admin.ModelAdmin):
+    list_display = ["name", "note", "everyone", "percent", "superusers", "staff"]
+    list_filter = ["everyone", "superusers", "staff"]
+    search_fields = ["name", "note"]
+    filter_horizontal = ["clubs"]
+
+
+@admin.register(Maintenance)
+class MaintenanceAdmin(admin.ModelAdmin):
+    list_display = ["__str__", "started_at", "started_by"]
+    readonly_fields = ["started_at", "started_by"]
diff --git a/features/apps.py b/features/apps.py
new file mode 100644
index 0000000..1060681
--- /dev/null
+++ b/features/apps.py
@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class FeaturesConfig(AppConfig):
+    name = "features"
+
+    def ready(self):
+        from . import signals  # noqa: F401
diff --git a/features/commands.py b/features/commands.py
new file mode 100644
index 0000000..5f06cb4
--- /dev/null
+++ b/features/commands.py
@@ -0,0 +1,31 @@
+"""Scheduled work refuses to run while the platform is locked down.
+
+Deliberately opt-in, per command, rather than a blanket guard on BaseCommand: maintenance is
+usually declared IN ORDER to run `migrate` or `collectstatic`, and a guard that blocked those
+would make the mode useless — you would have to turn it off to do the work you turned it on
+for. Only the domain jobs (which write club data, archive clubs, or import members) stand
+down.
+"""
+
+from django.core.management.base import BaseCommand, CommandError
+
+from features.models import Maintenance
+
+
+class MaintenanceAwareCommand(BaseCommand):
+    """A command that must not run while the platform is closed."""
+
+    def execute(self, *args, **options):
+        if Maintenance.is_on() and not options.get("ignore_maintenance"):
+            raise CommandError("The platform is in maintenance mode; this command stands down. Pass --ignore-maintenance to override.")
+
+        return super().execute(*args, **options)
+
+    def create_parser(self, prog_name, subcommand, **kwargs):
+        parser = super().create_parser(prog_name, subcommand, **kwargs)
+        parser.add_argument(
+            "--ignore-maintenance",
+            action="store_true",
+            help="Run even though the platform is in maintenance mode.",
+        )
+        return parser
diff --git a/features/context_processors.py b/features/context_processors.py
new file mode 100644
index 0000000..2875c19
--- /dev/null
+++ b/features/context_processors.py
@@ -0,0 +1,7 @@
+from features.models import Maintenance
+
+
+def maintenance(request):
+    """So no control-panel page can forget the platform is closed. Cached, so it costs no
+    query."""
+    return {"maintenance_on": Maintenance.is_on()}
diff --git a/features/middleware.py b/features/middleware.py
new file mode 100644
index 0000000..7bca397
--- /dev/null
+++ b/features/middleware.py
@@ -0,0 +1,77 @@
+"""Platform lock-down.
+
+While maintenance is on, every club subdomain is closed and the base domain keeps only what
+is needed to *end* the maintenance: the control panel, the auth screens that get you into it,
+the static files those pages need, and the health check.
+
+The exemptions are the whole design. Close /accounts/ as well and you cannot sign in to turn
+maintenance off — a lock-down with no key, fixable only from a shell. Close /healthz and the
+load balancer concludes the node is dead and stops routing to it, which takes the control
+panel down with everything else.
+"""
+
+from django.http import JsonResponse
+from django.shortcuts import render
+from django.utils.translation import gettext_lazy as _
+
+from features.models import Maintenance
+
+#: Reachable on the base domain while the platform is locked down.
+OPEN_PREFIXES = (
+    "/controlpanel/",  # the point of the exercise
+    "/accounts/",  # ...which you cannot reach without signing in
+    "/admin/",
+    "/static/",
+    "/__reload__/",  # dev only; absent outside DEBUG
+)
+
+#: Reachable on every host, always. The health check must answer or the load balancer will
+#: take the node out of rotation and the control panel with it. /media/ has to stay open too:
+#: the club maintenance page is rendered through the tenant's own skin specifically so it can
+#: show the club's logo, and that logo is itself a /media/ file — closing it outright would
+#: serve the maintenance page over the top of its own image.
+ALWAYS_OPEN = ("/healthz", "/media/")
+
+RETRY_AFTER_SECONDS = 3600
+
+
+class MaintenanceMiddleware:
+    """Runs after ClubTenantMiddleware: whether a request is a club's or the platform's is
+    decided by ``request.club``, which the tenant middleware has just resolved."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not self.is_closed(request):
+            return self.get_response(request)
+
+        maintenance = Maintenance.current()
+        response = self.render(request, maintenance)
+        response["Retry-After"] = RETRY_AFTER_SECONDS
+
+        return response
+
+    def is_closed(self, request) -> bool:
+        if request.path.startswith(ALWAYS_OPEN):
+            return False
+
+        if not Maintenance.is_on():
+            return False
+
+        # A club subdomain is closed outright — no login, no shop, nothing (besides the
+        # /media/ exemption above, which its own maintenance page needs to render).
+        if getattr(request, "club", None) is not None:
+            return True
+
+        # The base domain keeps the way back in.
+        return not request.path.startswith(OPEN_PREFIXES)
+
+    def render(self, request, maintenance):
+        message = maintenance.message or _("RosterChief is down for maintenance. It will be back shortly.")
+
+        # An API-ish caller gets JSON rather than a page of HTML it cannot read.
+        if request.headers.get("accept", "").startswith("application/json"):
+            return JsonResponse({"status": "maintenance", "detail": str(message)}, status=503)
+
+        return render(request, "maintenance.html", {"message": message, "maintenance": maintenance}, status=503)
diff --git a/features/migrations/0001_initial.py b/features/migrations/0001_initial.py
new file mode 100644
index 0000000..c7344f4
--- /dev/null
+++ b/features/migrations/0001_initial.py
@@ -0,0 +1,45 @@
+# Generated by Django 6.0.6 on 2026-07-13 14:29
+
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+        ('club', '0011_alter_club_slug'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Flag',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(help_text='The human/computer readable name.', max_length=100, unique=True, verbose_name='Name')),
+                ('everyone', models.BooleanField(blank=True, help_text='Flip this flag on (Yes) or off (No) for everyone, overriding all other settings. Leave as Unknown to use normally.', null=True, verbose_name='Everyone')),
+                ('percent', models.DecimalField(blank=True, decimal_places=1, help_text='A number between 0.0 and 99.9 to indicate a percentage of users for whom this flag will be active.', max_digits=3, null=True, verbose_name='Percent')),
+                ('testing', models.BooleanField(default=False, help_text='Allow this flag to be set for a session for user testing', verbose_name='Testing')),
+                ('superusers', models.BooleanField(default=True, help_text='Flag always active for superusers?', verbose_name='Superusers')),
+                ('staff', models.BooleanField(default=False, help_text='Flag always active for staff?', verbose_name='Staff')),
+                ('authenticated', models.BooleanField(default=False, help_text='Flag always active for authenticated users?', verbose_name='Authenticated')),
+                ('languages', models.TextField(blank=True, default='', help_text='Activate this flag for users with one of these languages (comma-separated list)', verbose_name='Languages')),
+                ('rollout', models.BooleanField(default=False, help_text='Activate roll-out mode?', verbose_name='Rollout')),
+                ('note', models.TextField(blank=True, help_text='Note where this Flag is used.', verbose_name='Note')),
+                ('created', models.DateTimeField(db_index=True, default=django.utils.timezone.now, help_text='Date when this Flag was created.', verbose_name='Created')),
+                ('modified', models.DateTimeField(default=django.utils.timezone.now, help_text='Date when this Flag was last modified.', verbose_name='Modified')),
+                ('clubs', models.ManyToManyField(blank=True, help_text='Activate this flag for these clubs.', related_name='flags', to='club.club', verbose_name='Clubs')),
+                ('groups', models.ManyToManyField(blank=True, help_text='Activate this flag for these user groups.', to='auth.group', verbose_name='Groups')),
+                ('users', models.ManyToManyField(blank=True, help_text='Activate this flag for these users.', to=settings.AUTH_USER_MODEL, verbose_name='Users')),
+            ],
+            options={
+                'verbose_name': 'Flag',
+                'verbose_name_plural': 'Flags',
+                'abstract': False,
+            },
+        ),
+    ]
diff --git a/features/migrations/0002_maintenance.py b/features/migrations/0002_maintenance.py
new file mode 100644
index 0000000..3048687
--- /dev/null
+++ b/features/migrations/0002_maintenance.py
@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-07-14 08:00
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('features', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Maintenance',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('is_active', models.BooleanField(default=False, verbose_name='active')),
+                ('message', models.TextField(blank=True, help_text='Shown to clubs while the platform is locked down.', verbose_name='message')),
+                ('started_at', models.DateTimeField(blank=True, null=True, verbose_name='started at')),
+                ('started_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='maintenance_windows', to=settings.AUTH_USER_MODEL, verbose_name='started by')),
+            ],
+            options={
+                'verbose_name': 'maintenance',
+                'verbose_name_plural': 'maintenance',
+            },
+        ),
+    ]
diff --git a/features/migrations/__init__.py b/features/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/features/models.py b/features/models.py
new file mode 100644
index 0000000..45d5d62
--- /dev/null
+++ b/features/models.py
@@ -0,0 +1,153 @@
+"""Club-scoped feature flags.
+
+waffle's Flag model is swappable (``WAFFLE_FLAG_MODEL``, like ``AUTH_USER_MODEL``),
+so we subclass it to add the one dimension this platform actually needs: which
+*clubs* a feature is on for. The tenant middleware already puts ``request.club``
+on every request, so a flag resolves with a plain ``flag_is_active(request, "shop")``
+— no call site has to know about clubs.
+
+Everything waffle already offers (``everyone`` / ``percent`` / ``staff`` /
+``superusers`` / per-user / per-group) keeps working untouched.
+"""
+
+from django.conf import settings
+from django.db import models
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+from waffle.models import CACHE_EMPTY, AbstractUserFlag
+from waffle.utils import get_cache, keyfmt
+
+from rosterchief.base import UUIDModel
+
+#: Cache key template for a flag's club ids, mirroring waffle's own
+#: FLAG_USERS_CACHE_KEY / FLAG_GROUPS_CACHE_KEY.
+FLAG_CLUBS_CACHE_KEY = "flag:%s:clubs"
+
+
+class Flag(AbstractUserFlag):
+    clubs = models.ManyToManyField(
+        "club.Club",
+        blank=True,
+        related_name="flags",
+        help_text=_("Activate this flag for these clubs."),
+        verbose_name=_("Clubs"),
+    )
+
+    def get_flush_keys(self, flush_keys=None):
+        flush_keys = super().get_flush_keys(flush_keys)
+        flush_keys.append(keyfmt(FLAG_CLUBS_CACHE_KEY, self.name))
+        return flush_keys
+
+    def _get_club_ids(self) -> set:
+        """Club ids this flag is on for, cached the way waffle caches its own M2Ms."""
+        if self.pk is None:
+            # waffle's own BaseModel.get() falls back to a transient, unsaved
+            # Flag(name=...) instance for a name nothing in the DB matches yet
+            # (see waffle/models.py) -- an M2M lookup can't run against that, and
+            # there's genuinely nothing for it to be on for anyway.
+            return set()
+
+        cache = get_cache()
+        cache_key = keyfmt(FLAG_CLUBS_CACHE_KEY, self.name)
+
+        cached = cache.get(cache_key)
+        if cached == CACHE_EMPTY:
+            return set()
+        if cached:
+            return cached
+
+        club_ids = set(self.clubs.values_list("pk", flat=True))
+        if not club_ids:
+            cache.add(cache_key, CACHE_EMPTY)
+            return set()
+
+        cache.add(cache_key, club_ids)
+        return club_ids
+
+    def is_active(self, request, read_only=False):
+        # waffle's contract: `everyone` overrides *all* other settings. So a flag
+        # explicitly switched off for everyone stays off even for a targeted club,
+        # and club targeting only applies while `everyone` is left Unknown (None).
+        if self.everyone is None:
+            club = getattr(request, "club", None)
+            if club is not None and club.pk in self._get_club_ids():
+                return True
+
+        return super().is_active(request, read_only=read_only)
+
+    def is_active_for_club(self, club) -> bool:
+        """Explicit check for code that holds a club but no request."""
+        if self.everyone is not None:
+            return self.everyone
+        return club.pk in self._get_club_ids()
+
+
+class Maintenance(UUIDModel):
+    """Platform lock-down. One row, read on every request.
+
+    Cached rather than queried per request, and the cache is the same shared Redis the flags
+    use — so turning maintenance on in the control panel takes effect on every worker and
+    every server at once. A per-process cache would leave some workers still serving clubs.
+    """
+
+    CACHE_KEY = "maintenance:current"
+
+    #: Cached, but not for ever. Write-through makes the flip instant for the process that
+    #: made it and — on the shared Redis of a real deployment — for every other one too. The
+    #: TTL is the belt to that braces: on a per-process cache (a dev box with no Redis, or a
+    #: misconfigured deploy) a lock-down that only reached one gunicorn worker would be worse
+    #: than useless, so the others notice within ten seconds regardless.
+    CACHE_SECONDS = 10
+
+    is_active = models.BooleanField(_("active"), default=False)
+    message = models.TextField(_("message"), blank=True, help_text=_("Shown to clubs while the platform is locked down."))
+    started_at = models.DateTimeField(_("started at"), null=True, blank=True)
+    started_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True, related_name="maintenance_windows", verbose_name=_("started by"))
+
+    class Meta:
+        verbose_name = _("maintenance")
+        verbose_name_plural = _("maintenance")
+
+    def __str__(self):
+        return "Maintenance on" if self.is_active else "Maintenance off"
+
+    def save(self, *args, **kwargs):
+        super().save(*args, **kwargs)
+        get_cache().set(self.CACHE_KEY, self, self.CACHE_SECONDS)
+
+    @classmethod
+    def current(cls) -> Maintenance:
+        """The one row, created on first read. Cached until it changes."""
+        cached = get_cache().get(cls.CACHE_KEY)
+        if cached is not None:
+            return cached
+
+        maintenance = cls.objects.first() or cls.objects.create()
+        get_cache().set(cls.CACHE_KEY, maintenance, cls.CACHE_SECONDS)
+
+        return maintenance
+
+    @classmethod
+    def is_on(cls) -> bool:
+        return cls.current().is_active
+
+    @classmethod
+    def start(cls, *, message: str = "", user=None) -> Maintenance:
+        maintenance = cls.current()
+        maintenance.is_active = True
+        maintenance.message = message
+        maintenance.started_at = timezone.now()
+        maintenance.started_by = user
+        maintenance.save()
+
+        return maintenance
+
+    @classmethod
+    def stop(cls) -> Maintenance:
+        maintenance = cls.current()
+        maintenance.is_active = False
+        maintenance.started_at = None
+        maintenance.started_by = None
+        maintenance.save()
+
+        return maintenance
diff --git a/features/signals.py b/features/signals.py
new file mode 100644
index 0000000..d1ce6e7
--- /dev/null
+++ b/features/signals.py
@@ -0,0 +1,26 @@
+"""Keep waffle's flag cache honest when club targeting changes.
+
+waffle caches a flag's M2M ids and only flushes on ``save()``. Editing an M2M
+does not call ``save()``, so adding or removing a club would otherwise leave a
+stale cached set and the flag would keep answering with the old value.
+"""
+
+from django.db.models.signals import m2m_changed
+from django.dispatch import receiver
+
+from .models import Flag
+
+FLUSH_ACTIONS = {"post_add", "post_remove", "post_clear"}
+
+
+@receiver(m2m_changed, sender=Flag.clubs.through)
+def flush_flag_club_cache(sender, instance, action, reverse, pk_set, **kwargs):
+    if action not in FLUSH_ACTIONS:
+        return
+
+    if isinstance(instance, Flag):
+        instance.flush()
+    else:
+        # Reverse edit (club.flags.add(flag)): flush each flag touched.
+        for flag in Flag.objects.filter(pk__in=pk_set or []):
+            flag.flush()
diff --git a/features/tests.py b/features/tests.py
new file mode 100644
index 0000000..b6aea13
--- /dev/null
+++ b/features/tests.py
@@ -0,0 +1,252 @@
+from io import StringIO
+
+from allauth.mfa.models import Authenticator
+from django.contrib.auth import get_user_model
+from django.core.cache import cache
+from django.core.management import call_command
+from django.core.management.base import CommandError
+from django.test import RequestFactory, TestCase, override_settings
+from waffle import flag_is_active, get_waffle_flag_model
+
+from club.models import Club
+
+from .models import Maintenance
+
+Flag = get_waffle_flag_model()
+User = get_user_model()
+
+
+class ClubScopedFlagTests(TestCase):
+    def setUp(self):
+        # waffle caches flags by name, and its cache is NOT rolled back with the
+        # test transaction -- a flag row recreated under the same name in the next
+        # test would otherwise be shadowed by the previous test's cached object.
+        cache.clear()
+        self.addCleanup(cache.clear)
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.flag = Flag.objects.create(name="shop")
+
+    def request_for(self, club):
+        request = RequestFactory().get("/")
+        request.club = club
+        request.user = None
+        return request
+
+    def active_for(self, club):
+        return flag_is_active(self.request_for(club), "shop")
+
+    def test_off_for_every_club_by_default(self):
+        self.assertFalse(self.active_for(self.club))
+        self.assertFalse(self.active_for(self.other))
+
+    def test_on_only_for_the_targeted_club(self):
+        self.flag.clubs.add(self.club)
+
+        self.assertTrue(self.active_for(self.club))
+        self.assertFalse(self.active_for(self.other))
+
+    def test_removing_a_club_turns_it_off_again(self):
+        self.flag.clubs.add(self.club)
+        self.flag.clubs.remove(self.club)
+
+        self.assertFalse(self.active_for(self.club))
+
+    def test_everyone_true_overrides_club_targeting(self):
+        self.flag.everyone = True
+        self.flag.save()
+
+        self.assertTrue(self.active_for(self.other))  # not targeted, still on
+
+    def test_everyone_false_beats_club_targeting(self):
+        # waffle's contract: `everyone` overrides ALL other settings, so a flag
+        # switched off for everyone must stay off even for a targeted club.
+        self.flag.clubs.add(self.club)
+        self.flag.everyone = False
+        self.flag.save()
+
+        self.assertFalse(self.active_for(self.club))
+
+    def test_no_club_on_the_request_is_not_active(self):
+        # e.g. the base domain / control panel, where there is no tenant.
+        self.flag.clubs.add(self.club)
+
+        self.assertFalse(flag_is_active(self.request_for(None), "shop"))
+
+    def test_a_flag_name_with_no_matching_row_is_off_not_an_error(self):
+        # Regression: waffle's own BaseModel.get() falls back to a transient,
+        # unsaved Flag(name=...) instance when nothing in the DB matches the
+        # name -- an M2M lookup (self.clubs) against that unsaved instance used
+        # to raise ValueError instead of just resolving to "off". This is the
+        # normal state for any flag nobody has created in the control panel yet.
+        self.assertFalse(flag_is_active(self.request_for(self.club), "no-such-flag"))
+
+    def test_is_active_for_club_without_a_request(self):
+        self.flag.clubs.add(self.club)
+
+        self.assertTrue(self.flag.is_active_for_club(self.club))
+        self.assertFalse(self.flag.is_active_for_club(self.other))
+
+    def test_is_active_for_club_respects_everyone(self):
+        self.flag.everyone = False
+        self.flag.save()
+        self.assertFalse(self.flag.is_active_for_club(self.club))
+
+        self.flag.everyone = True
+        self.flag.save()
+        self.assertTrue(self.flag.is_active_for_club(self.club))
+
+    def test_cache_is_flushed_when_club_targeting_changes(self):
+        # The M2M does not call save(), so without the flush signal waffle would
+        # keep answering from a stale cached set.
+        self.assertFalse(self.active_for(self.club))  # primes the cache
+
+        self.flag.clubs.add(self.club)
+
+        self.assertTrue(self.active_for(self.club))
+
+    def test_cache_is_flushed_on_reverse_edit(self):
+        self.assertFalse(self.active_for(self.club))
+
+        self.club.flags.add(self.flag)
+
+        self.assertTrue(self.active_for(self.club))
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "testserver"],
+)
+class MaintenanceModeTests(TestCase):
+    def setUp(self):
+        cache.clear()
+        self.addCleanup(cache.clear)
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.user = User.objects.create_user(email="root@example.com", password="pw-secret-123", is_staff=True)
+        Authenticator.objects.create(user=self.user, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+
+    def club_get(self, path="/"):
+        return self.client.get(path, HTTP_HOST="ajax-united.rosterchief.app")
+
+    def platform_get(self, path):
+        return self.client.get(path, HTTP_HOST="rosterchief.app")
+
+    def test_a_club_subdomain_is_closed(self):
+        Maintenance.start(message="Upgrading the database.")
+
+        response = self.club_get("/accounts/login/")
+
+        self.assertEqual(response.status_code, 503)
+        self.assertContains(response, "Upgrading the database", status_code=503)
+        self.assertEqual(response["Retry-After"], "3600")
+
+    def test_a_club_is_open_again_when_maintenance_ends(self):
+        Maintenance.start()
+        Maintenance.stop()
+
+        self.assertEqual(self.club_get("/accounts/login/").status_code, 200)
+
+    def test_the_control_panel_stays_reachable(self):
+        Maintenance.start()
+        self.client.force_login(self.user)
+
+        self.assertEqual(self.platform_get("/controlpanel/").status_code, 200)
+
+    def test_signing_in_stays_possible(self):
+        # Close /accounts/ as well and you cannot sign in to turn maintenance off: a
+        # lock-down with no key, fixable only from a shell.
+        Maintenance.start()
+
+        self.assertEqual(self.platform_get("/accounts/login/").status_code, 200)
+
+    def test_the_club_logo_still_loads_on_the_maintenance_page(self):
+        # The maintenance page is rendered through the club's own skin specifically to show
+        # its logo -- closing /media/ on the club subdomain too would serve the maintenance
+        # page itself in place of that logo, making it look like the logo vanished.
+        Maintenance.start()
+
+        self.assertEqual(self.club_get("/media/clubs/ajax-united/crest.png").status_code, 404)
+
+    def test_the_health_check_still_answers(self):
+        # Close it and the load balancer decides the node is dead and stops routing to it —
+        # taking the control panel down with everything else.
+        Maintenance.start()
+
+        self.assertEqual(self.platform_get("/healthz").status_code, 200)
+        self.assertEqual(self.client.get("/healthz", HTTP_HOST="ajax-united.rosterchief.app").status_code, 200)
+
+    def test_the_rest_of_the_base_domain_is_closed(self):
+        Maintenance.start()
+
+        self.assertEqual(self.platform_get("/").status_code, 503)
+
+    def test_a_json_caller_gets_json(self):
+        Maintenance.start(message="Back soon.")
+
+        response = self.client.get("/", HTTP_HOST="ajax-united.rosterchief.app", headers={"accept": "application/json"})
+
+        self.assertEqual(response.status_code, 503)
+        self.assertEqual(response.json()["status"], "maintenance")
+
+    def test_the_message_is_optional(self):
+        Maintenance.start()
+
+        self.assertContains(self.club_get("/"), "down for maintenance", status_code=503)
+
+    def test_it_says_which_state_it_is_in(self):
+        self.assertEqual(str(Maintenance.start()), "Maintenance on")
+        self.assertEqual(str(Maintenance.stop()), "Maintenance off")
+
+    def test_it_records_who_closed_the_platform_and_when(self):
+        maintenance = Maintenance.start(message="db upgrade", user=self.user)
+
+        self.assertTrue(maintenance.is_active)
+        self.assertEqual(maintenance.started_by, self.user)
+        self.assertIsNotNone(maintenance.started_at)
+
+    def test_the_state_is_shared_rather_than_per_process(self):
+        # The cache is the shared one the flags use, so closing the platform reaches every
+        # worker and every server. A per-process cache would leave some workers serving clubs.
+        Maintenance.start()
+
+        self.assertTrue(cache.get(Maintenance.CACHE_KEY).is_active)
+        self.assertTrue(Maintenance.is_on())
+
+        Maintenance.stop()
+
+        self.assertFalse(cache.get(Maintenance.CACHE_KEY).is_active)
+
+
+class MaintenanceCommandTests(TestCase):
+    def setUp(self):
+        cache.clear()
+        self.addCleanup(cache.clear)
+
+    def run_command(self, name, *args):
+        out = StringIO()
+        call_command(name, *args, stdout=out, stderr=out)
+        return out.getvalue()
+
+    def test_a_scheduled_job_stands_down(self):
+        Maintenance.start()
+
+        with self.assertRaises(CommandError):
+            self.run_command("archive_overdue_clubs")
+
+    def test_it_runs_again_once_the_platform_reopens(self):
+        Maintenance.start()
+        Maintenance.stop()
+
+        self.assertIn("Nothing overdue", self.run_command("archive_overdue_clubs"))
+
+    def test_an_override_exists_for_when_you_mean_it(self):
+        Maintenance.start()
+
+        self.assertIn("Nothing overdue", self.run_command("archive_overdue_clubs", "--ignore-maintenance"))
+
+    def test_migrate_is_not_blocked(self):
+        # Maintenance is usually declared IN ORDER to migrate. A guard on every command would
+        # mean turning the mode off to do the work you turned it on for.
+        Maintenance.start()
+
+        self.run_command("migrate", "--check")  # raises SystemExit only if migrations are pending
diff --git a/formbuilder/__init__.py b/formbuilder/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/formbuilder/admin.py b/formbuilder/admin.py
new file mode 100644
index 0000000..94c6188
--- /dev/null
+++ b/formbuilder/admin.py
@@ -0,0 +1,50 @@
+from django.contrib import admin
+
+from .models import Answer, Field, Form, Submission
+
+
+class FieldInline(admin.TabularInline):
+    model = Field
+    extra = 0
+    fields = ["order", "key", "label", "field_type", "required", "is_active"]
+    ordering = ["order"]
+
+
+@admin.register(Form)
+class FormAdmin(admin.ModelAdmin):
+    list_display = ["title", "slug", "club", "is_active", "login_required", "opens_at", "closes_at"]
+    list_filter = ["club", "is_active", "login_required"]
+    search_fields = ["title", "slug"]
+    prepopulated_fields = {"slug": ["title"]}
+    inlines = [FieldInline]
+
+
+@admin.register(Field)
+class FieldAdmin(admin.ModelAdmin):
+    list_display = ["label", "key", "form", "field_type", "order", "required", "is_active"]
+    list_filter = ["field_type", "required", "is_active"]
+    search_fields = ["label", "key", "form__title"]
+    raw_id_fields = ["form"]
+
+
+class AnswerInline(admin.TabularInline):
+    model = Answer
+    extra = 0
+    raw_id_fields = ["field"]
+
+
+@admin.register(Submission)
+class SubmissionAdmin(admin.ModelAdmin):
+    list_display = ["form", "member", "submitted_at"]
+    list_filter = ["form"]
+    search_fields = ["form__title", "member__first_name", "member__last_name"]
+    raw_id_fields = ["form", "member"]
+    readonly_fields = ["submitted_at"]
+    inlines = [AnswerInline]
+
+
+@admin.register(Answer)
+class AnswerAdmin(admin.ModelAdmin):
+    list_display = ["submission", "field", "value"]
+    search_fields = ["field__label", "field__key"]
+    raw_id_fields = ["submission", "field"]
diff --git a/formbuilder/apps.py b/formbuilder/apps.py
new file mode 100644
index 0000000..28e84de
--- /dev/null
+++ b/formbuilder/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class FormbuilderConfig(AppConfig):
+    name = "formbuilder"
diff --git a/formbuilder/migrations/0001_initial.py b/formbuilder/migrations/0001_initial.py
new file mode 100644
index 0000000..ec03e17
--- /dev/null
+++ b/formbuilder/migrations/0001_initial.py
@@ -0,0 +1,90 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:02
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Form',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('title', models.CharField(max_length=255, verbose_name='title')),
+                ('slug', models.SlugField(unique=True, verbose_name='slug')),
+                ('description', models.TextField(blank=True, verbose_name='description')),
+                ('is_active', models.BooleanField(default=True, verbose_name='is active?')),
+                ('login_required', models.BooleanField(default=False, verbose_name='login required?')),
+                ('opens_at', models.DateTimeField(blank=True, null=True, verbose_name='opens at')),
+                ('closes_at', models.DateTimeField(blank=True, null=True, verbose_name='closes at')),
+                ('max_submissions_per_user', models.PositiveIntegerField(blank=True, null=True, verbose_name='max submissions per user')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'form',
+                'verbose_name_plural': 'forms',
+                'ordering': ['title'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Field',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('key', models.SlugField(unique=True, verbose_name='key')),
+                ('label', models.CharField(max_length=255, verbose_name='label')),
+                ('field_type', models.CharField(choices=[('text', 'text'), ('textarea', 'textarea'), ('number', 'number'), ('email', 'email'), ('date', 'date'), ('choice', 'choice'), ('multichoice', 'multichoice'), ('checkbox', 'checkbox'), ('file', 'file')], default='text', max_length=255, verbose_name='field type')),
+                ('required', models.BooleanField(default=True, verbose_name='required?')),
+                ('help_text', models.TextField(blank=True, verbose_name='help text')),
+                ('order', models.PositiveIntegerField(default=0, verbose_name='order')),
+                ('is_active', models.BooleanField(default=True, verbose_name='is active?')),
+                ('options', models.JSONField(blank=True, null=True, verbose_name='options')),
+                ('form', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='fields', to='formbuilder.form', verbose_name='form')),
+            ],
+            options={
+                'verbose_name': 'field',
+                'verbose_name_plural': 'fields',
+                'ordering': ['form', 'order'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Submission',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('submitted_at', models.DateTimeField(auto_now_add=True, verbose_name='submitted at')),
+                ('form', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='submissions', to='formbuilder.form', verbose_name='form')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='submissions', to='members.member', verbose_name='member')),
+            ],
+            options={
+                'verbose_name': 'submission',
+                'verbose_name_plural': 'submissions',
+                'ordering': ['-submitted_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Answer',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('value', models.JSONField(blank=True, null=True, verbose_name='value')),
+                ('field', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='answers', to='formbuilder.field', verbose_name='field')),
+                ('submission', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='answers', to='formbuilder.submission', verbose_name='submission')),
+            ],
+            options={
+                'verbose_name': 'answer',
+                'verbose_name_plural': 'answers',
+                'ordering': ['submission', 'field'],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='form',
+            constraint=models.UniqueConstraint(fields=('club', 'slug'), name='unique_form_slug_per_club'),
+        ),
+    ]
diff --git a/formbuilder/migrations/0002_alter_answer_field_alter_submission_member.py b/formbuilder/migrations/0002_alter_answer_field_alter_submission_member.py
new file mode 100644
index 0000000..017078c
--- /dev/null
+++ b/formbuilder/migrations/0002_alter_answer_field_alter_submission_member.py
@@ -0,0 +1,25 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:04
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('formbuilder', '0001_initial'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='answer',
+            name='field',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='answers', to='formbuilder.field', verbose_name='field'),
+        ),
+        migrations.AlterField(
+            model_name='submission',
+            name='member',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='submissions', to='members.member', verbose_name='member'),
+        ),
+    ]
diff --git a/formbuilder/migrations/0003_fix_tenant_uniqueness.py b/formbuilder/migrations/0003_fix_tenant_uniqueness.py
new file mode 100644
index 0000000..c3749f0
--- /dev/null
+++ b/formbuilder/migrations/0003_fix_tenant_uniqueness.py
@@ -0,0 +1,31 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:05
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('formbuilder', '0002_alter_answer_field_alter_submission_member'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='field',
+            name='key',
+            field=models.SlugField(verbose_name='key'),
+        ),
+        migrations.AlterField(
+            model_name='form',
+            name='slug',
+            field=models.SlugField(verbose_name='slug'),
+        ),
+        migrations.AddConstraint(
+            model_name='answer',
+            constraint=models.UniqueConstraint(fields=('submission', 'field'), name='unique_answer_per_field_per_submission'),
+        ),
+        migrations.AddConstraint(
+            model_name='field',
+            constraint=models.UniqueConstraint(fields=('form', 'key'), name='unique_field_key_per_form'),
+        ),
+    ]
diff --git a/formbuilder/migrations/0004_alter_field_key_alter_form_slug.py b/formbuilder/migrations/0004_alter_field_key_alter_form_slug.py
new file mode 100644
index 0000000..2066841
--- /dev/null
+++ b/formbuilder/migrations/0004_alter_field_key_alter_form_slug.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:39
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('formbuilder', '0003_fix_tenant_uniqueness'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='field',
+            name='key',
+            field=models.SlugField(blank=True, verbose_name='key'),
+        ),
+        migrations.AlterField(
+            model_name='form',
+            name='slug',
+            field=models.SlugField(blank=True, verbose_name='slug'),
+        ),
+    ]
diff --git a/formbuilder/migrations/0005_answer_created_answer_modified_field_created_and_more.py b/formbuilder/migrations/0005_answer_created_answer_modified_field_created_and_more.py
new file mode 100644
index 0000000..c068112
--- /dev/null
+++ b/formbuilder/migrations/0005_answer_created_answer_modified_field_created_and_more.py
@@ -0,0 +1,58 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('formbuilder', '0004_alter_field_key_alter_form_slug'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='answer',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566066, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='answer',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='field',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566082, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='field',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='form',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566098, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='form',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='submission',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566113, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='submission',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+    ]
diff --git a/formbuilder/migrations/__init__.py b/formbuilder/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/formbuilder/models.py b/formbuilder/models.py
new file mode 100644
index 0000000..7eb2c5a
--- /dev/null
+++ b/formbuilder/models.py
@@ -0,0 +1,107 @@
+from django.core.exceptions import ValidationError
+from django.db import models
+from django.db.models import UniqueConstraint
+from django.utils.translation import gettext_lazy as _
+
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel, unique_slugify
+
+
+class Form(ClubScopedModel):
+    title = models.CharField(_("title"), max_length=255)
+    slug = models.SlugField(_("slug"), blank=True)
+    description = models.TextField(_("description"), blank=True)
+
+    slug_source = "title"
+
+    is_active = models.BooleanField(_("is active?"), default=True)
+    login_required = models.BooleanField(_("login required?"), default=False)
+
+    opens_at = models.DateTimeField(_("opens at"), blank=True, null=True)
+    closes_at = models.DateTimeField(_("closes at"), blank=True, null=True)
+    max_submissions_per_user = models.PositiveIntegerField(_("max submissions per user"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("form")
+        verbose_name_plural = _("forms")
+        ordering = ["title"]
+        constraints = [
+            UniqueConstraint(fields=["club", "slug"], name="unique_form_slug_per_club"),
+        ]
+
+    def __str__(self):
+        return self.title
+
+
+class Field(UUIDModel):
+    class FieldType(models.TextChoices):
+        TEXT = "text", _("text")
+        TEXTAREA = "textarea", _("textarea")
+        NUMBER = "number", _("number")
+        EMAIL = "email", _("email")
+        DATE = "date", _("date")
+        CHOICE = "choice", _("choice")
+        MULTICHOICE = "multichoice", _("multichoice")
+        CHECKBOX = "checkbox", _("checkbox")
+        FILE = "file", _("file")
+
+    form = models.ForeignKey(Form, on_delete=models.CASCADE, related_name="fields", verbose_name=_("form"))
+    key = models.SlugField(_("key"), blank=True)
+    label = models.CharField(_("label"), max_length=255)
+    field_type = models.CharField(_("field type"), max_length=255, choices=FieldType.choices, default=FieldType.TEXT)
+    required = models.BooleanField(_("required?"), default=True)
+    help_text = models.TextField(_("help text"), blank=True)
+    order = models.PositiveIntegerField(_("order"), default=0)
+    is_active = models.BooleanField(_("is active?"), default=True)
+    options = models.JSONField(_("options"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("field")
+        verbose_name_plural = _("fields")
+        ordering = ["form", "order"]
+        constraints = [
+            UniqueConstraint(fields=["form", "key"], name="unique_field_key_per_form"),
+        ]
+
+    def save(self, *args, **kwargs):
+        if not self.key:
+            self.key = unique_slugify(self, self.label, slug_field="key", scope={"form": self.form})
+        super().save(*args, **kwargs)
+
+    def __str__(self):
+        return self.label
+
+
+class Submission(UUIDModel):
+    form = models.ForeignKey(Form, on_delete=models.CASCADE, related_name="submissions", verbose_name=_("form"))
+    member = models.ForeignKey(Member, on_delete=models.SET_NULL, related_name="submissions", verbose_name=_("member"), blank=True, null=True)
+    submitted_at = models.DateTimeField(_("submitted at"), auto_now_add=True)
+
+    class Meta:
+        verbose_name = _("submission")
+        verbose_name_plural = _("submissions")
+        ordering = ["-submitted_at"]
+
+    def __str__(self):
+        return f"{self.form} - {self.member}"
+
+
+class Answer(UUIDModel):
+    submission = models.ForeignKey(Submission, on_delete=models.CASCADE, related_name="answers", verbose_name=_("submission"))
+    field = models.ForeignKey(Field, on_delete=models.PROTECT, related_name="answers", verbose_name=_("field"))
+    value = models.JSONField(_("value"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("answer")
+        verbose_name_plural = _("answers")
+        ordering = ["submission", "field"]
+        constraints = [
+            UniqueConstraint(fields=["submission", "field"], name="unique_answer_per_field_per_submission"),
+        ]
+
+    def __str__(self):
+        return f"{self.submission} - {self.field}"
+
+    def clean(self):
+        if self.field_id and self.submission_id and self.field.form_id != self.submission.form_id:
+            raise ValidationError({"field": _("Must belong to the same form as the submission.")})
diff --git a/formbuilder/services/__init__.py b/formbuilder/services/__init__.py
new file mode 100644
index 0000000..0a5c57e
--- /dev/null
+++ b/formbuilder/services/__init__.py
@@ -0,0 +1,16 @@
+from .form_factory import build_form, build_form_class
+from .options import allowed_values, field_choices
+from .reporting import FormReport, ReportRow, form_report
+from .submission import FormSubmissionError, submit_form
+
+__all__ = [
+    "FormReport",
+    "FormSubmissionError",
+    "ReportRow",
+    "allowed_values",
+    "build_form",
+    "build_form_class",
+    "field_choices",
+    "form_report",
+    "submit_form",
+]
diff --git a/formbuilder/services/form_factory.py b/formbuilder/services/form_factory.py
new file mode 100644
index 0000000..13b388e
--- /dev/null
+++ b/formbuilder/services/form_factory.py
@@ -0,0 +1,35 @@
+"""Build a live ``django.forms.Form`` class from a Form instance's fields."""
+
+from django import forms
+
+from formbuilder.models import Field
+
+from .options import field_choices
+
+FIELD_BUILDERS = {
+    Field.FieldType.TEXT: lambda field, kw: forms.CharField(**kw),
+    Field.FieldType.TEXTAREA: lambda field, kw: forms.CharField(widget=forms.Textarea, **kw),
+    Field.FieldType.NUMBER: lambda field, kw: forms.DecimalField(**kw),
+    Field.FieldType.EMAIL: lambda field, kw: forms.EmailField(**kw),
+    Field.FieldType.DATE: lambda field, kw: forms.DateField(**kw),
+    Field.FieldType.CHOICE: lambda field, kw: forms.ChoiceField(choices=field_choices(field), **kw),
+    Field.FieldType.MULTICHOICE: lambda field, kw: forms.MultipleChoiceField(choices=field_choices(field), **kw),
+    Field.FieldType.CHECKBOX: lambda field, kw: forms.BooleanField(**kw),
+    Field.FieldType.FILE: lambda field, kw: forms.FileField(**kw),
+}
+
+
+def _build_field(field):
+    kwargs = {"required": field.required, "label": field.label, "help_text": field.help_text}
+    return FIELD_BUILDERS[field.field_type](field, kwargs)
+
+
+def build_form_class(form):
+    """Return a ``forms.Form`` subclass with a field per active Field, keyed by ``key``."""
+    fields = {field.key: _build_field(field) for field in form.fields.filter(is_active=True).order_by("order")}
+    return type("DynamicForm", (forms.Form,), fields)
+
+
+def build_form(form, data=None, files=None):
+    """Instantiate the dynamic form, bound to ``data``/``files`` when provided."""
+    return build_form_class(form)(data=data, files=files)
diff --git a/formbuilder/services/options.py b/formbuilder/services/options.py
new file mode 100644
index 0000000..fea825e
--- /dev/null
+++ b/formbuilder/services/options.py
@@ -0,0 +1,23 @@
+"""Helpers for interpreting a Field's ``options`` (choice definitions).
+
+``options`` is a JSON list, either of plain strings (``["a", "b"]``) or of
+``{"value": ..., "label": ...}`` dicts.
+"""
+
+
+def field_choices(field):
+    """Return ``[(value, label), ...]`` for a choice-type field."""
+    choices = []
+    for option in field.options or []:
+        if isinstance(option, dict):
+            value = option.get("value")
+            label = option.get("label", value)
+        else:
+            value = label = option
+        choices.append((value, label))
+    return choices
+
+
+def allowed_values(field):
+    """Return the set of accepted values for a choice-type field."""
+    return {value for value, _ in field_choices(field)}
diff --git a/formbuilder/services/reporting.py b/formbuilder/services/reporting.py
new file mode 100644
index 0000000..15dc2d0
--- /dev/null
+++ b/formbuilder/services/reporting.py
@@ -0,0 +1,46 @@
+"""Build a tabular overview of all answers for a Form."""
+
+from dataclasses import dataclass
+
+from formbuilder.models import Field
+
+CHOICE_TYPES = {Field.FieldType.CHOICE, Field.FieldType.MULTICHOICE, Field.FieldType.CHECKBOX}
+
+
+@dataclass
+class ReportRow:
+    submission: object
+    values: dict  # field id -> answer value
+
+
+@dataclass
+class FormReport:
+    form: object
+    columns: list  # Field instances, in display order
+    rows: list  # ReportRow, newest submission first
+    summaries: dict  # field id -> {stringified value: count} for choice-like fields
+    count: int
+
+
+def form_report(form):
+    """Return a FormReport: one column per field, one row per submission."""
+    columns = list(form.fields.order_by("order"))
+    summaries = {column.id: {} for column in columns if column.field_type in CHOICE_TYPES}
+
+    rows = []
+    submissions = form.submissions.select_related("member").prefetch_related("answers")
+    for submission in submissions:
+        values = {answer.field_id: answer.value for answer in submission.answers.all()}
+        rows.append(ReportRow(submission=submission, values=values))
+        for field_id, bucket in summaries.items():
+            if field_id in values:
+                _tally(bucket, values[field_id])
+
+    return FormReport(form=form, columns=columns, rows=rows, summaries=summaries, count=len(rows))
+
+
+def _tally(bucket, value):
+    items = value if isinstance(value, list) else [value]
+    for item in items:
+        key = str(item)
+        bucket[key] = bucket.get(key, 0) + 1
diff --git a/formbuilder/services/submission.py b/formbuilder/services/submission.py
new file mode 100644
index 0000000..48aedd8
--- /dev/null
+++ b/formbuilder/services/submission.py
@@ -0,0 +1,65 @@
+"""Validate and persist a submission against a Form's fields and rules."""
+
+from django.db import transaction
+from django.utils import timezone
+
+from formbuilder.models import Answer, Submission
+
+from .form_factory import build_form
+
+
+class FormSubmissionError(Exception):
+    """Raised when a submission is rejected. ``errors`` maps field key -> messages."""
+
+    def __init__(self, message, *, errors=None):
+        super().__init__(message)
+        self.errors = errors or {}
+
+
+def _is_empty(value):
+    return value is None or value == "" or value == []
+
+
+@transaction.atomic
+def submit_form(form, member, data, *, files=None, when=None):
+    """Create a Submission (with Answers) for ``data``/``files`` or raise FormSubmissionError.
+
+    Validation goes through ``build_form`` — the same dynamic Django Form the UI would
+    render — so a NUMBER field is actually checked as a decimal, an EMAIL as an email, a
+    CHOICE against its real options, and so on, rather than a hand-rolled subset of that.
+    """
+    when = when or timezone.now()
+
+    _check_open(form, member, when)
+    cleaned = _clean_answers(form, data, files)
+
+    submission = Submission.objects.create(form=form, member=member)
+    Answer.objects.bulk_create([Answer(submission=submission, field=field, value=value) for field, value in cleaned])
+    return submission
+
+
+def _check_open(form, member, when):
+    if not form.is_active:
+        raise FormSubmissionError("This form is not accepting submissions.")
+    if form.login_required and member is None:
+        raise FormSubmissionError("You must be signed in to submit this form.")
+    if form.opens_at is not None and when < form.opens_at:
+        raise FormSubmissionError("This form is not open yet.")
+    if form.closes_at is not None and when > form.closes_at:
+        raise FormSubmissionError("This form has closed.")
+    if form.max_submissions_per_user is not None and member is not None:
+        used = form.submissions.filter(member=member).count()
+        if used >= form.max_submissions_per_user:
+            raise FormSubmissionError("You have reached the maximum number of submissions for this form.")
+
+
+def _clean_answers(form, data, files):
+    bound_form = build_form(form, data=data, files=files or {})
+    if not bound_form.is_valid():
+        errors = {key: list(messages) for key, messages in bound_form.errors.items()}
+        raise FormSubmissionError("The submission has errors.", errors=errors)
+
+    # Blank optional answers are validated (they may legitimately be empty) but not
+    # stored — an Answer row exists only where the submitter actually said something.
+    fields_by_key = {field.key: field for field in form.fields.filter(is_active=True)}
+    return [(fields_by_key[key], value) for key, value in bound_form.cleaned_data.items() if not _is_empty(value)]
diff --git a/formbuilder/tests.py b/formbuilder/tests.py
new file mode 100644
index 0000000..0305e3c
--- /dev/null
+++ b/formbuilder/tests.py
@@ -0,0 +1,367 @@
+from datetime import timedelta
+
+from django import forms
+from django.core.exceptions import ValidationError
+from django.db import IntegrityError
+from django.db.models import ProtectedError
+from django.test import TestCase
+from django.utils import timezone
+
+from club.models import Club
+from members.models import Member
+
+from .models import Answer, Field, Form, Submission
+from .services import (
+    FormSubmissionError,
+    build_form,
+    build_form_class,
+    field_choices,
+    form_report,
+    submit_form,
+)
+
+
+class FormbuilderTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.form = Form.objects.create(club=self.club, title="Sign-up", slug="sign-up")
+        self.name = Field.objects.create(form=self.form, key="name", label="Name", field_type=Field.FieldType.TEXT, required=True, order=1)
+        self.size = Field.objects.create(form=self.form, key="size", label="Shirt size", field_type=Field.FieldType.CHOICE, required=False, order=2, options=["S", "M", "L"])
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+
+
+class ModelTests(FormbuilderTestBase):
+    def test_str_methods(self):
+        submission = Submission.objects.create(form=self.form, member=self.member)
+        answer = Answer.objects.create(submission=submission, field=self.name, value="Jane")
+
+        self.assertEqual(str(self.form), "Sign-up")
+        self.assertEqual(str(self.name), "Name")
+        self.assertEqual(str(submission), "Sign-up - Jane Doe")
+        self.assertEqual(str(answer), "Sign-up - Jane Doe - Name")
+
+    def test_slug_is_unique_per_club_not_globally(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Form.objects.create(club=other_club, title="Sign-up", slug="sign-up")
+
+        with self.assertRaises(IntegrityError):
+            Form.objects.create(club=self.club, title="Another", slug="sign-up")
+
+    def test_key_is_unique_per_form_not_globally(self):
+        other_form = Form.objects.create(club=self.club, title="Other", slug="other")
+        Field.objects.create(form=other_form, key="name", label="Name", order=1)
+
+        with self.assertRaises(IntegrityError):
+            Field.objects.create(form=self.form, key="name", label="Duplicate", order=9)
+
+    def test_answer_is_unique_per_field_per_submission(self):
+        submission = Submission.objects.create(form=self.form, member=self.member)
+        Answer.objects.create(submission=submission, field=self.name, value="Jane")
+
+        with self.assertRaises(IntegrityError):
+            Answer.objects.create(submission=submission, field=self.name, value="Again")
+
+    def test_deleting_form_cascades_to_fields_and_submissions(self):
+        Submission.objects.create(form=self.form, member=self.member)
+
+        self.form.delete()
+
+        self.assertFalse(Field.objects.exists())
+        self.assertFalse(Submission.objects.exists())
+
+    def test_field_referenced_by_answer_is_protected(self):
+        submission = Submission.objects.create(form=self.form, member=self.member)
+        Answer.objects.create(submission=submission, field=self.name, value="Jane")
+
+        with self.assertRaises(ProtectedError):
+            self.name.delete()
+
+
+class FormSlugTests(FormbuilderTestBase):
+    def test_slug_auto_populated_from_title(self):
+        form = Form.objects.create(club=self.club, title="Registration Form")
+
+        self.assertEqual(form.slug, "registration-form")
+
+    def test_explicit_slug_is_preserved(self):
+        form = Form.objects.create(club=self.club, title="Registration", slug="reg")
+
+        self.assertEqual(form.slug, "reg")
+
+    def test_slug_is_unique_per_club_with_suffix(self):
+        first = Form.objects.create(club=self.club, title="Registration")
+        second = Form.objects.create(club=self.club, title="Registration")
+
+        self.assertEqual(first.slug, "registration")
+        self.assertEqual(second.slug, "registration-2")
+
+
+class FieldKeyTests(FormbuilderTestBase):
+    def test_key_auto_populated_from_label(self):
+        field = Field.objects.create(form=self.form, label="First Name", order=5)
+
+        self.assertEqual(field.key, "first-name")
+
+    def test_explicit_key_is_preserved(self):
+        field = Field.objects.create(form=self.form, key="fn", label="First Name", order=5)
+
+        self.assertEqual(field.key, "fn")
+
+    def test_key_is_unique_per_form_with_suffix(self):
+        first = Field.objects.create(form=self.form, label="First Name", order=5)
+        second = Field.objects.create(form=self.form, label="First Name", order=6)
+
+        self.assertEqual(first.key, "first-name")
+        self.assertEqual(second.key, "first-name-2")
+
+    def test_same_key_allowed_in_a_different_form(self):
+        other_form = Form.objects.create(club=self.club, title="Other", slug="other")
+        here = Field.objects.create(form=self.form, label="First Name", order=5)
+        there = Field.objects.create(form=other_form, label="First Name", order=1)
+
+        self.assertEqual(here.key, there.key)
+
+
+class FieldChoicesTests(FormbuilderTestBase):
+    def test_string_options(self):
+        self.assertEqual(field_choices(self.size), [("S", "S"), ("M", "M"), ("L", "L")])
+
+    def test_dict_options(self):
+        field = Field.objects.create(form=self.form, key="tier", label="Tier", field_type=Field.FieldType.CHOICE, order=3, options=[{"value": "a", "label": "Gold"}, {"value": "b", "label": "Silver"}])
+
+        self.assertEqual(field_choices(field), [("a", "Gold"), ("b", "Silver")])
+
+    def test_no_options(self):
+        self.assertEqual(field_choices(self.name), [])
+
+
+class SubmitFormTests(FormbuilderTestBase):
+    def test_successful_submission_creates_submission_and_answers(self):
+        submission = submit_form(self.form, self.member, {"name": "Jane", "size": "M"})
+
+        self.assertEqual(submission.form, self.form)
+        self.assertEqual(submission.member, self.member)
+        self.assertEqual(submission.answers.count(), 2)
+        self.assertEqual(submission.answers.get(field=self.name).value, "Jane")
+
+    def test_optional_field_can_be_omitted(self):
+        submission = submit_form(self.form, self.member, {"name": "Jane"})
+
+        self.assertEqual(submission.answers.count(), 1)
+
+    def test_missing_required_field_is_rejected(self):
+        with self.assertRaises(FormSubmissionError) as ctx:
+            submit_form(self.form, self.member, {"size": "M"})
+
+        self.assertIn("name", ctx.exception.errors)
+        self.assertFalse(Submission.objects.exists())
+
+    def test_inactive_form_is_rejected(self):
+        self.form.is_active = False
+        self.form.save()
+
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, self.member, {"name": "Jane"})
+
+    def test_login_required_without_member_is_rejected(self):
+        self.form.login_required = True
+        self.form.save()
+
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, None, {"name": "Jane"})
+
+    def test_anonymous_submission_allowed_when_login_not_required(self):
+        submission = submit_form(self.form, None, {"name": "Jane"})
+
+        self.assertIsNone(submission.member)
+
+    def test_not_open_yet_is_rejected(self):
+        self.form.opens_at = timezone.now() + timedelta(days=1)
+        self.form.save()
+
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, self.member, {"name": "Jane"})
+
+    def test_closed_form_is_rejected(self):
+        self.form.closes_at = timezone.now() - timedelta(days=1)
+        self.form.save()
+
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, self.member, {"name": "Jane"})
+
+    def test_open_window_respects_when_argument(self):
+        self.form.opens_at = timezone.now() + timedelta(days=1)
+        self.form.save()
+
+        submission = submit_form(self.form, self.member, {"name": "Jane"}, when=timezone.now() + timedelta(days=2))
+
+        self.assertTrue(Submission.objects.filter(pk=submission.pk).exists())
+
+    def test_max_submissions_per_user_is_enforced(self):
+        self.form.max_submissions_per_user = 1
+        self.form.save()
+        submit_form(self.form, self.member, {"name": "Jane"})
+
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, self.member, {"name": "Jane"})
+
+    def test_invalid_choice_is_rejected(self):
+        with self.assertRaises(FormSubmissionError) as ctx:
+            submit_form(self.form, self.member, {"name": "Jane", "size": "XL"})
+
+        self.assertIn("size", ctx.exception.errors)
+
+    def test_number_field_rejects_non_numeric_input(self):
+        # Validation goes through the same dynamic Django Form the UI renders, so a
+        # NUMBER field is checked as a decimal — not merely "present".
+        Field.objects.create(form=self.form, key="age", label="Age", field_type=Field.FieldType.NUMBER, required=True, order=3)
+
+        with self.assertRaises(FormSubmissionError) as ctx:
+            submit_form(self.form, self.member, {"name": "Jane", "age": "not-a-number"})
+
+        self.assertIn("age", ctx.exception.errors)
+
+    def test_email_field_rejects_an_invalid_address(self):
+        Field.objects.create(form=self.form, key="contact", label="Contact", field_type=Field.FieldType.EMAIL, required=True, order=3)
+
+        with self.assertRaises(FormSubmissionError) as ctx:
+            submit_form(self.form, self.member, {"name": "Jane", "contact": "not-an-email"})
+
+        self.assertIn("contact", ctx.exception.errors)
+
+    def test_multichoice_validation(self):
+        field = Field.objects.create(form=self.form, key="days", label="Days", field_type=Field.FieldType.MULTICHOICE, required=False, order=3, options=["mon", "tue", "wed"])
+
+        submit_form(self.form, self.member, {"name": "Jane", "days": ["mon", "wed"]})
+        with self.assertRaises(FormSubmissionError):
+            submit_form(self.form, self.member, {"name": "Joe", "days": ["mon", "sun"]})
+        self.assertEqual(Answer.objects.filter(field=field).count(), 1)
+
+    def test_inactive_field_is_ignored(self):
+        Field.objects.create(form=self.form, key="secret", label="Secret", field_type=Field.FieldType.TEXT, required=True, is_active=False, order=4)
+
+        submission = submit_form(self.form, self.member, {"name": "Jane"})
+
+        self.assertFalse(submission.answers.filter(field__key="secret").exists())
+
+    def test_unknown_keys_are_ignored(self):
+        submission = submit_form(self.form, self.member, {"name": "Jane", "bogus": "x"})
+
+        self.assertEqual(submission.answers.count(), 1)
+
+
+class BuildFormTests(FormbuilderTestBase):
+    def make_all_field_types_form(self):
+        form = Form.objects.create(club=self.club, title="All", slug="all")
+        specs = [
+            ("f_text", Field.FieldType.TEXT, forms.CharField),
+            ("f_area", Field.FieldType.TEXTAREA, forms.CharField),
+            ("f_num", Field.FieldType.NUMBER, forms.DecimalField),
+            ("f_email", Field.FieldType.EMAIL, forms.EmailField),
+            ("f_date", Field.FieldType.DATE, forms.DateField),
+            ("f_choice", Field.FieldType.CHOICE, forms.ChoiceField),
+            ("f_multi", Field.FieldType.MULTICHOICE, forms.MultipleChoiceField),
+            ("f_check", Field.FieldType.CHECKBOX, forms.BooleanField),
+            ("f_file", Field.FieldType.FILE, forms.FileField),
+        ]
+        for i, (key, field_type, _) in enumerate(specs):
+            Field.objects.create(form=form, key=key, label=key, field_type=field_type, required=False, order=i, options=["a", "b"])
+        return form, specs
+
+    def test_field_classes_map_from_field_type(self):
+        form, specs = self.make_all_field_types_form()
+
+        instance = build_form_class(form)()
+
+        for key, _, expected in specs:
+            with self.subTest(key=key):
+                self.assertIsInstance(instance.fields[key], expected)
+
+    def test_required_and_labels_propagate(self):
+        instance = build_form_class(self.form)()
+
+        self.assertTrue(instance.fields["name"].required)
+        self.assertFalse(instance.fields["size"].required)
+        self.assertEqual(instance.fields["name"].label, "Name")
+
+    def test_choice_field_gets_choices(self):
+        instance = build_form(self.form)
+
+        self.assertEqual(list(instance.fields["size"].choices), [("S", "S"), ("M", "M"), ("L", "L")])
+
+    def test_bound_form_validates(self):
+        bound = build_form(self.form, data={"name": "Jane", "size": "M"})
+
+        self.assertTrue(bound.is_valid())
+        self.assertEqual(bound.cleaned_data["name"], "Jane")
+
+    def test_bound_form_reports_required_error(self):
+        bound = build_form(self.form, data={"size": "M"})
+
+        self.assertFalse(bound.is_valid())
+        self.assertIn("name", bound.errors)
+
+    def test_inactive_fields_are_excluded(self):
+        Field.objects.create(form=self.form, key="hidden", label="Hidden", is_active=False, order=9)
+
+        instance = build_form(self.form)
+
+        self.assertNotIn("hidden", instance.fields)
+
+
+class FormReportTests(FormbuilderTestBase):
+    def test_columns_are_fields_in_order(self):
+        report = form_report(self.form)
+
+        self.assertEqual(report.columns, [self.name, self.size])
+
+    def test_rows_carry_answer_values(self):
+        submit_form(self.form, self.member, {"name": "Jane", "size": "M"})
+
+        report = form_report(self.form)
+
+        self.assertEqual(report.count, 1)
+        row = report.rows[0]
+        self.assertEqual(row.values[self.name.id], "Jane")
+        self.assertEqual(row.values[self.size.id], "M")
+
+    def test_choice_field_is_summarised(self):
+        submit_form(self.form, self.member, {"name": "Jane", "size": "M"})
+        submit_form(self.form, Member.objects.create(first_name="Joe", last_name="Roe"), {"name": "Joe", "size": "M"})
+        submit_form(self.form, Member.objects.create(first_name="Kim", last_name="Ash"), {"name": "Kim", "size": "L"})
+
+        report = form_report(self.form)
+
+        self.assertEqual(report.summaries[self.size.id], {"M": 2, "L": 1})
+        self.assertNotIn(self.name.id, report.summaries)
+
+    def test_multichoice_values_are_tallied_per_option(self):
+        days = Field.objects.create(form=self.form, key="days", label="Days", field_type=Field.FieldType.MULTICHOICE, required=False, order=3, options=["mon", "tue"])
+        submit_form(self.form, self.member, {"name": "Jane", "days": ["mon", "tue"]})
+
+        report = form_report(self.form)
+
+        self.assertEqual(report.summaries[days.id], {"mon": 1, "tue": 1})
+
+    def test_empty_form_reports_no_rows(self):
+        report = form_report(self.form)
+
+        self.assertEqual(report.count, 0)
+        self.assertEqual(report.rows, [])
+
+
+class AnswerCleanTests(FormbuilderTestBase):
+    def test_rejects_field_from_another_form(self):
+        other_form = Form.objects.create(club=self.club, title="Other", slug="other")
+        other_field = Field.objects.create(form=other_form, key="x", label="X", order=1)
+        submission = Submission.objects.create(form=self.form, member=self.member)
+        answer = Answer(submission=submission, field=other_field, value="v")
+
+        with self.assertRaises(ValidationError) as ctx:
+            answer.full_clean()
+        self.assertIn("field", ctx.exception.error_dict)
+
+    def test_accepts_field_from_the_submissions_form(self):
+        submission = Submission.objects.create(form=self.form, member=self.member)
+
+        Answer(submission=submission, field=self.name, value="v").full_clean()
diff --git a/formbuilder/views.py b/formbuilder/views.py
new file mode 100644
index 0000000..60f00ef
--- /dev/null
+++ b/formbuilder/views.py
@@ -0,0 +1 @@
+# Create your views here.
diff --git a/manage.py b/manage.py
index e3be89a..86cc41a 100755
--- a/manage.py
+++ b/manage.py
@@ -1,22 +1,19 @@
 #!/usr/bin/env python
 """Django's command-line utility for administrative tasks."""
+
 import os
 import sys
 
 
 def main():
     """Run administrative tasks."""
-    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'clubmanager.settings')
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rosterchief.settings")
     try:
         from django.core.management import execute_from_command_line
     except ImportError as exc:
-        raise ImportError(
-            "Couldn't import Django. Are you sure it's installed and "
-            "available on your PYTHONPATH environment variable? Did you "
-            "forget to activate a virtual environment?"
-        ) from exc
+        raise ImportError("Couldn't import Django. Are you sure it's installed and available on your PYTHONPATH environment variable? Did you forget to activate a virtual environment?") from exc
     execute_from_command_line(sys.argv)
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/management/__init__.py b/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/management/apps.py b/management/apps.py
new file mode 100644
index 0000000..f4ad1a6
--- /dev/null
+++ b/management/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class ManagementConfig(AppConfig):
+    name = "management"
diff --git a/management/bulk_import.py b/management/bulk_import.py
new file mode 100644
index 0000000..4715219
--- /dev/null
+++ b/management/bulk_import.py
@@ -0,0 +1,163 @@
+"""Mass-uploading members from an Excel template: extracting a workbook into plain
+row data, and validating that data into what will be created.
+
+Kept as two separate functions so binary parsing happens exactly once (at upload
+time) while validation -- the part that must behave identically whether it's
+building the preview or actually creating records -- runs against plain data both
+times (see MemberImportView / MemberImportConfirmView in management/views.py).
+"""
+
+from datetime import date, datetime
+
+import openpyxl
+from django.db.models import Q
+from django.utils.translation import gettext_lazy as _
+from openpyxl.worksheet.datavalidation import DataValidation
+
+from club.models import ClubMembership
+from members.models import Member
+
+from .forms import MemberForm
+
+TEMPLATE_COLUMNS = ["first_name", "last_name", "date_of_birth", "email", "phone", "emergency_phone", "license", "status", "fee_status"]
+REQUIRED_HEADER_COLUMNS = {"first_name", "last_name"}
+
+TEMPLATE_EXAMPLE_ROW = ["Alex", "Morgan", date(2012, 5, 14), "alex.morgan@example.com", "+32470123456", "+32470654321", "", ClubMembership.StatusChoices.ACTIVE, ClubMembership.FeeStatus.UNPAID]
+
+
+def build_member_import_template():
+    """The downloadable .xlsx: header row, one example row, and a dropdown on the
+    status/fee_status columns so a cell can't be typo'd into an invalid value."""
+    workbook = openpyxl.Workbook()
+    sheet = workbook.active
+    sheet.title = "Members"
+
+    sheet.append(TEMPLATE_COLUMNS)
+    for cell in sheet[1]:
+        cell.font = openpyxl.styles.Font(bold=True)
+    sheet.freeze_panes = "A2"
+
+    sheet.append(TEMPLATE_EXAMPLE_ROW)
+
+    for column_name, choices in (("status", ClubMembership.StatusChoices), ("fee_status", ClubMembership.FeeStatus)):
+        column_index = TEMPLATE_COLUMNS.index(column_name) + 1
+        column_letter = sheet.cell(row=1, column=column_index).column_letter
+        options = ",".join(choices.values)
+        validation = DataValidation(type="list", formula1=f'"{options}"', allow_blank=True)
+        sheet.add_data_validation(validation)
+        validation.add(f"{column_letter}2:{column_letter}1000")
+
+    for column_index, column_name in enumerate(TEMPLATE_COLUMNS, start=1):
+        sheet.column_dimensions[sheet.cell(row=1, column=column_index).column_letter].width = max(12, len(column_name) + 2)
+
+    return workbook
+
+
+def read_member_import_workbook(file):
+    """Uploaded .xlsx -> list[dict], one dict per row keyed by TEMPLATE_COLUMNS.
+
+    Normalizes every cell to a plain str/None here: openpyxl returns typed cells
+    (a date-formatted cell comes back as a datetime.date, a phone number typed as
+    digits-only can come back as a number), so this is the one place that has to
+    deal with that -- everything downstream, including the session, only ever
+    sees plain strings.
+    """
+    workbook = openpyxl.load_workbook(file, data_only=True)
+    sheet = workbook.active
+
+    header = [str(cell.value).strip() if cell.value is not None else "" for cell in next(sheet.iter_rows(min_row=1, max_row=1))]
+    if not REQUIRED_HEADER_COLUMNS.issubset(header):
+        missing = REQUIRED_HEADER_COLUMNS - set(header)
+        raise ValueError(_("This doesn't look like the template — missing column(s): %(columns)s.") % {"columns": ", ".join(sorted(missing))})
+
+    rows = []
+    for excel_row in sheet.iter_rows(min_row=2):
+        values = {}
+        for column_name, cell in zip(header, excel_row, strict=False):
+            if column_name not in TEMPLATE_COLUMNS:
+                continue
+            values[column_name] = _cell_to_str(cell.value)
+
+        if not any(values.values()):
+            continue  # a fully blank row (trailing spreadsheet padding) isn't a row to import
+        rows.append(values)
+
+    return rows
+
+
+def _cell_to_str(value):
+    if value is None:
+        return ""
+    if isinstance(value, datetime):
+        return value.date().isoformat()
+    if isinstance(value, date):
+        return value.isoformat()
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    return str(value).strip()
+
+
+def parse_member_import_rows(rows, club):
+    """list[dict] (as returned by read_member_import_workbook) -> one result per
+    row: {line_number, raw, member, membership_kwargs, errors}. `member` is an
+    unsaved Member instance (ready to .save()) when the row is valid, else None."""
+    results = []
+    seen_emails = set()
+
+    for line_number, raw in enumerate(rows, start=2):
+        errors = []
+        member_fields = {key: raw.get(key, "") for key in ("first_name", "last_name", "date_of_birth", "email", "phone", "emergency_phone")}
+        form = MemberForm(data=member_fields)
+
+        member = None
+        if form.is_valid():
+            member = form.save(commit=False)
+        else:
+            for field_errors in form.errors.values():
+                errors.extend(field_errors)
+
+        email = member_fields["email"].strip()
+        if email:
+            if email.lower() in seen_emails:
+                errors.append(_("Duplicate email in this file."))
+            seen_emails.add(email.lower())
+            already_in_club = Member.objects.filter(member_of__club=club).filter(Q(email__iexact=email) | Q(user__email__iexact=email)).exists()
+            if already_in_club:
+                errors.append(_("Already a member of this club."))
+
+        membership_kwargs, status_fee_errors = _parse_membership_fields(raw)
+        errors.extend(status_fee_errors)
+
+        results.append({"line_number": line_number, "raw": raw, "member": member if not errors else None, "membership_kwargs": membership_kwargs, "errors": errors})
+
+    return results
+
+
+def _parse_membership_fields(raw):
+    errors = []
+    license_number = raw.get("license", "").strip()
+
+    status = raw.get("status", "").strip()
+    if status:
+        status_value = _match_choice(status, ClubMembership.StatusChoices)
+        if status_value is None:
+            errors.append(_("Invalid status '%(value)s'.") % {"value": status})
+    else:
+        status_value = ClubMembership.StatusChoices.ACTIVE
+
+    fee_status = raw.get("fee_status", "").strip()
+    if fee_status:
+        fee_status_value = _match_choice(fee_status, ClubMembership.FeeStatus)
+        if fee_status_value is None:
+            errors.append(_("Invalid fee status '%(value)s'.") % {"value": fee_status})
+    else:
+        fee_status_value = ClubMembership.FeeStatus.UNPAID
+
+    return {"license": license_number, "status": status_value, "fee_status": fee_status_value}, errors
+
+
+def _match_choice(value, choices):
+    for choice_value in choices.values:
+        if choice_value.lower() == value.lower():
+            return choice_value
+    return None
diff --git a/management/context_processors.py b/management/context_processors.py
new file mode 100644
index 0000000..9275e30
--- /dev/null
+++ b/management/context_processors.py
@@ -0,0 +1,172 @@
+"""Whether the signed-in user is a club ADMIN, for the management nav to hide
+admin-only sections (seasons, positions, roles, shop, forms) from plain staff.
+
+The underlying views are gated regardless (``ClubAdminRequiredMixin``) -- this is
+purely so the nav doesn't show a link a coach or manager can't actually follow.
+Same reasoning for ``news_permissions`` below, gating just the "New news item"
+action rather than the whole section (``NewsAuthorRequiredMixin``/``can_add_news``).
+"""
+
+from waffle import flag_is_active
+
+from club.services.access import can_add_news, has_management_access, is_club_admin, is_coach_manager
+
+#: Every management URL name, mapped to the nav item it should light up --
+#: management/templates/management/_nav_items.html compares against this.
+#: One dict here beats threading `nav=` through every view in views.py, and
+#: unlike that, a new page can't silently be forgotten (it just renders with
+#: no active item until added below, rather than needing every view touched).
+_NAV_SECTIONS = {
+    "home": "home",
+    "member_list": "member_list",
+    "member_create": "member_list",
+    "member_import_template": "member_list",
+    "member_import": "member_list",
+    "member_import_confirm": "member_list",
+    "member_detail": "member_list",
+    "member_update": "member_list",
+    "member_delete": "member_list",
+    "member_attach_family": "member_list",
+    "member_grant_login": "member_list",
+    "member_detach_family": "member_list",
+    "family_create": "member_list",
+    "family_detail": "member_list",
+    "family_add_child": "member_list",
+    "family_add_parent": "member_list",
+    "family_membership_role_update": "member_list",
+    "membership_list": "membership_list",
+    "membership_mark_paid": "membership_list",
+    "membership_export_pdf": "membership_list",
+    "membership_mark_fully_paid": "membership_list",
+    "membership_record_payment": "membership_list",
+    "position_list": "position_list",
+    "position_create": "position_list",
+    "position_update": "position_list",
+    "role_list": "role_list",
+    "role_create": "role_list",
+    "role_revoke": "role_list",
+    "team_list": "team_list",
+    "team_create": "team_list",
+    "team_update": "team_list",
+    "team_delete": "team_list",
+    "team_detail": "team_list",
+    "team_roster_add": "team_list",
+    "team_roster_update": "team_list",
+    "team_roster_remove": "team_list",
+    "team_staff_add": "team_list",
+    "team_staff_update": "team_list",
+    "team_staff_remove": "team_list",
+    "team_photo_set": "team_list",
+    "team_photo_delete": "team_list",
+    "news_list": "news_list",
+    "news_create": "news_list",
+    "news_detail": "news_list",
+    "news_update": "news_list",
+    "news_delete": "news_list",
+    "news_publish": "news_list",
+    "news_unpublish": "news_list",
+    "news_photo_upload": "news_list",
+    "news_photo_set_main": "news_list",
+    "news_photo_delete": "news_list",
+    "event_list": "event_list",
+    "event_create": "event_list",
+    "event_detail": "event_list",
+    "event_update": "event_list",
+    "event_delete": "event_list",
+    "event_detach": "event_list",
+    "event_fetch_game_info": "event_list",
+    "rbihf_import": "event_list",
+    "rbihf_import_confirm": "event_list",
+    "event_series_create": "event_list",
+    "event_series_detail": "event_list",
+    "event_series_update": "event_list",
+    "event_series_delete": "event_list",
+    "event_series_stop": "event_list",
+    "event_series_generate": "event_list",
+    "location_list": "location_list",
+    "location_create": "location_list",
+    "location_update": "location_list",
+    "location_delete": "location_list",
+    "opponent_list": "opponent_list",
+    "opponent_create": "opponent_list",
+    "opponent_update": "opponent_list",
+    "opponent_delete": "opponent_list",
+    "sponsor_list": "sponsor_list",
+    "sponsor_create": "sponsor_list",
+    "sponsor_update": "sponsor_list",
+    "sponsor_delete": "sponsor_list",
+    "product_list": "product_list",
+    "order_list": "order_list",
+    "discount_list": "discount_list",
+    "invoice_list": "invoice_list",
+    "form_list": "form_list",
+    "submission_list": "form_list",
+}
+
+
+def active_nav_section(request):
+    """Which management nav item is currently active, derived from the resolved
+    URL name. Guarded on the "management" namespace so a same-named url_name in
+    some other app can never leak into this."""
+    match = request.resolver_match
+    if match is None or match.namespace != "management":
+        return {"nav": None}
+
+    return {"nav": _NAV_SECTIONS.get(match.url_name)}
+
+
+def is_admin(request):
+    club = getattr(request, "club", None)
+    if club is None or not request.user.is_authenticated:
+        return {"is_club_admin": False}
+
+    return {"is_club_admin": is_club_admin(request.user, club)}
+
+
+def management_position(request):
+    """Whether the signed-in user holds a management position (or is ADMIN) --
+    gates the nav's Locations/Opponents links, which ``ManagementPositionRequiredMixin``
+    restricts to exactly this group (unlike most staff-visible sections)."""
+    club = getattr(request, "club", None)
+    if club is None or not request.user.is_authenticated:
+        return {"has_management_position": False}
+
+    return {"has_management_position": is_club_admin(request.user, club) or is_coach_manager(request.user, club)}
+
+
+def management_link(request):
+    """Whether to show a "Management" link in the global navbar (templates/_base.html),
+    next to the Django admin one -- only on a club subdomain, and only for someone with
+    real authority there (see has_management_access)."""
+    club = getattr(request, "club", None)
+    if club is None or not request.user.is_authenticated:
+        return {"has_management_access": False}
+
+    return {"has_management_access": has_management_access(request.user, club)}
+
+
+def feature_sections(request):
+    """Whether the nav's Shop/Forms sections -- and the Events page's "Import
+    from RBIHF" button -- should show at all. Each is gated behind its own
+    waffle Flag (see club.mixins.FeatureRequiredMixin, which gates the
+    underlying views regardless), on top of the existing is_club_admin check
+    those all already require."""
+    club = getattr(request, "club", None)
+    if club is None or not request.user.is_authenticated:
+        return {"shop_enabled": False, "forms_enabled": False, "rbihf_enabled": False}
+
+    return {
+        "shop_enabled": flag_is_active(request, "shop"),
+        "forms_enabled": flag_is_active(request, "formbuilder"),
+        "rbihf_enabled": flag_is_active(request, "RBIHF"),
+    }
+
+
+def news_permissions(request):
+    """Whether the "New news item" action should show -- viewing the News
+    section itself is open to any staff, same as Roster/Staff."""
+    club = getattr(request, "club", None)
+    if club is None or not request.user.is_authenticated:
+        return {"can_add_news": False}
+
+    return {"can_add_news": can_add_news(request.user, club)}
diff --git a/management/forms.py b/management/forms.py
new file mode 100644
index 0000000..cebe039
--- /dev/null
+++ b/management/forms.py
@@ -0,0 +1,512 @@
+import datetime
+from decimal import Decimal
+
+from django import forms
+from django.contrib.auth import get_user_model
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from club.models import ClubMembership, ClubRole, FeePayment, Season, Sponsor
+from club.services.access import is_club_admin, teams_managed_by
+from events.models import Competition, Event, EventSeries, Location, Opponent
+from events.services.rbihf_import import RBIHFImportError, extract_team_id
+from members.models import Family, FamilyMembership, Member
+from members.services.family import find_member_by_email
+from news.models import News
+from teams.models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+from .recurrence_ui import FREQUENCY_CHOICES, WEEKDAY_CHOICES, build_rrule, parse_rrule
+
+User = get_user_model()
+
+
+class MemberForm(forms.ModelForm):
+    class Meta:
+        model = Member
+        fields = ["first_name", "last_name", "date_of_birth", "email", "phone", "emergency_phone"]
+        widgets = {"date_of_birth": forms.DateInput(attrs={"type": "date"})}
+
+
+class TeamForm(forms.ModelForm):
+    class Meta:
+        model = Team
+        fields = ["name", "short_name"]
+
+
+class TeamPhotoForm(forms.ModelForm):
+    """One photo per (team, season) -- bound to the existing TeamPhoto (if
+    any) by the view's get_form_kwargs, same "create or update the one row
+    for this scope" pattern as controlpanel.forms.HomeLocationForm."""
+
+    class Meta:
+        model = TeamPhoto
+        fields = ["image"]
+
+
+class TeamMembershipForm(forms.ModelForm):
+    """Add/edit one roster entry -- team and season come from the view (the URL
+    already identifies both), never from the form itself."""
+
+    class Meta:
+        model = TeamMembership
+        fields = ["member", "position", "jersey_number", "is_captain", "is_alternate_captain"]
+        widgets = {"member": forms.Select(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a name to search...")})}
+
+    def __init__(self, *args, club=None, team=None, season=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.team = team
+        self.season = season
+        # Eligible to be added regardless of which season's roster is being edited
+        # (the team detail page's season switcher can be pointed at an older
+        # season): active this season or the next one, not lapsed/pending/cancelled
+        # or active only in some other season.
+        today = timezone.localdate()
+        eligible_seasons = [s for s in (Season.covering(club, today), Season.next_after(club, today)) if s is not None]
+        members = Member.objects.filter(member_of__club=club, member_of__season__in=eligible_seasons, member_of__status=ClubMembership.StatusChoices.ACTIVE).distinct()
+        if team is not None and season is not None:
+            # Already on this team's roster this season -- offering them again
+            # would just fail the unique_member_per_team_per_season constraint.
+            taken = TeamMembership.objects.filter(team=team, season=season).exclude(pk=self.instance.pk).values_list("member_id", flat=True)
+            members = members.exclude(pk__in=taken)
+        self.fields["member"].queryset = members
+        self.fields["position"].queryset = Position.objects.filter(club=club, staff_position=False)
+
+    def clean(self):
+        cleaned = super().clean()
+        # team/season aren't form fields (the view sets them from the URL, not user
+        # input), so Django's automatic validate_unique() excludes both of them --
+        # and with them, the whole unique_jersey_number_per_team_per_season check.
+        # Without this, a clashing jersey number reaches the database unrejected
+        # and surfaces as a raw IntegrityError instead of a form error.
+        jersey_number = cleaned.get("jersey_number")
+        if jersey_number is not None and self.team is not None and self.season is not None:
+            clash = TeamMembership.objects.filter(team=self.team, season=self.season, jersey_number=jersey_number).exclude(pk=self.instance.pk).exists()
+            if clash:
+                self.add_error("jersey_number", _("Another player on this team already has this jersey number this season."))
+        return cleaned
+
+
+class StaffAssignmentForm(forms.ModelForm):
+    """Assign/edit one staff assignment -- team and season come from the view,
+    same reasoning as TeamMembershipForm."""
+
+    class Meta:
+        model = StaffAssignment
+        fields = ["member", "position"]
+        widgets = {"member": forms.Select(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a name to search...")})}
+
+    def __init__(self, *args, club=None, team=None, season=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        # See TeamMembershipForm for why current-or-next-season: eligible to be
+        # assigned regardless of which season's staff list is being edited.
+        today = timezone.localdate()
+        eligible_seasons = [s for s in (Season.covering(club, today), Season.next_after(club, today)) if s is not None]
+        members = Member.objects.filter(member_of__club=club, member_of__season__in=eligible_seasons, member_of__status=ClubMembership.StatusChoices.ACTIVE).distinct()
+        if team is not None and season is not None:
+            taken = StaffAssignment.objects.filter(team=team, season=season).exclude(pk=self.instance.pk).values_list("member_id", flat=True)
+            members = members.exclude(pk__in=taken)
+        self.fields["member"].queryset = members
+        self.fields["position"].queryset = Position.objects.filter(club=club, staff_position=True)
+
+
+class PositionForm(forms.ModelForm):
+    class Meta:
+        model = Position
+        fields = ["name", "short_name", "ordering", "staff_position", "management_position"]
+
+    def clean(self):
+        cleaned = super().clean()
+        # Mirrors Position's management_position_implies_staff_position check
+        # constraint -- caught here so it reads as a form error, not a 500.
+        if cleaned.get("management_position") and not cleaned.get("staff_position"):
+            self.add_error("management_position", _("A management position must also be a staff position."))
+        return cleaned
+
+
+class LocationForm(forms.ModelForm):
+    class Meta:
+        model = Location
+        fields = ["name", "address", "city", "zip_code", "country"]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # CountryField's own widget (a lazily-translated Select) must stay the widget
+        # class -- only the searchable-select JS hooks are added on top of it, the
+        # same progressive enhancement TeamMembershipForm uses for its member field.
+        self.fields["country"].widget.attrs.update({"data-searchable": "true", "data-search-placeholder": _("Type a country to search...")})
+
+
+class OpponentForm(forms.ModelForm):
+    class Meta:
+        model = Opponent
+        fields = ["name", "logo"]
+
+
+class SponsorForm(forms.ModelForm):
+    class Meta:
+        model = Sponsor
+        fields = ["name", "logo", "url", "start_date", "end_date"]
+        widgets = {
+            "start_date": forms.DateInput(attrs={"type": "date"}),
+            "end_date": forms.DateInput(attrs={"type": "date"}),
+        }
+
+    def clean(self):
+        cleaned = super().clean()
+        # Mirrors Sponsor.clean() -- caught here too so it reads as a form
+        # error tied to the end_date field, not a raw ValidationError.
+        start_date, end_date = cleaned.get("start_date"), cleaned.get("end_date")
+        if start_date and end_date and end_date < start_date:
+            self.add_error("end_date", _("End date can't be before the start date."))
+        return cleaned
+
+
+class EventAudienceFormMixin:
+    """Shared club/user-scoped audience fields for EventForm and EventSeriesForm:
+    teams restricted to the ones the requester manages (all of them for an
+    admin), and a non-admin must pick at least one -- a team-less/club-wide
+    event (e.g. an AGM) has no team-manager claim to anchor it to, so that's
+    admin-only."""
+
+    def scope_audience_fields(self, club, user):
+        self.club = club
+        self.user = user
+        self.fields["teams"].queryset = Team.objects.filter(club=club) if is_club_admin(user, club) else teams_managed_by(user, club)
+        self.fields["location"].queryset = Location.objects.filter(club=club)
+        self.fields["opponent"].queryset = Opponent.objects.filter(club=club)
+        members = Member.objects.filter(member_of__club=club).distinct()
+        self.fields["invited_members"].queryset = members
+        self.fields["excluded_members"].queryset = members
+
+    def clean_teams_requires_one_for_non_admins(self, cleaned):
+        teams = cleaned.get("teams")
+        if teams is not None and not teams.exists() and not is_club_admin(self.user, self.club):
+            self.add_error("teams", _("Select at least one of your teams, or ask an admin to create a club-wide event."))
+
+
+_AUDIENCE_WIDGETS = {
+    "teams": forms.SelectMultiple(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a team to search...")}),
+    "invited_members": forms.SelectMultiple(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a name to search...")}),
+    "excluded_members": forms.SelectMultiple(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a name to search...")}),
+}
+
+
+class EventForm(EventAudienceFormMixin, forms.ModelForm):
+    class Meta:
+        model = Event
+        fields = ["title", "kind", "teams", "invited_members", "excluded_members", "location", "opponent", "start", "end", "gathering", "deadline", "competition", "external_game_id", "score_for", "score_against", "is_live"]
+        widgets = {
+            "start": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            "end": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            "gathering": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            "deadline": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            "score_for": forms.NumberInput(attrs={"min": 0}),
+            "score_against": forms.NumberInput(attrs={"min": 0}),
+            **_AUDIENCE_WIDGETS,
+        }
+
+    def __init__(self, *args, club=None, user=None, editing=False, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.scope_audience_fields(club, user)
+        # Unlike the Django-admin form (events.admin.EventAdminForm), this dropdown
+        # isn't filtered by which competitions have their feature flag on for the
+        # club -- a manager should be able to pick any competition when scheduling a
+        # game; it's fetch_game_info (events.services.competitions) that gates the
+        # actual per-club fetch once a competition is set.
+        self.fields["competition"] = forms.ChoiceField(
+            choices=[("", "---------"), *[(competition.name, competition.name) for competition in Competition.objects.all()]],
+            required=False,
+            label=self.fields["competition"].label,
+            help_text=self.fields["competition"].help_text,
+        )
+        if not editing:
+            # Score/live status don't exist yet for a game that's only just being
+            # scheduled -- offering them on the add form is just noise. Editing an
+            # existing game is the only time there's anything to record here.
+            del self.fields["score_for"]
+            del self.fields["score_against"]
+            del self.fields["is_live"]
+
+    def clean(self):
+        cleaned = super().clean()
+        self.clean_teams_requires_one_for_non_admins(cleaned)
+        return cleaned
+
+
+class RBIHFImportForm(forms.Form):
+    """Step 1 of importing a team's fixtures from RBIHF's own website -- see
+    events.services.rbihf_import. Only the URL and which of the club's own
+    teams it applies to; everything else is scraped."""
+
+    url = forms.CharField(
+        label=_("RBIHF team page URL"),
+        help_text=_("E.g. https://www.rbihf.be/league/team/4460"),
+        widget=forms.URLInput(attrs={"placeholder": "https://www.rbihf.be/league/team/4460"}),
+    )
+    team = forms.ModelChoiceField(queryset=Team.objects.none(), label=_("Team"), help_text=_("Which of your teams this fixture list is for."))
+
+    def __init__(self, *args, club=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["team"].queryset = Team.objects.filter(club=club)
+
+    def clean_url(self):
+        url = self.cleaned_data["url"].strip()
+        try:
+            extract_team_id(url)
+        except RBIHFImportError as error:
+            raise forms.ValidationError(str(error)) from error
+        return url
+
+
+class EventSeriesForm(EventAudienceFormMixin, forms.ModelForm):
+    """A friendly weekly/monthly recurrence picker on top of EventSeries' raw
+    RRULE (see management.recurrence_ui) -- covers the common case (every N
+    weeks/months) with an advanced raw-RRULE field as an escape hatch for
+    anything else."""
+
+    frequency = forms.ChoiceField(choices=FREQUENCY_CHOICES, initial="weekly", label=_("Repeats"))
+    interval = forms.IntegerField(min_value=1, initial=1, label=_("Every"), help_text=_("E.g. 2 for every other week/month."))
+    # A plain multi-select, not CheckboxSelectMultiple: its widget_type ("checkboxselectmultiple")
+    # isn't one form_field's ui.py recognises, which would silently render a broken
+    # plain text input instead -- see the "lazyselect" fix for the same class of bug.
+    weekdays = forms.MultipleChoiceField(choices=WEEKDAY_CHOICES, required=False, label=_("On"), widget=forms.SelectMultiple(attrs={"data-searchable": "true"}))
+    duration_hours = forms.IntegerField(min_value=0, required=False, label=_("Duration (hours)"))
+    duration_minutes = forms.IntegerField(min_value=0, max_value=59, required=False, label=_("Duration (minutes)"))
+    gathering_minutes_before = forms.IntegerField(min_value=0, required=False, label=_("Gather (minutes before)"))
+    deadline_minutes_before = forms.IntegerField(min_value=0, required=False, label=_("Registration deadline (minutes before)"))
+    advanced_rrule = forms.CharField(required=False, label=_("Advanced: raw recurrence rule"), help_text=_("Overrides the fields above if filled in. RFC 5545 RRULE, e.g. FREQ=WEEKLY;BYDAY=MO,WE."))
+
+    class Meta:
+        model = EventSeries
+        fields = ["title", "kind", "dtstart", "until", "teams", "invited_members", "excluded_members", "location", "opponent"]
+        widgets = {
+            "dtstart": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            "until": forms.DateTimeInput(attrs={"type": "datetime-local"}),
+            **_AUDIENCE_WIDGETS,
+        }
+
+    def __init__(self, *args, club=None, user=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.scope_audience_fields(club, user)
+
+        if self.instance.pk:
+            parsed = parse_rrule(self.instance.rrule)
+            if parsed is not None:
+                self.fields["frequency"].initial = parsed["frequency"]
+                self.fields["interval"].initial = parsed["interval"]
+                self.fields["weekdays"].initial = parsed["weekdays"]
+            else:
+                # Not one of our two shapes (hand-written/imported) -- show it
+                # verbatim in the advanced field rather than guessing at it.
+                self.fields["advanced_rrule"].initial = self.instance.rrule
+
+            if self.instance.duration is not None:
+                total_minutes = int(self.instance.duration.total_seconds() // 60)
+                self.fields["duration_hours"].initial = total_minutes // 60
+                self.fields["duration_minutes"].initial = total_minutes % 60
+            if self.instance.gathering_offset is not None:
+                self.fields["gathering_minutes_before"].initial = int(self.instance.gathering_offset.total_seconds() // 60)
+            if self.instance.deadline_offset is not None:
+                self.fields["deadline_minutes_before"].initial = int(self.instance.deadline_offset.total_seconds() // 60)
+
+    def clean(self):
+        cleaned = super().clean()
+        self.clean_teams_requires_one_for_non_admins(cleaned)
+
+        if cleaned.get("advanced_rrule"):
+            return cleaned  # the advanced field wins outright; nothing else to check
+
+        if cleaned.get("frequency") == "weekly" and not cleaned.get("weekdays"):
+            self.add_error("weekdays", _("Pick at least one day of the week."))
+        return cleaned
+
+    def save(self, commit=True):
+        instance = super().save(commit=False)
+        cleaned = self.cleaned_data
+
+        advanced = (cleaned.get("advanced_rrule") or "").strip()
+        instance.rrule = advanced or build_rrule(cleaned["frequency"], cleaned["interval"], cleaned.get("weekdays"))
+
+        hours, minutes = cleaned.get("duration_hours") or 0, cleaned.get("duration_minutes") or 0
+        instance.duration = datetime.timedelta(hours=hours, minutes=minutes) if (hours or minutes) else None
+
+        gathering_minutes = cleaned.get("gathering_minutes_before")
+        instance.gathering_offset = datetime.timedelta(minutes=gathering_minutes) if gathering_minutes else None
+
+        deadline_minutes = cleaned.get("deadline_minutes_before")
+        instance.deadline_offset = datetime.timedelta(minutes=deadline_minutes) if deadline_minutes else None
+
+        if commit:
+            instance.save()
+            self.save_m2m()
+        return instance
+
+
+class ClubRoleAssignForm(forms.ModelForm):
+    """Grant a club-wide role to a member already affiliated with this club."""
+
+    class Meta:
+        model = ClubRole
+        fields = ["member", "role"]
+        widgets = {"member": forms.Select(attrs={"data-searchable": "true", "data-search-placeholder": _("Type a name to search...")})}
+
+    def __init__(self, *args, club=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Never list members of other clubs -- this isn't a platform-wide picker.
+        self.fields["member"].queryset = Member.objects.filter(member_of__club=club).distinct()
+
+
+class FamilyCreateForm(forms.Form):
+    """One new family in one go: a parent (who gets a login) and a child (who
+    doesn't). See members.services.family.register_family."""
+
+    parent_first_name = forms.CharField(label=_("Parent first name"))
+    parent_last_name = forms.CharField(label=_("Parent last name"))
+    parent_email = forms.EmailField(label=_("Parent email"), help_text=_("If this email has no account yet, one is created and they set a password via the reset link."))
+
+    child_first_name = forms.CharField(label=_("Child first name"))
+    child_last_name = forms.CharField(label=_("Child last name"))
+    child_date_of_birth = forms.DateField(label=_("Child date of birth"), required=False, widget=forms.DateInput(attrs={"type": "date"}))
+
+
+class AddChildForm(forms.Form):
+    """A family that needs one more child registered -- see
+    members.services.family.add_child_to_family."""
+
+    first_name = forms.CharField(label=_("First name"))
+    last_name = forms.CharField(label=_("Last name"))
+    date_of_birth = forms.DateField(label=_("Date of birth"), required=False, widget=forms.DateInput(attrs={"type": "date"}))
+
+
+class AddParentForm(forms.Form):
+    """A family that needs one more parent/guardian registered -- see
+    members.services.family.add_parent_to_family."""
+
+    email = forms.EmailField(label=_("Email address"), help_text=_("If this email has no account yet, one is created and they set a password via the reset link."))
+    first_name = forms.CharField(label=_("First name"), required=False)
+    last_name = forms.CharField(label=_("Last name"), required=False)
+
+    def clean(self):
+        cleaned = super().clean()
+        email = cleaned.get("email")
+
+        # Only a brand-new person needs a name; an existing member already has one.
+        if email and find_member_by_email(email) is None:
+            for field in ("first_name", "last_name"):
+                if not cleaned.get(field):
+                    self.add_error(field, _("Required: this email has no account yet."))
+
+        return cleaned
+
+
+class AttachToFamilyForm(forms.Form):
+    """Link a standalone member into a family -- a new one, or an existing one they
+    turn out to belong to. See members.services.family.attach_to_family."""
+
+    role = forms.ChoiceField(label=_("Role"), choices=FamilyMembership.FamilyRole.choices)
+    family = forms.ModelChoiceField(label=_("Family"), queryset=Family.objects.none(), required=False, empty_label=_("— start a new family —"))
+
+    def __init__(self, *args, club=None, member=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Same scoping query as management.views.families_of_club -- inlined rather
+        # than imported, since that function lives in views.py, which imports this
+        # module (a module-level import back here would be circular).
+        queryset = Family.objects.filter(memberships__member__member_of__club=club).distinct()
+        if member is not None:
+            # Already a member of it -- offering it again would be a no-op re-add.
+            queryset = queryset.exclude(memberships__member=member)
+        self.fields["family"].queryset = queryset
+
+
+class MemberImportUploadForm(forms.Form):
+    """The mass-upload entry point -- one .xlsx file, built from the downloadable
+    template. See management.bulk_import.read_member_import_workbook."""
+
+    file = forms.FileField(label=_("Excel file"), help_text=_("Use the downloaded template — one row per member."))
+
+
+class GrantLoginForm(forms.Form):
+    """A login-less family member (a child, typically) getting their own account --
+    see members.services.family.grant_login. Pre-filled from the member's contact
+    email where one is already on file; still editable, and required either way."""
+
+    email = forms.EmailField(label=_("Email"), help_text=_("They'll set a password via the reset link the first time they sign in."))
+
+    def clean_email(self):
+        email = self.cleaned_data["email"]
+        if User.objects.filter(email__iexact=email).exists():
+            raise forms.ValidationError(_("This email is already in use."))
+        return email
+
+
+class ClubMembershipForm(forms.ModelForm):
+    """This season's standing -- shown and edited right on the member's own page,
+    since a Member has no club of its own without one. fee_amount is the only
+    money field here -- amount_paid is exclusively written by club.services.fees,
+    never hand-edited."""
+
+    class Meta:
+        model = ClubMembership
+        fields = ["license", "status", "fee_status", "fee_amount"]
+
+
+class NewsForm(forms.ModelForm):
+    """Title/teams/visibility/body only -- status and published_at are never
+    directly editable, only through the publish/unpublish actions."""
+
+    class Meta:
+        model = News
+        fields = ["title", "teams", "visibility", "body"]
+        widgets = {
+            "teams": forms.SelectMultiple(attrs={"data-searchable": "true", "data-search-placeholder": _("Type to filter teams...")}),
+            "body": forms.Textarea(attrs={"rows": 8}),
+        }
+
+    def __init__(self, *args, club=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["teams"].queryset = Team.objects.filter(club=club)
+
+
+class MultipleFileInput(forms.ClearableFileInput):
+    allow_multiple_selected = True
+
+
+class MultipleFileField(forms.FileField):
+    """Django's own documented recipe for a multi-file upload field: the plain
+    FileField only ever picks up one of several selected files, so clean() has
+    to iterate the list itself instead."""
+
+    def __init__(self, *args, **kwargs):
+        kwargs.setdefault("widget", MultipleFileInput(attrs={"multiple": True}))
+        super().__init__(*args, **kwargs)
+
+    def clean(self, data, initial=None):
+        single_file_clean = super().clean
+        if isinstance(data, (list, tuple)):
+            return [single_file_clean(item, initial) for item in data]
+        return [single_file_clean(data, initial)] if data else []
+
+
+class NewsPhotoUploadForm(forms.Form):
+    images = MultipleFileField(label=_("Photos"))
+
+
+class NewsPublishForm(forms.Form):
+    published_at = forms.DateTimeField(
+        label=_("Publish date"),
+        initial=timezone.now,
+        widget=forms.DateTimeInput(attrs={"type": "datetime-local"}),
+        help_text=_("Leave as now to publish immediately, or pick a future date/time to schedule it."),
+    )
+
+
+class RecordFeePaymentForm(forms.Form):
+    """Money received against one membership's fee -- see club.services.fees.record_payment.
+    Reusable for any amount, partial or the exact remaining balance; "Mark fully
+    paid" (management.views.MembershipMarkFullyPaidView) skips this form entirely
+    and settles the balance directly in one click."""
+
+    amount = forms.DecimalField(label=_("Amount"), max_digits=10, decimal_places=2, min_value=Decimal("0.01"))
+    method = forms.ChoiceField(label=_("Method"), choices=FeePayment.Method.choices)
+    reference = forms.CharField(label=_("Reference"), required=False, help_text=_("Bank reference, transaction id — whatever lets you find this again."))
+    note = forms.CharField(label=_("Note"), required=False, widget=forms.Textarea(attrs={"rows": 2}))
diff --git a/management/pdf.py b/management/pdf.py
new file mode 100644
index 0000000..32624c4
--- /dev/null
+++ b/management/pdf.py
@@ -0,0 +1,30 @@
+"""HTML-to-PDF rendering for exports (currently just the memberships list).
+
+Same lazy-import shape as billing.services.invoices.render_pdf -- WeasyPrint binds
+to native pango/cairo libraries, and a machine without them must still be able to
+run the app, the tests and every other page, so the import happens here, not at
+module scope, and only fails when someone actually asks for a PDF. Kept separate
+from billing's version rather than shared: the two exports have nothing else in
+common, and sharing would make one app depend on the other's error type for no
+real benefit.
+"""
+
+from django.template.loader import render_to_string
+
+
+class PDFExportError(Exception):
+    """Raised when WeasyPrint's native libraries aren't available."""
+
+
+def render_pdf(html: str) -> bytes:
+    try:
+        from weasyprint import HTML
+    except (ImportError, OSError) as error:
+        raise PDFExportError("PDF rendering needs the native pango/cairo libraries (on macOS: brew install pango).") from error
+
+    return HTML(string=html).write_pdf()
+
+
+def membership_list_pdf(context: dict) -> bytes:
+    html = render_to_string("management/membership_list_pdf.html", context)
+    return render_pdf(html)
diff --git a/management/recurrence_ui.py b/management/recurrence_ui.py
new file mode 100644
index 0000000..b73723a
--- /dev/null
+++ b/management/recurrence_ui.py
@@ -0,0 +1,84 @@
+"""A friendly weekly/monthly recurrence picker on top of EventSeries.rrule (a raw
+RFC 5545 string, e.g. "FREQ=WEEKLY;INTERVAL=1;BYDAY=MO,WE") -- covers the common
+club-scheduling case (every N weeks on these weekdays, or every N months on the
+same day of month) without building a full RRULE UI.
+
+dateutil's rrule recurs on dtstart's own day-of-month for FREQ=MONTHLY with no
+BYMONTHDAY needed, which is what keeps monthly this cheap to support alongside
+weekly.
+
+Anything that isn't exactly one of the two shapes build_rrule() produces --
+hand-written, imported, or from a future frequency this module doesn't cover --
+is left alone: parse_rrule() returns None, and EventSeriesForm falls back to
+showing the raw string in an "Advanced" field instead of the friendly picker.
+"""
+
+import re
+
+from django.utils.translation import gettext_lazy as _
+
+WEEKDAY_CODES = ["MO", "TU", "WE", "TH", "FR", "SA", "SU"]
+
+WEEKDAY_LABELS = {
+    "MO": _("Mon"),
+    "TU": _("Tue"),
+    "WE": _("Wed"),
+    "TH": _("Thu"),
+    "FR": _("Fri"),
+    "SA": _("Sat"),
+    "SU": _("Sun"),
+}
+
+WEEKDAY_CHOICES = [(code, WEEKDAY_LABELS[code]) for code in WEEKDAY_CODES]
+
+FREQUENCY_CHOICES = [
+    ("weekly", _("Weekly")),
+    ("monthly", _("Monthly")),
+]
+
+_WEEKLY_RE = re.compile(r"^FREQ=WEEKLY;INTERVAL=(\d+);BYDAY=([A-Z,]+)$")
+_MONTHLY_RE = re.compile(r"^FREQ=MONTHLY;INTERVAL=(\d+)$")
+
+
+def build_rrule(frequency, interval, weekdays=None):
+    """Compose an RRULE string from the friendly fields. ``weekdays`` is a list
+    of two-letter codes (e.g. ["MO", "WE"]), required for "weekly", ignored for
+    "monthly"."""
+    interval = interval or 1
+    if frequency == "weekly":
+        # Preserve WEEKDAY_CODES order regardless of the order the caller passed
+        # them in, so the same pattern always serializes to the same string.
+        ordered = [code for code in WEEKDAY_CODES if code in (weekdays or [])]
+        return f"FREQ=WEEKLY;INTERVAL={interval};BYDAY={','.join(ordered)}"
+    if frequency == "monthly":
+        return f"FREQ=MONTHLY;INTERVAL={interval}"
+    raise ValueError(f"Unknown frequency: {frequency!r}")
+
+
+def parse_rrule(rrule):
+    """The friendly fields that produced ``rrule``, or None if it doesn't match
+    one of build_rrule()'s two shapes."""
+    if match := _WEEKLY_RE.match(rrule):
+        interval, days = match.groups()
+        return {"frequency": "weekly", "interval": int(interval), "weekdays": days.split(",")}
+    if match := _MONTHLY_RE.match(rrule):
+        return {"frequency": "monthly", "interval": int(match.group(1)), "weekdays": []}
+    return None
+
+
+def describe_rrule(rrule):
+    """A human-readable summary for list/detail pages, e.g. "Every week on Mon,
+    Wed" or "Every 2 months" -- or the raw string verbatim if it isn't one of
+    ours (an imported/hand-written RRULE)."""
+    parsed = parse_rrule(rrule)
+    if parsed is None:
+        return rrule
+
+    interval = parsed["interval"]
+    if parsed["frequency"] == "weekly":
+        days = ", ".join(str(WEEKDAY_LABELS[code]) for code in parsed["weekdays"] if code in WEEKDAY_LABELS)
+        if not days:
+            return _("Every week") if interval == 1 else _("Every %(n)d weeks") % {"n": interval}
+        return _("Every week on %(days)s") % {"days": days} if interval == 1 else _("Every %(n)d weeks on %(days)s") % {"n": interval, "days": days}
+
+    return _("Every month") if interval == 1 else _("Every %(n)d months") % {"n": interval}
diff --git a/management/templates/management/_family_members_table.html b/management/templates/management/_family_members_table.html
new file mode 100644
index 0000000..efc7f7e
--- /dev/null
+++ b/management/templates/management/_family_members_table.html
@@ -0,0 +1,92 @@
+{% load lucide ui i18n %}
+
+{% comment %}
+Shared by family_detail.html and member_detail.html's own Family panel -- one
+table design for "everyone in this family", included with `group` (a dict from
+management.views.group_by_family: family/guardians/children/others/all) and
+`family_role_choices` (FamilyMembership.FamilyRole.choices, for the role dropdown).
+`next_url`, if passed, is where a role change redirects back to -- member_detail.html
+passes its own URL so admins land back on the member they were viewing; family_detail.html
+leaves it unset, since staying on the family page is already the right place there.
+{% endcomment %}
+<div class="overflow-x-auto">
+    <table class="table">
+        <thead>
+            <tr>
+                <th>{% trans "Last name" %}</th>
+                <th>{% trans "First name" %}</th>
+                <th>{% trans "Email" %}</th>
+                <th>{% trans "Type" %}</th>
+                <th></th>
+            </tr>
+        </thead>
+        <tbody>
+            {% for person in group.all %}
+            <tr>
+                <td><a class="link link-hover" href="{% url 'management:member_detail' person.pk %}">{{ person.last_name }}</a></td>
+                <td>{{ person.first_name }}</td>
+                <td>{{ person.contact_email|default:"-" }}</td>
+                <td>
+                    {% if is_club_admin %}
+                    <form method="post" action="{% url 'management:family_membership_role_update' group.family.pk person.pk %}">
+                        {% csrf_token %}
+                        {% if next_url %}<input type="hidden" name="next" value="{{ next_url }}">{% endif %}
+                        <select name="role" class="select select-bordered select-sm" onchange="this.form.requestSubmit()" aria-label="{% trans 'Role in family' %}">
+                            {% for value, label in family_role_choices %}
+                            <option value="{{ value }}" {% if value == person.role_in_family %}selected{% endif %}>{{ label|capfirst }}</option>
+                            {% endfor %}
+                        </select>
+                    </form>
+                    {% else %}
+                    <span class="badge badge-sm badge-ghost">{{ person.role_in_family_display|capfirst }}</span>
+                    {% endif %}
+                </td>
+                <td class="text-right">
+                    {% if is_club_admin %}
+                    <div class="flex justify-end gap-1">
+                        {% if person.grant_login_form %}
+                        <button class="btn btn-outline btn-sm" type="button" onclick="document.getElementById('grant_login_modal_{{ group.family.pk }}_{{ person.pk }}').showModal()" aria-label="{% trans 'Grant login' %}">
+                            {% lucide "key-round" size=14 %} {% trans "Grant login" %}
+                        </button>
+                        {% endif %}
+                        <a class="btn btn-outline btn-sm" href="{% url 'management:member_detail' person.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                        <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('remove_family_modal_{{ group.family.pk }}_{{ person.pk }}').showModal()" aria-label="{% trans 'Remove from family' %}">
+                            {% lucide "user-x" size=14 %} {% trans "Remove" %}
+                        </button>
+                        <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('member_delete_modal_{{ group.family.pk }}_{{ person.pk }}').showModal()" aria-label="{% trans 'Delete' %}">
+                            {% lucide "trash-2" size=14 %} {% trans "Delete" %}
+                        </button>
+                    </div>
+                    {% endif %}
+                </td>
+            </tr>
+            {% endfor %}
+        </tbody>
+    </table>
+</div>
+
+{% if is_club_admin %}
+{% trans "Delete member" as delete_member_title %}
+{% trans "Delete" as delete_label %}
+{% trans "Remove from family" as remove_from_family_title %}
+{% trans "Remove" as remove_label %}
+{% trans "Grant login" as grant_login_title %}
+{% trans "Grant" as grant_login_submit_label %}
+{% trans "They'll be able to sign in with this email once you confirm." as grant_login_blurb %}
+{% with family_pk_str=group.family.pk|stringformat:"s" %}
+{% for person in group.all %}
+{% with person_pk_str=person.pk|stringformat:"s" %}
+{% url 'management:member_delete' person.pk as member_delete_url %}
+{% url 'management:member_detach_family' person.pk group.family.pk as detach_family_url %}
+{% url 'management:member_grant_login' person.pk as grant_login_url %}
+{% blocktrans with full_name=person.get_full_name asvar delete_member_body %}Delete {{ full_name }}? This also removes their club membership, roster spots, staff assignments, and family links. This cannot be undone.{% endblocktrans %}
+{% blocktrans with full_name=person.get_full_name family_name=group.family asvar detach_family_body %}Remove {{ full_name }} from family {{ family_name }}? They become a standalone member - nothing else about them changes.{% endblocktrans %}
+{% include "controlpanel/_confirm_modal.html" with modal_id="member_delete_modal_"|add:family_pk_str|add:"_"|add:person_pk_str title=delete_member_title body=delete_member_body action_url=member_delete_url submit_label=delete_label %}
+{% include "controlpanel/_confirm_modal.html" with modal_id="remove_family_modal_"|add:family_pk_str|add:"_"|add:person_pk_str title=remove_from_family_title body=detach_family_body action_url=detach_family_url submit_label=remove_label submit_icon="user-x" %}
+{% if person.grant_login_form %}
+{% include "controlpanel/_modal_form.html" with modal_id="grant_login_modal_"|add:family_pk_str|add:"_"|add:person_pk_str title=grant_login_title form=person.grant_login_form action_url=grant_login_url submit_label=grant_login_submit_label submit_icon="key-round" blurb=grant_login_blurb %}
+{% endif %}
+{% endwith %}
+{% endfor %}
+{% endwith %}
+{% endif %}
diff --git a/management/templates/management/_generic_list.html b/management/templates/management/_generic_list.html
new file mode 100644
index 0000000..044a665
--- /dev/null
+++ b/management/templates/management/_generic_list.html
@@ -0,0 +1,33 @@
+{% extends "management/base.html" %}
+{% load i18n %}
+
+{% comment %}
+    Shared placeholder for every entity that doesn't have its own list template yet
+    (see management.views.StubListMixin) -- a plain one-column table of __str__, just
+    enough to prove the query scoping and permission gate work. Not meant to stay this
+    bare once each section gets its own page.
+{% endcomment %}
+
+{% block heading %}{{ page_title }}{% endblock heading %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <tbody>
+                        {% for object in object_list %}
+                            <tr>
+                                <td>{{ object }}</td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td class="text-center opacity-60">{% trans "Nothing here yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/_nav_items.html b/management/templates/management/_nav_items.html
new file mode 100644
index 0000000..c720998
--- /dev/null
+++ b/management/templates/management/_nav_items.html
@@ -0,0 +1,54 @@
+{% load i18n lucide %}
+
+{% comment %}
+    The management nav, in one place: the sidebar renders it on a wide screen and the
+    collapsed menu renders it on a narrow one. Admin-only sections are hidden here for
+    plain staff -- the views are gated regardless (ClubAdminRequiredMixin), this is
+    just so the nav never shows a link they can't follow.
+
+    `nav` (management.context_processors.active_nav_section) is the current page's
+    section, derived from the resolved URL name -- `menu-active` is daisyUI's active
+    state, same convention as controlpanel/templates/controlpanel/_nav_items.html.
+{% endcomment %}
+<li>
+    <a class="{% if nav == 'home' %}menu-active{% endif %}" href="{% url 'management:home' %}">{% lucide "layout-dashboard" size=16 %} {% trans "Dashboard" %}</a>
+</li>
+
+<li class="menu-title">{% trans "People" %}</li>
+<li><a class="{% if nav == 'member_list' %}menu-active{% endif %}" href="{% url 'management:member_list' %}">{% lucide "users" size=16 %} {% trans "Members" %}</a></li>
+{% if is_club_admin %}
+    <li><a class="{% if nav == 'membership_list' %}menu-active{% endif %}" href="{% url 'management:membership_list' %}">{% lucide "wallet" size=16 %} {% trans "Memberships" %}</a></li>
+    <li><a class="{% if nav == 'role_list' %}menu-active{% endif %}" href="{% url 'management:role_list' %}">{% lucide "shield-check" size=16 %} {% trans "Roles" %}</a></li>
+{% endif %}
+
+<li class="menu-title">{% trans "Teams" %}</li>
+<li><a class="{% if nav == 'team_list' %}menu-active{% endif %}" href="{% url 'management:team_list' %}">{% lucide "shirt" size=16 %} {% trans "Teams" %}</a></li>
+<li><a class="{% if nav == 'position_list' %}menu-active{% endif %}" href="{% url 'management:position_list' %}">{% lucide "tags" size=16 %} {% trans "Positions" %}</a></li>
+
+<li class="menu-title">{% trans "News" %}</li>
+<li><a class="{% if nav == 'news_list' %}menu-active{% endif %}" href="{% url 'management:news_list' %}">{% lucide "newspaper" size=16 %} {% trans "News" %}</a></li>
+
+<li class="menu-title">{% trans "Calendar" %}</li>
+<li><a class="{% if nav == 'event_list' %}menu-active{% endif %}" href="{% url 'management:event_list' %}">{% lucide "calendar" size=16 %} {% trans "Events" %}</a></li>
+{% if has_management_position %}
+    <li><a class="{% if nav == 'location_list' %}menu-active{% endif %}" href="{% url 'management:location_list' %}">{% lucide "map-pin" size=16 %} {% trans "Locations" %}</a></li>
+    <li><a class="{% if nav == 'opponent_list' %}menu-active{% endif %}" href="{% url 'management:opponent_list' %}">{% lucide "swords" size=16 %} {% trans "Opponents" %}</a></li>
+{% endif %}
+
+{% if is_club_admin %}
+    <li class="menu-title">{% trans "Sponsors" %}</li>
+    <li><a class="{% if nav == 'sponsor_list' %}menu-active{% endif %}" href="{% url 'management:sponsor_list' %}">{% lucide "handshake" size=16 %} {% trans "Sponsors" %}</a></li>
+{% endif %}
+
+{% if is_club_admin and shop_enabled %}
+    <li class="menu-title">{% trans "Shop" %}</li>
+    <li><a class="{% if nav == 'product_list' %}menu-active{% endif %}" href="{% url 'management:product_list' %}">{% lucide "package" size=16 %} {% trans "Products" %}</a></li>
+    <li><a class="{% if nav == 'order_list' %}menu-active{% endif %}" href="{% url 'management:order_list' %}">{% lucide "shopping-cart" size=16 %} {% trans "Orders" %}</a></li>
+    <li><a class="{% if nav == 'discount_list' %}menu-active{% endif %}" href="{% url 'management:discount_list' %}">{% lucide "percent" size=16 %} {% trans "Discounts" %}</a></li>
+    <li><a class="{% if nav == 'invoice_list' %}menu-active{% endif %}" href="{% url 'management:invoice_list' %}">{% lucide "receipt" size=16 %} {% trans "Invoices" %}</a></li>
+{% endif %}
+
+{% if is_club_admin and forms_enabled %}
+    <li class="menu-title">{% trans "Forms" %}</li>
+    <li><a class="{% if nav == 'form_list' %}menu-active{% endif %}" href="{% url 'management:form_list' %}">{% lucide "clipboard-list" size=16 %} {% trans "Forms" %}</a></li>
+{% endif %}
diff --git a/management/templates/management/base.html b/management/templates/management/base.html
new file mode 100644
index 0000000..9560dd1
--- /dev/null
+++ b/management/templates/management/base.html
@@ -0,0 +1,42 @@
+{% extends "_club_base.html" %}
+{% load i18n lucide %}
+
+{% comment %}
+    The club-staff shell: team managers, coaches and admins only (never parents or
+    players -- see club.mixins.ClubStaffRequiredMixin). Mirrors controlpanel/base.html's
+    block structure, extending the club's own skin instead of the platform's.
+{% endcomment %}
+
+{% block head_title %}
+    {% block section_title %}{% trans "Management" %}{% endblock section_title %}
+{% endblock head_title %}
+
+{% block menu %}
+    <aside class="hidden w-64 shrink-0 overflow-y-auto border-r border-base-300 bg-base-100 lg:block">
+        <ul class="menu w-full gap-1 p-3 mt-4">
+            {% include "management/_nav_items.html" %}
+        </ul>
+    </aside>
+{% endblock menu %}
+
+{% block main %}
+    <div class="mb-6 flex flex-wrap flex-row items-center justify-between gap-3">
+        <div class="flex flex-col gap-2 grow">
+            <h1 class="text-3xl font-bold">
+                {% block heading %}{% trans "Management" %}{% endblock heading %}
+            </h1>
+            <span class="text-sm text-base-content/50">{% block subheading %}{% endblock subheading %}</span>
+        </div>
+
+        <div class="flex gap-2">
+            {% block actions %}{% endblock actions %}
+        </div>
+    </div>
+
+    {# Below `lg` the sidebar is hidden, so the same links appear here rather than nowhere. #}
+    <ul class="menu menu-horizontal mb-6 w-full gap-1 overflow-x-auto rounded-box bg-base-100 lg:hidden">
+        {% include "management/_nav_items.html" %}
+    </ul>
+
+    {% block panel %}{% endblock panel %}
+{% endblock main %}
diff --git a/management/templates/management/event_detail.html b/management/templates/management/event_detail.html
new file mode 100644
index 0000000..d1fa466
--- /dev/null
+++ b/management/templates/management/event_detail.html
@@ -0,0 +1,215 @@
+{% extends "management/base.html" %}
+{% load i18n lucide %}
+
+{% block heading %}{{ event.title }}{% endblock heading %}
+{% block subheading %}{{ event.get_kind_display }}{% endblock subheading %}
+
+{% block actions %}
+    {% if can_manage %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:event_update' event.pk %}">{% lucide "pencil" size=16 %} {% trans "Edit" %}</a>
+        {% if event.series_id and not event.detached %}
+            <form method="post" action="{% url 'management:event_detach' event.pk %}">
+                {% csrf_token %}
+                <button class="btn btn-outline gap-2" type="submit">{% lucide "unlink" size=16 %} {% trans "Detach from series" %}</button>
+            </form>
+        {% endif %}
+        <button class="btn btn-outline btn-error gap-2" type="button" onclick="document.getElementById('event_delete_modal').showModal()">
+            {% lucide "trash-2" size=16 %}
+            {% if event.series_id %}{% trans "Cancel occurrence" %}{% else %}{% trans "Delete" %}{% endif %}
+        </button>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    {% if event.series_id %}
+        <div class="alert alert-info mb-6">
+            {% lucide "repeat" size=20 %}
+            <span>
+                {% blocktrans with series=event.series %}Part of the recurring series “{{ series }}”.{% endblocktrans %}
+                <a class="link" href="{% url 'management:event_series_detail' event.series_id %}">{% trans "View series" %}</a>
+                {% if event.detached %}<span class="badge badge-sm badge-neutral ml-2">{% trans "Detached" %}</span>{% endif %}
+            </span>
+        </div>
+    {% endif %}
+
+    <div class="mb-6 grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "info" size=18 %} {% trans "Details" %}</h2>
+                <dl class="divide-y divide-base-200">
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Start" %}</dt>
+                        <dd>{{ event.start|date:"j M Y H:i" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "End" %}</dt>
+                        <dd>{{ event.end|date:"j M Y H:i"|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Gathering" %}</dt>
+                        <dd>{{ event.gathering|date:"j M Y H:i"|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Registration deadline" %}</dt>
+                        <dd>{{ event.deadline|date:"j M Y H:i"|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Location" %}</dt>
+                        <dd>{{ event.location|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Opponent" %}</dt>
+                        <dd>{{ event.opponent|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Teams" %}</dt>
+                        <dd>{% for team in event.teams.all %}{{ team.name }}{% if not forloop.last %}, {% endif %}{% empty %}—{% endfor %}</dd>
+                    </div>
+                </dl>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% lucide "user-check" size=18 %} {% trans "RSVPs" %}</h2>
+                    {% if has_attendance_rows %}
+                        <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('rsvp_modal').showModal()">
+                            {% lucide "list" size=14 %} {% trans "View responses" %}
+                        </button>
+                    {% endif %}
+                </div>
+                <dl class="divide-y divide-base-200">
+                    {% for group in attendance_groups %}
+                        <div class="flex items-center justify-between py-2">
+                            <dt class="text-sm opacity-70">{{ group.label }}</dt>
+                            <dd class="font-semibold tabular-nums font-mono">{{ group.rows|length }}</dd>
+                        </div>
+                    {% endfor %}
+                </dl>
+                {% if not has_attendance_rows %}
+                    <p class="text-sm opacity-60">{% trans "No one invited yet." %}</p>
+                {% endif %}
+            </div>
+        </div>
+    </div>
+
+    {% if event.kind == "game" %}
+        <div class="mb-6 card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">
+                        {% lucide "trophy" size=18 %} {% trans "Game" %}
+                        {% if event.is_live %}<span class="badge badge-error gap-1 animate-pulse">{% lucide "circle" size=10 %} {% trans "Live" %}</span>{% endif %}
+                    </h2>
+                    {% if can_manage and event.competition %}
+                        <form method="post" action="{% url 'management:event_fetch_game_info' event.pk %}">
+                            {% csrf_token %}
+                            <button class="btn btn-outline btn-sm gap-2" type="submit">{% lucide "refresh-cw" size=14 %} {% trans "Fetch new game info" %}</button>
+                        </form>
+                    {% endif %}
+                </div>
+                <div class="grid grid-cols-1 gap-4 sm:grid-cols-3">
+                    <div>
+                        <div class="text-sm opacity-70">{% trans "Score" %}</div>
+                        <div class="text-sm font-semibold tabular-nums font-mono">
+                            {% if event.score_for is not None and event.score_against is not None %}{{ event.score_for }} - {{ event.score_against }}{% else %}—{% endif %}
+                        </div>
+                    </div>
+                    <div>
+                        <div class="text-sm opacity-70">{% trans "Competition" %}</div>
+                        <div class="text-sm">{{ event.competition|default:"—" }}</div>
+                    </div>
+                    <div>
+                        <div class="text-sm opacity-70">{% trans "External game ID" %}</div>
+                        <div class="font-mono text-sm">{{ event.external_game_id|default:"—" }}</div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    {% endif %}
+{% endblock panel %}
+
+{% block extra_body %}
+    {% if can_manage %}
+        <dialog id="event_delete_modal" class="modal">
+            <div class="modal-box">
+                <h3 class="text-lg font-bold">
+                    {% if event.series_id %}{% trans "Cancel occurrence" %}{% else %}{% trans "Delete event" %}{% endif %}
+                </h3>
+                <form method="post" action="{% url 'management:event_delete' event.pk %}" id="event_delete_form">
+                    {% csrf_token %}
+                    {% if event.series_id %}
+                        <p class="py-2 text-sm opacity-70">{% trans "Removes this occurrence from the schedule. It won't be regenerated." %}</p>
+                        <label class="label cursor-pointer justify-start gap-2">
+                            <input type="checkbox" name="keep_record" class="checkbox">
+                            <span class="label-text">{% trans "Keep a record of it (marks it cancelled instead of deleting it)" %}</span>
+                        </label>
+                    {% else %}
+                        <p class="py-2 text-sm opacity-70">{% trans "This cannot be undone." %}</p>
+                    {% endif %}
+                </form>
+                <div class="modal-action">
+                    <form method="dialog">
+                        <button class="btn btn-outline gap-2">{% lucide "x" size=16 %} {% trans "Cancel" %}</button>
+                    </form>
+                    <button class="btn btn-error gap-2" type="submit" form="event_delete_form">{% lucide "trash-2" size=16 %} {% trans "Confirm" %}</button>
+                </div>
+            </div>
+            <form method="dialog" class="modal-backdrop">
+                <button>close</button>
+            </form>
+        </dialog>
+    {% endif %}
+
+    {% if has_attendance_rows %}
+        <dialog id="rsvp_modal" class="modal">
+            <div class="modal-box max-w-2xl">
+                <h3 class="text-lg font-bold">{% trans "Who responded" %}</h3>
+                <div class="mt-2 space-y-2">
+                    {% for group in attendance_groups %}
+                        {% if group.rows %}
+                            <details class="collapse collapse-arrow border border-base-300 bg-base-100">
+                                <summary class="collapse-title text-sm font-medium">
+                                    <span class="badge badge-sm
+                                        {% if group.value == "present" %}badge-success
+                                        {% elif group.value == "absent" %}badge-error
+                                        {% elif group.value == "excused" %}badge-warning
+                                        {% elif group.value == "selected" %}badge-info
+                                        {% elif group.value == "maybe" %}badge-warning badge-outline
+                                        {% elif group.value == "not_selected" %}badge-neutral
+                                        {% else %}badge-outline{% endif %}">
+                                        {{ group.label }}
+                                    </span>
+                                    <span class="opacity-60">({{ group.rows|length }})</span>
+                                </summary>
+                                <div class="collapse-content">
+                                    <div class="overflow-x-auto">
+                                        <table class="table table-sm">
+                                            <tbody>
+                                                {% for row in group.rows %}
+                                                    <tr>
+                                                        <td>{{ row.member }}</td>
+                                                        <td class="text-sm opacity-70">{{ row.note|default:"—" }}</td>
+                                                    </tr>
+                                                {% endfor %}
+                                            </tbody>
+                                        </table>
+                                    </div>
+                                </div>
+                            </details>
+                        {% endif %}
+                    {% endfor %}
+                </div>
+                <div class="modal-action">
+                    <form method="dialog">
+                        <button class="btn btn-outline gap-2">{% lucide "x" size=16 %} {% trans "Close" %}</button>
+                    </form>
+                </div>
+            </div>
+            <form method="dialog" class="modal-backdrop">
+                <button>close</button>
+            </form>
+        </dialog>
+    {% endif %}
+{% endblock extra_body %}
diff --git a/management/templates/management/event_form.html b/management/templates/management/event_form.html
new file mode 100644
index 0000000..063303a
--- /dev/null
+++ b/management/templates/management/event_form.html
@@ -0,0 +1,96 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New event" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.title %}
+                    {% form_field form.kind %}
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Audience" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    {% form_field form.teams %}
+                    {% form_field form.invited_members %}
+                    {% form_field form.excluded_members %}
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Where" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.location %}
+                    <div class="game-only">
+                        {% form_field form.opponent %}
+                    </div>
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "When" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-4 gap-4">
+                    {% form_field form.start %}
+                    {% form_field form.end %}
+                    {% form_field form.gathering %}
+                    {% form_field form.deadline %}
+                </div>
+
+                <div id="game-details-section" class="game-only">
+                    <div class="divider"></div>
+                    <h3 class="text-lg font-semibold mb-3">{% trans "Game" %}</h3>
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                        {% form_field form.competition %}
+                        {% form_field form.external_game_id %}
+                    </div>
+                    {% if update_view %}
+                        {% comment %}
+                            Score/live status only exist to record once a game has
+                            actually been created -- the add form leaves them out
+                            entirely (see EventForm's editing=False path).
+                        {% endcomment %}
+                        <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                            {% form_field form.score_for %}
+                            {% form_field form.score_against %}
+                            {% form_field form.is_live %}
+                        </div>
+                    {% endif %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "management:event_detail" object.pk %}{% else %}{% url "management:event_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+    <script>
+        (() => {
+            // Progressive enhancement only -- the fields stay in the form and post
+            // normally either way, this just hides them when they don't apply so a
+            // training/social/etc. event isn't cluttered with opponent/score/competition
+            // inputs. Anything gated on "only makes sense for a game" carries this class.
+            const kindField = document.getElementById("id_kind");
+            const gameOnlyElements = document.querySelectorAll(".game-only");
+            if (!kindField || !gameOnlyElements.length) return;
+
+            const sync = () => gameOnlyElements.forEach((element) => element.classList.toggle("hidden", kindField.value !== "game"));
+            kindField.addEventListener("change", sync);
+            sync();
+        })();
+    </script>
+{% endblock extra_body %}
diff --git a/management/templates/management/event_list.html b/management/templates/management/event_list.html
new file mode 100644
index 0000000..9a338f3
--- /dev/null
+++ b/management/templates/management/event_list.html
@@ -0,0 +1,118 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Events" %}{% endblock heading %}
+
+{% block actions %}
+    {% if is_club_admin and rbihf_enabled %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:rbihf_import' %}">{% lucide "download" size=16 %} {% trans "Import from RBIHF" %}</a>
+    {% endif %}
+    {% if can_create %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:event_series_create' %}">{% lucide "repeat" size=16 %} {% trans "New series" %}</a>
+        <a class="btn btn-outline gap-2" href="{% url 'management:event_create' %}">{% lucide "plus" size=16 %} {% trans "New event" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <form method="get" class="mb-4">
+        <div class="flex flex-row flex-wrap items-center gap-2">
+            <select name="season" class="select select-bordered">
+                {% for season in seasons %}
+                    <option value="{{ season.pk }}" {% if season.pk == selected_season.pk %}selected{% endif %}>{% trans "Season" %} {{ season.start_date|date:"Y" }} - {{ season.end_date|date:"Y" }}</option>
+                {% endfor %}
+            </select>
+            <select name="kind" class="select select-bordered">
+                <option value="">{% trans "All kinds" %}</option>
+                {% for value, label in event_kinds %}
+                    <option value="{{ value }}" {% if value == selected_kind %}selected{% endif %}>{{ label }}</option>
+                {% endfor %}
+            </select>
+            <label class="label cursor-pointer gap-2">
+                <input type="checkbox" name="show_past" value="1" class="checkbox" {% if show_past %}checked{% endif %} onchange="this.form.submit()">
+                <span class="label-text">{% trans "Show past events" %}</span>
+            </label>
+            <button class="btn btn-outline gap-2" type="submit">{% lucide "filter" size=16 %} {% trans "View" %}</button>
+        </div>
+    </form>
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Title" %}</th>
+                            <th>{% trans "Kind" %}</th>
+                            <th>{% trans "When" %}</th>
+                            <th>{% trans "Teams" %}</th>
+                            <th>{% trans "Location" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for event in events %}
+                            <tr>
+                                <td class="flex flex-row items-center gap-2">
+                                    <a class="link link-hover" href="{% url 'management:event_detail' event.pk %}">{{ event.title }}</a>
+                                    {% if event.series_id %}<span class="tooltip" data-tip="{% trans 'Part of a series' %}">{% lucide "repeat" size=12 %}</span>{% endif %}
+                                </td>
+                                <td>{{ event.get_kind_display }}</td>
+                                <td>{{ event.start|date:"j M Y H:i" }}</td>
+                                <td>{% for team in event.teams.all %}{{ team.short_name }}{% if not forloop.last %}, {% endif %}{% empty %}—{% endfor %}</td>
+                                <td>{{ event.location.name|default:"—" }}</td>
+                                <td class="text-right">
+                                    {% if event.can_manage %}
+                                        <div class="flex justify-end gap-1">
+                                            <a class="btn btn-outline btn-sm" href="{% url 'management:event_detail' event.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                            <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ event.pk|dom_id:"event_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                        </div>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="6" class="text-center opacity-60">{% trans "No events." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% comment %} Dialogs live outside the table: <tbody> may only contain <tr> elements. {% endcomment %}
+    {% for event in events %}
+        {% if event.can_manage %}
+            <dialog id="{{ event.pk|dom_id:"event_delete_modal" }}" class="modal">
+                <div class="modal-box">
+                    <h3 class="text-lg font-bold">
+                        {% if event.series_id %}{% trans "Cancel occurrence" %}{% else %}{% trans "Delete event" %}{% endif %}
+                    </h3>
+                    <form method="post" action="{% url 'management:event_delete' event.pk %}" id="{{ event.pk|dom_id:"event_delete_form" }}">
+                        {% csrf_token %}
+                        {% if event.series_id %}
+                            {% blocktrans with name=event.title asvar delete_body %}Removes “{{ name }}” from the schedule. It won't be regenerated.{% endblocktrans %}
+                            <p class="py-2 text-sm opacity-70">{{ delete_body }}</p>
+                            <label class="label cursor-pointer justify-start gap-2">
+                                <input type="checkbox" name="keep_record" class="checkbox">
+                                <span class="label-text">{% trans "Keep a record of it (marks it cancelled instead of deleting it)" %}</span>
+                            </label>
+                        {% else %}
+                            {% blocktrans with name=event.title asvar delete_body %}Delete “{{ name }}”? This cannot be undone.{% endblocktrans %}
+                            <p class="py-2 text-sm opacity-70">{{ delete_body }}</p>
+                        {% endif %}
+                    </form>
+                    <div class="modal-action">
+                        <form method="dialog">
+                            <button class="btn btn-outline gap-2">{% lucide "x" size=16 %} {% trans "Cancel" %}</button>
+                        </form>
+                        <button class="btn btn-error gap-2" type="submit" form="{{ event.pk|dom_id:"event_delete_form" }}">{% lucide "trash-2" size=16 %} {% trans "Confirm" %}</button>
+                    </div>
+                </div>
+                <form method="dialog" class="modal-backdrop">
+                    <button>close</button>
+                </form>
+            </dialog>
+        {% endif %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/management/templates/management/event_series_detail.html b/management/templates/management/event_series_detail.html
new file mode 100644
index 0000000..1e048c6
--- /dev/null
+++ b/management/templates/management/event_series_detail.html
@@ -0,0 +1,117 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{{ series.title }}{% endblock heading %}
+{% block subheading %}{{ series.get_kind_display }} · {{ recurrence_summary }}{% endblock subheading %}
+
+{% block actions %}
+    {% if can_manage %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:event_series_update' series.pk %}">{% lucide "pencil" size=16 %} {% trans "Edit" %}</a>
+        <form method="post" action="{% url 'management:event_series_generate' series.pk %}">
+            {% csrf_token %}
+            <button class="btn btn-outline gap-2" type="submit">{% lucide "refresh-cw" size=16 %} {% trans "Regenerate occurrences" %}</button>
+        </form>
+        <button class="btn btn-outline btn-warning gap-2" type="button" onclick="document.getElementById('series_stop_modal').showModal()">{% lucide "octagon-pause" size=16 %} {% trans "Stop repeating" %}</button>
+        <button class="btn btn-outline btn-error gap-2" type="button" onclick="document.getElementById('series_delete_modal').showModal()">{% lucide "trash-2" size=16 %} {% trans "Delete series" %}</button>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="mb-6 grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "repeat" size=18 %} {% trans "Recurrence" %}</h2>
+                <dl class="divide-y divide-base-200">
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Pattern" %}</dt>
+                        <dd>{{ recurrence_summary }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "First occurrence" %}</dt>
+                        <dd>{{ series.dtstart|date:"j M Y H:i" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Repeats until" %}</dt>
+                        <dd>{{ series.until|date:"j M Y H:i"|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Generated up to" %}</dt>
+                        <dd>{{ series.generated_until|date:"j M Y"|default:"—" }}</dd>
+                    </div>
+                </dl>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "info" size=18 %} {% trans "Template" %}</h2>
+                <dl class="divide-y divide-base-200">
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Location" %}</dt>
+                        <dd>{{ series.location|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Opponent" %}</dt>
+                        <dd>{{ series.opponent|default:"—" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Teams" %}</dt>
+                        <dd>{% for team in series.teams.all %}{{ team.name }}{% if not forloop.last %}, {% endif %}{% empty %}—{% endfor %}</dd>
+                    </div>
+                </dl>
+            </div>
+        </div>
+    </div>
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <h2 class="card-title text-base">{% lucide "calendar" size=18 %} {% trans "Occurrences" %}</h2>
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "When" %}</th>
+                            <th>{% trans "Status" %}</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for occurrence in occurrences %}
+                            <tr>
+                                <td><a class="link link-hover" href="{% url 'management:event_detail' occurrence.pk %}">{{ occurrence.start|date:"j M Y H:i" }}</a></td>
+                                <td>
+                                    {% if occurrence.cancelled %}
+                                        <span class="badge badge-outline gap-1">{% lucide "ban" size=12 %} {% trans "Cancelled" %}</span>
+                                    {% elif occurrence.detached %}
+                                        <span class="badge badge-neutral gap-1">{% lucide "unlink" size=12 %} {% trans "Detached" %}</span>
+                                    {% elif occurrence.is_past %}
+                                        <span class="badge badge-outline">{% trans "Past" %}</span>
+                                    {% else %}
+                                        <span class="badge badge-success">{% trans "Upcoming" %}</span>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="2" class="text-center opacity-60">{% trans "No occurrences generated yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    {% if can_manage %}
+        {% trans "Stop repeating" as stop_title %}
+        {% blocktrans with name=series.title asvar stop_body %}Stop “{{ name }}” from generating new occurrences? Existing ones (past and future) are left exactly as they are — this only affects what happens from here on.{% endblocktrans %}
+        {% url 'management:event_series_stop' series.pk as stop_url %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id="series_stop_modal" title=stop_title body=stop_body action_url=stop_url submit_label=stop_title submit_icon="octagon-pause" %}
+
+        {% trans "Delete series" as delete_title %}
+        {% blocktrans with name=series.title asvar delete_body %}Delete “{{ name }}”? This also deletes every occurrence it has ever generated, past and future, and their attendance records. This cannot be undone — use “Stop repeating” instead if you just want it to stop.{% endblocktrans %}
+        {% url 'management:event_series_delete' series.pk as delete_url %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id="series_delete_modal" title=delete_title body=delete_body action_url=delete_url submit_label=delete_title %}
+    {% endif %}
+{% endblock extra_body %}
diff --git a/management/templates/management/event_series_form.html b/management/templates/management/event_series_form.html
new file mode 100644
index 0000000..60e9234
--- /dev/null
+++ b/management/templates/management/event_series_form.html
@@ -0,0 +1,75 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New series" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.title %}
+                    {% form_field form.kind %}
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Repeats" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    {% form_field form.frequency %}
+                    {% form_field form.interval %}
+                    {% form_field form.dtstart %}
+                    {% form_field form.until %}
+                </div>
+                {% trans "Only used for a weekly pattern -- a monthly one repeats on the same day of the month as the first occurrence above." as weekdays_help %}
+                {% form_field form.weekdays help_text=weekdays_help %}
+                <details class="collapse collapse-arrow bg-base-200 mt-2">
+                    <summary class="collapse-title text-sm font-medium">{% trans "Advanced: raw recurrence rule" %}</summary>
+                    <div class="collapse-content">
+                        {% form_field form.advanced_rrule %}
+                    </div>
+                </details>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Audience" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    {% form_field form.teams %}
+                    {% form_field form.invited_members %}
+                    {% form_field form.excluded_members %}
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Where" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.location %}
+                    {% form_field form.opponent %}
+                </div>
+
+                <div class="divider"></div>
+                <h3 class="text-lg font-semibold mb-3">{% trans "Timing" %}</h3>
+                <div class="grid grid-cols-1 md:grid-cols-4 gap-4">
+                    {% form_field form.duration_hours %}
+                    {% form_field form.duration_minutes %}
+                    {% form_field form.gathering_minutes_before %}
+                    {% form_field form.deadline_minutes_before %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "management:event_series_detail" object.pk %}{% else %}{% url "management:event_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+{% endblock extra_body %}
diff --git a/management/templates/management/family_detail.html b/management/templates/management/family_detail.html
new file mode 100644
index 0000000..ff3bec1
--- /dev/null
+++ b/management/templates/management/family_detail.html
@@ -0,0 +1,31 @@
+{% extends "management/base.html" %}
+{% load lucide i18n %}
+
+{% block heading %}{% blocktrans with name=family %}{{ name }} Family{% endblocktrans %}{% endblock heading %}
+
+{% block actions %}
+{% if is_club_admin %}
+{% trans "Add parent" as add_parent_label %}
+{% trans "Add child" as add_child_label %}
+<button class="btn btn-outline gap-2" type="button" onclick="document.getElementById('add_parent_modal').showModal()">{% lucide "user-plus" size=16 %} {{ add_parent_label }}</button>
+<button class="btn btn-outline gap-2" type="button" onclick="document.getElementById('add_child_modal').showModal()">{% lucide "baby" size=16 %} {{ add_child_label }}</button>
+{% endif %}
+{% endblock actions %}
+
+{% block panel %}
+<div class="card bg-base-100 shadow">
+    <div class="card-body">
+        {% include "management/_family_members_table.html" with group=group %}
+    </div>
+</div>
+
+{% if is_club_admin %}
+{% url 'management:family_add_parent' family.pk as add_parent_url %}
+{% url 'management:family_add_child' family.pk as add_child_url %}
+{% trans "Add parent" as add_parent_title %}
+{% trans "Add child" as add_child_title %}
+{% trans "If this email has no account yet, one is created and they set a password via the reset link." as add_parent_blurb %}
+{% include "controlpanel/_modal_form.html" with modal_id="add_parent_modal" title=add_parent_title form=add_parent_form action_url=add_parent_url submit_label=add_parent_title submit_icon="user-plus" blurb=add_parent_blurb %}
+{% include "controlpanel/_modal_form.html" with modal_id="add_child_modal" title=add_child_title form=add_child_form action_url=add_child_url submit_label=add_child_title submit_icon="baby" %}
+{% endif %}
+{% endblock panel %}
diff --git a/management/templates/management/family_form.html b/management/templates/management/family_form.html
new file mode 100644
index 0000000..c6eb451
--- /dev/null
+++ b/management/templates/management/family_form.html
@@ -0,0 +1,43 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{% trans "Add family" %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <h2 class="card-title text-base">{% lucide "user" size=18 %} {% trans "Parent / guardian" %}</h2>
+                <p class="text-sm opacity-70">{% trans "Gets a login -- they set a password via the reset link if this is a new email." %}</p>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.parent_first_name %}
+                    {% form_field form.parent_last_name %}
+                    {% form_field form.parent_email %}
+                </div>
+
+                <div class="divider"></div>
+
+                <h2 class="card-title text-base">{% lucide "baby" size=18 %} {% trans "Child" %}</h2>
+                <p class="text-sm opacity-70">{% trans "No login of their own -- the parent above manages things for them." %}</p>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.child_first_name %}
+                    {% form_field form.child_last_name %}
+                    {% form_field form.child_date_of_birth %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url "management:member_list" %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/home.html b/management/templates/management/home.html
new file mode 100644
index 0000000..ca214ce
--- /dev/null
+++ b/management/templates/management/home.html
@@ -0,0 +1,308 @@
+{% extends "management/base.html" %}
+{% load i18n static lucide %}
+
+{% block heading %}{{ club.name }}{% endblock heading %}
+{% block subheading %}{% trans "Management" %}{% endblock subheading %}
+
+{% block panel %}
+    {% if attention.no_season %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "calendar-x" size=20 %}
+            <span>
+                {% trans "No season covers today, so this club cannot take a signup or schedule a match. Nothing errors — it is simply inert." %}
+            </span>
+        </div>
+    {% endif %}
+
+    {% if is_club_admin and billing_ends_at %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "calendar-clock" size=20 %}
+            <span>
+                {% if billing_auto_renews %}
+                    {% blocktrans with date=billing_ends_at|date:"j M Y" %}Your current billing period ends {{ date }} and will renew automatically.{% endblocktrans %}
+                {% else %}
+                    {% blocktrans with date=billing_ends_at|date:"j M Y" %}Your current billing period ends {{ date }} and is not set to renew automatically — billing is about to stop. Contact us to keep access.{% endblocktrans %}
+                {% endif %}
+            </span>
+        </div>
+    {% endif %}
+
+    {% comment %}
+        The club's own numbers that should be zero -- same attention/chart/stat-group
+        data controlpanel/club_detail.html shows a platform admin drilling into this
+        club from outside; club_attention/club_charts/club_statistics are already
+        club-scoped, so this is that same data for the club's own staff. Nothing
+        money-shaped renders below for non-admins, same line the nav already draws
+        around the Shop section.
+    {% endcomment %}
+    <div class="mb-6 grid gap-4 sm:grid-cols-2 md:grid-cols-5">
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.teams_without_manager %}border-error{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-x" size=16 %} {% trans "Teams without coach" %}</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.teams_without_manager }}</div>
+                <div class="text-xs opacity-60">{% trans "Teams nobody can pick a squad for" %}</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.unrostered %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-minus" size=16 %} {% trans "Unrostered members" %}</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.unrostered }}</div>
+                <div class="text-xs opacity-60">{% trans "Active members on no team" %}</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.pending_approvals %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "clock" size=16 %} {% trans "Pending" %}</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.pending_approvals }}</div>
+                <div class="text-xs opacity-60">{% trans "Memberships awaiting approval" %}</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 border-info">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "sparkles" size=16 %} {% trans "New members" %}</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">{{ attention.new_members }}</div>
+                <div class="text-xs opacity-60">{% trans "First season at this club" %}</div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow border-l-4 {% if attention.attendance.turnout is None %}border-info{% elif attention.attendance.turnout < 30 %}border-error{% elif attention.attendance.turnout < 65 %}border-warning{% else %}border-success{% endif %}">
+            <div class="card-body p-4">
+                <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-check" size=16 %} {% trans "Attendance rate" %}</div>
+                <div class="text-4xl font-bold tabular-nums font-mono">
+                    {% if attention.attendance.turnout is None %}
+                        {% trans "N/A" %}
+                    {% else %}
+                        {{ attention.attendance.turnout }}%
+                    {% endif %}
+                </div>
+                <div class="text-xs opacity-60">
+                    {% if attention.attendance.turnout is None %}
+                        {% trans "No events this season" %}
+                    {% else %}
+                        <progress class="progress w-full {% if attention.attendance.turnout < 30 %}progress-error{% elif attention.attendance.turnout < 65 %}progress-warning{% else %}progress-success{% endif %}"
+                                  value="{{ attention.attendance.turnout }}" max="100"></progress>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="mb-6 grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% lucide "calendar" size=18 %} {% trans "Upcoming events" %}</h2>
+                    <a class="btn btn-outline btn-sm gap-2" href="{% url 'management:event_list' %}">{% lucide "arrow-right" size=14 %} {% trans "View all" %}</a>
+                </div>
+                <div class="overflow-x-auto">
+                    <table class="table">
+                        <tbody>
+                            {% for event in upcoming_events %}
+                                <tr>
+                                    <td class="whitespace-nowrap">{{ event.start|date:"D j M, H:i" }}</td>
+                                    <td>{{ event.title }}</td>
+                                    <td>{{ event.get_kind_display }}</td>
+                                    <td>{% for team in event.teams.all %}{{ team.short_name }}{% if not forloop.last %}, {% endif %}{% empty %}—{% endfor %}</td>
+                                </tr>
+                            {% empty %}
+                                <tr>
+                                    <td class="text-center opacity-60">{% trans "Nothing scheduled." %}</td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% lucide "newspaper" size=18 %} {% trans "News" %}</h2>
+                    <a class="btn btn-outline btn-sm gap-2" href="{% url 'management:news_list' %}">{% lucide "arrow-right" size=14 %} {% trans "View all" %}</a>
+                </div>
+                <div class="overflow-x-auto">
+                    <table class="table">
+                        <tbody>
+                            {% for news_item in published_news %}
+                                <tr>
+                                    <td class="whitespace-nowrap">{{ news_item.published_at|date:"D j M" }}</td>
+                                    <td><a class="link link-hover" href="{% url 'management:news_detail' news_item.pk %}">{{ news_item.title }}</a></td>
+                                </tr>
+                            {% empty %}
+                                <tr>
+                                    <td class="text-center opacity-60">{% trans "Nothing published yet." %}</td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    {% if is_club_admin %}
+        <div class="mb-6 grid gap-4 lg:grid-cols-3">
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "user-plus" size=18 %} {% trans "Signups per month" %}</h2>
+                    <p class="text-sm opacity-70">{% trans "New members against returning ones." %}</p>
+                    <div class="h-56">
+                        <canvas id="signups-chart"></canvas>
+                    </div>
+                </div>
+            </div>
+
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "wallet" size=18 %} {% trans "Club fee status this season" %}</h2>
+                    <div class="h-56">
+                        <canvas id="fees-chart"></canvas>
+                    </div>
+                </div>
+            </div>
+
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "repeat" size=18 %} {% trans "Renewal rate" %}</h2>
+                    {% if attention.renewal_rate is None %}
+                        <p class="text-sm opacity-70">{% trans "No previous season to compare." %}</p>
+                    {% else %}
+                        <div class="h-56">
+                            <canvas id="renewal-chart"></canvas>
+                        </div>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+    {% endif %}
+
+    <div class="grid gap-4 {% if is_club_admin %}md:grid-cols-4{% else %}md:grid-cols-3{% endif %}">
+        {% for group in groups %}
+            {% if group.title != "Shop" or is_club_admin %}
+                <div class="card bg-base-100 shadow">
+                    <div class="card-body">
+                        <h2 class="card-title text-base">{% lucide group.icon size=18 %} {{ group.title }}</h2>
+                        <dl class="divide-y divide-base-200">
+                            {% for label, value in group.stats %}
+                                <div class="flex items-center justify-between py-2">
+                                    <dt class="text-sm opacity-70">{{ label }}</dt>
+                                    <dd class="font-semibold tabular-nums font-mono">{% if group.title == "Shop" and label == "Outstanding" or label == "Revenue" %}&euro;{% endif %}{{ value }}</dd>
+                                </div>
+                            {% endfor %}
+                        </dl>
+                    </div>
+                </div>
+            {% endif %}
+        {% endfor %}
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    {% trans "New" as new_label %}
+    {% trans "Returning" as returning_label %}
+    {% trans "Renewed" as renewed_label %}
+    {% trans "Not renewed" as not_renewed_label %}
+    {{ charts|json_script:"chart-data" }}
+    {{ attention.renewal_rate|json_script:"renewal-rate-data" }}
+    <script src="{% static 'js/chart.js' %}"></script>
+    <script>
+        (() => {
+            const data = JSON.parse(document.getElementById("chart-data").textContent);
+            const renewalRate = JSON.parse(document.getElementById("renewal-rate-data").textContent);
+            const css = (name, fallback) => getComputedStyle(document.documentElement).getPropertyValue(name).trim() || fallback;
+            const signupsCanvas = document.getElementById("signups-chart");
+            const feesCanvas = document.getElementById("fees-chart");
+            const renewalCanvas = document.getElementById("renewal-chart");
+
+            const render = () => {
+                const ink = css("--color-base-content", "#333");
+                const grid = "color-mix(in oklab, " + ink + " 15%, transparent)";
+                const charts = [];
+
+                // Both canvases are admin-only -- absent entirely for a manager/coach,
+                // same gate as the Shop nav section and the rest of this row.
+                if (signupsCanvas) {
+                    // Stacked: the bar height stays "signups this month" while the split shows
+                    // where they came from. Side-by-side bars would answer a different question.
+                    charts.push(new Chart(signupsCanvas, {
+                        type: "bar",
+                        data: {
+                            labels: data.signups.map((point) => point.month),
+                            datasets: [
+                                {label: "{{ new_label|escapejs }}", data: data.signups.map((point) => point.new), backgroundColor: css("--color-primary", "#4f46e5")},
+                                {label: "{{ returning_label|escapejs }}", data: data.signups.map((point) => point.returning), backgroundColor: css("--color-accent", "#0ea5e9")},
+                            ],
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {legend: {position: "bottom", labels: {color: ink}}},
+                            scales: {
+                                x: {stacked: true, ticks: {color: ink}, grid: {color: grid}},
+                                y: {stacked: true, beginAtZero: true, ticks: {color: ink, precision: 0}, grid: {color: grid}},
+                            },
+                        },
+                    }));
+                }
+
+                if (feesCanvas) {
+                    // Colour carries the meaning here — unpaid must read as a problem, waived
+                    // must not — so the slices are pinned to the semantic theme colours, in order.
+                    charts.push(new Chart(feesCanvas, {
+                        type: "pie",
+                        data: {
+                            labels: data.fees.map((slice) => slice.label),
+                            datasets: [
+                                {
+                                    data: data.fees.map((slice) => slice.value),
+                                    backgroundColor: [css("--color-success", "#16a34a"), css("--color-warning", "#f59e0b"), css("--color-error", "#dc2626"), css("--color-neutral", "#6b7280")],
+                                },
+                            ],
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {legend: {position: "right", labels: {color: ink}}},
+                        },
+                    }));
+                }
+
+                if (renewalCanvas && renewalRate !== null) {
+                    // Same "colour carries the meaning" reasoning as the fee chart: a low
+                    // renewal rate reads as a problem, so it's pinned to error, not neutral.
+                    charts.push(new Chart(renewalCanvas, {
+                        type: "pie",
+                        data: {
+                            labels: ["{{ renewed_label|escapejs }}", "{{ not_renewed_label|escapejs }}"],
+                            datasets: [
+                                {
+                                    data: [renewalRate, 100 - renewalRate],
+                                    backgroundColor: [css("--color-success", "#16a34a"), css("--color-error", "#dc2626")],
+                                },
+                            ],
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {legend: {position: "right", labels: {color: ink}}},
+                        },
+                    }));
+                }
+
+                return charts;
+            };
+
+            let charts = render();
+
+            // "auto" removes data-theme entirely, so watch the attribute rather than a click.
+            new MutationObserver(() => {
+                charts.forEach((chart) => chart.destroy());
+                charts = render();
+            }).observe(document.documentElement, {attributes: true, attributeFilter: ["data-theme"]});
+        })();
+    </script>
+{% endblock extra_body %}
diff --git a/management/templates/management/location_form.html b/management/templates/management/location_form.html
new file mode 100644
index 0000000..9398291
--- /dev/null
+++ b/management/templates/management/location_form.html
@@ -0,0 +1,35 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New location" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url "management:location_list" %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+{% endblock extra_body %}
diff --git a/management/templates/management/location_list.html b/management/templates/management/location_list.html
new file mode 100644
index 0000000..b768f7d
--- /dev/null
+++ b/management/templates/management/location_list.html
@@ -0,0 +1,59 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Locations" %}{% endblock heading %}
+
+{% block actions %}
+    <a class="btn btn-primary gap-2" href="{% url 'management:location_create' %}">{% lucide "plus" size=16 %} {% trans "New location" %}</a>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Name" %}</th>
+                            <th>{% trans "Address" %}</th>
+                            <th>{% trans "City" %}</th>
+                            <th>{% trans "Country" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for location in locations %}
+                            <tr>
+                                <td>
+                                    {{ location.name }}
+                                    {% if location.is_home %}<span class="badge badge-sm badge-primary ml-1">{% trans "Home" %}</span>{% endif %}
+                                </td>
+                                <td>{{ location.address }}</td>
+                                <td>{{ location.city }}</td>
+                                <td>{{ location.country }}</td>
+                                <td class="text-right">
+                                    <div class="flex justify-end gap-1">
+                                        <a class="btn btn-outline btn-sm" href="{% url 'management:location_update' location.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                        <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ location.pk|dom_id:"location_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                    </div>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">{% trans "No locations yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% trans "Delete location" as delete_location_title %}
+    {% trans "Delete" as delete_label %}
+    {% for location in locations %}
+        {% url 'management:location_delete' location.pk as location_delete_url %}
+        {% blocktrans with name=location.name asvar delete_location_body %}Delete “{{ name }}”? Any events at this location keep their history but lose the link. This cannot be undone.{% endblocktrans %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id=location.pk|dom_id:"location_delete_modal" title=delete_location_title body=delete_location_body action_url=location_delete_url submit_label=delete_label %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/management/templates/management/member_detail.html b/management/templates/management/member_detail.html
new file mode 100644
index 0000000..5f0dee0
--- /dev/null
+++ b/management/templates/management/member_detail.html
@@ -0,0 +1,157 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{{ member.get_full_name }}{% endblock heading %}
+{% block subheading %}{{ member.contact_email }}{% endblock subheading %}
+
+{% block actions %}
+    {% if is_club_admin %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:member_update' member.pk %}">{% lucide "pencil" size=16 %} {% trans "Edit" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="grid gap-4 lg:grid-cols-2">
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "user" size=18 %} {% trans "Personal information" %}</h2>
+                <dl class="divide-y divide-base-200">
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Date of birth" %}</dt>
+                        <dd class="font-semibold">{{ member.date_of_birth|default:"-" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Phone" %}</dt>
+                        <dd class="font-semibold">{{ member.phone.as_international|default:"-" }}</dd>
+                    </div>
+                    <div class="flex items-center justify-between py-2">
+                        <dt class="text-sm opacity-70">{% trans "Emergency phone" %}</dt>
+                        <dd class="font-semibold">{{ member.emergency_phone.as_international|default:"-" }}</dd>
+                    </div>
+                </dl>
+
+                <div class="flex flex-row gap-2 items-center mt-2">
+                    {% if member.phone %}
+                        <a class="btn btn-sm btn-outline btn-primary grow" href="tel:{{ member.phone.as_international }}">{% lucide "phone" size=14 %} {% trans "Call" %}</a>
+                    {% endif %}
+                    {% if member.emergency_phone %}
+                        <a class="btn btn-sm btn-outline btn-error grow" href="tel:{{ member.emergency_phone.as_international }}">{% lucide "shield-alert" size=14 %} {% trans "Emergency call" %}</a>
+                    {% endif %}
+                </div>
+            </div>
+        </div>
+
+        {% comment %}
+            A Member has no club of its own -- ClubMembership is the only thing that
+            actually ties this person to *this* club, so it gets its own panel: the
+            current season's standing, plus every season they've been part of.
+        {% endcomment %}
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "id-card" size=18 %} {% trans "Club membership" %}</h2>
+                {% if current_membership %}
+                    <dl class="divide-y divide-base-200">
+                        <div class="flex items-center justify-between py-2">
+                            <dt class="text-sm opacity-70">{% trans "License" %}</dt>
+                            <dd class="font-semibold">{{ current_membership.license|default:"-" }}</dd>
+                        </div>
+                        <div class="flex items-center justify-between py-2">
+                            <dt class="text-sm opacity-70">{% trans "Status" %}</dt>
+                            <dd class="font-semibold">{{ current_membership.get_status_display }}</dd>
+                        </div>
+                        <div class="flex items-center justify-between py-2">
+                            <dt class="text-sm opacity-70">{% trans "Fee status" %}</dt>
+                            <dd class="font-semibold">{{ current_membership.get_fee_status_display }}</dd>
+                        </div>
+                    </dl>
+                {% else %}
+                    <p class="text-sm opacity-60">{% trans "Not rostered for the current season." %}</p>
+                {% endif %}
+
+                {% if membership_history %}
+                    <div class="divider"></div>
+                    <h3 class="text-sm font-semibold opacity-70">{% trans "Season history" %}</h3>
+                    <div class="overflow-x-auto">
+                        <table class="table">
+                            <thead>
+                                <tr>
+                                    <th>{% trans "Season" %}</th>
+                                    <th>{% trans "Status" %}</th>
+                                    <th>{% trans "Fee status" %}</th>
+                                    <th>{% trans "License" %}</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {% for membership in membership_history %}
+                                    <tr>
+                                        <td>{{ membership.season.start_date|date:"Y" }} - {{ membership.season.end_date|date:"Y" }}</td>
+                                        <td>{{ membership.get_status_display }}</td>
+                                        <td>{{ membership.get_fee_status_display }}</td>
+                                        <td>{{ membership.license|default:"-" }}</td>
+                                    </tr>
+                                {% endfor %}
+                            </tbody>
+                        </table>
+                    </div>
+                {% endif %}
+            </div>
+        </div>
+    </div>
+
+    {% trans "Add parent" as add_parent_label %}
+    {% trans "Add child" as add_child_label %}
+    {% trans "If this email has no account yet, one is created and they set a password via the reset link." as add_parent_blurb %}
+    {% blocktrans with short_name=member.get_short_name asvar remove_from_family_label %}Remove {{ short_name }} from family{% endblocktrans %}
+    {% trans "Remove from family" as remove_from_family_title %}
+    {% trans "Remove" as remove_label %}
+    {% for family_group in family_groups %}
+        <div class="card bg-base-100 shadow mt-4">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">
+                        {% lucide "users" size=18 %}
+                        <a class="link link-hover" href="{% url 'management:family_detail' family_group.family.pk %}">{{ family_group.family }}</a>
+                    </h2>
+                    {% if is_club_admin %}
+                        <div class="flex gap-2">
+                            <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('{{ family_group.family.pk|dom_id:"add_parent_modal" }}').showModal()">{% lucide "user-plus" size=14 %} {{ add_parent_label }}</button>
+                            <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('{{ family_group.family.pk|dom_id:"add_child_modal" }}').showModal()">{% lucide "baby" size=14 %} {{ add_child_label }}</button>
+                            <button class="btn btn-outline btn-error btn-sm gap-2" type="button" onclick="document.getElementById('{{ family_group.family.pk|dom_id:"detach_family_modal" }}').showModal()">{% lucide "user-x" size=14 %} {{ remove_from_family_label }}</button>
+                        </div>
+                    {% endif %}
+                </div>
+                {% include "management/_family_members_table.html" with group=family_group next_url=request.path %}
+            </div>
+        </div>
+
+        {% if is_club_admin %}
+            {% url 'management:family_add_parent' family_group.family.pk as add_parent_url %}
+            {% url 'management:family_add_child' family_group.family.pk as add_child_url %}
+            {% url 'management:member_detach_family' member.pk family_group.family.pk as detach_family_url %}
+            {% blocktrans with full_name=member.get_full_name family_name=family_group.family asvar detach_family_body %}Remove {{ full_name }} from {{ family_name }}? They become a standalone member -- nothing else about them changes.{% endblocktrans %}
+            {% include "controlpanel/_modal_form.html" with modal_id=family_group.family.pk|dom_id:"add_parent_modal" title=add_parent_label form=add_parent_form action_url=add_parent_url submit_label=add_parent_label submit_icon="user-plus" blurb=add_parent_blurb %}
+            {% include "controlpanel/_modal_form.html" with modal_id=family_group.family.pk|dom_id:"add_child_modal" title=add_child_label form=add_child_form action_url=add_child_url submit_label=add_child_label submit_icon="baby" %}
+            {% include "controlpanel/_confirm_modal.html" with modal_id=family_group.family.pk|dom_id:"detach_family_modal" title=remove_from_family_title body=detach_family_body action_url=detach_family_url submit_label=remove_label submit_icon="user-x" %}
+        {% endif %}
+    {% endfor %}
+
+    {% if is_club_admin %}
+        <div class="card bg-base-100 shadow mt-4">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% lucide "users" size=18 %} {% trans "Family" %}</h2>
+                    <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('attach_family_modal').showModal()">{% lucide "user-plus" size=14 %} {% trans "Add to family" %}</button>
+                </div>
+                {% if not family_groups %}
+                    <p class="text-sm opacity-60">{% trans "Not part of a family." %}</p>
+                {% endif %}
+            </div>
+        </div>
+
+        {% url 'management:member_attach_family' member.pk as attach_family_url %}
+        {% trans "Add to family" as add_to_family_title %}
+        {% trans "Add" as add_label %}
+        {% trans "Pick an existing family, or leave it blank to start a new one." as attach_family_blurb %}
+        {% include "controlpanel/_modal_form.html" with modal_id="attach_family_modal" title=add_to_family_title form=attach_to_family_form action_url=attach_family_url submit_label=add_label submit_icon="user-plus" blurb=attach_family_blurb %}
+    {% endif %}
+{% endblock panel %}
diff --git a/management/templates/management/member_form.html b/management/templates/management/member_form.html
new file mode 100644
index 0000000..4a6f484
--- /dev/null
+++ b/management/templates/management/member_form.html
@@ -0,0 +1,62 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{% if update_view %}{% blocktrans with name=object %}Edit {{ name }}{% endblocktrans %}{% else %}{% trans "New member" %}{% endif %}{% endblock heading %}
+
+{% block actions %}
+    {% if update_view %}
+        <button class="btn btn-outline btn-error gap-2" type="button" onclick="document.getElementById('member_delete_modal').showModal()">{% lucide "trash-2" size=16 %} {% trans "Delete" %}</button>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                {% if membership_form %}
+                    <div class="divider"></div>
+                    <h2 class="card-title text-base">{% lucide "id-card" size=18 %} {% trans "This season" %}</h2>
+
+                    {% for error in membership_form.non_field_errors %}
+                        <div class="alert alert-error my-2">
+                            <span>{{ error }}</span>
+                        </div>
+                    {% endfor %}
+
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                        {% for field in membership_form %}
+                            {% form_field field %}
+                        {% endfor %}
+                    </div>
+                {% endif %}
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "management:member_detail" object.pk %}{% else %}{% url "management:member_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    {% if update_view %}
+        {% url 'management:member_delete' object.pk as member_delete_url %}
+        {% trans "Delete member" as delete_member_title %}
+        {% trans "Delete" as delete_label %}
+        {% blocktrans with full_name=object.get_full_name asvar delete_member_body %}Delete {{ full_name }}? This also removes their club membership, roster spots, staff assignments, and family links. This cannot be undone.{% endblocktrans %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id="member_delete_modal" title=delete_member_title body=delete_member_body action_url=member_delete_url submit_label=delete_label %}
+    {% endif %}
+{% endblock panel %}
diff --git a/management/templates/management/member_import.html b/management/templates/management/member_import.html
new file mode 100644
index 0000000..ab92361
--- /dev/null
+++ b/management/templates/management/member_import.html
@@ -0,0 +1,39 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{% trans "Mass upload members" %}{% endblock heading %}
+
+{% block actions %}
+    <a class="btn btn-outline gap-2" href="{% url 'management:member_import_template' %}">{% lucide "download" size=16 %} {% trans "Download template" %}</a>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <p class="text-sm opacity-70">
+                {% blocktrans %}Fill in the downloaded template — one row per member — then upload it
+                here. Nothing is created yet: you'll see exactly what will be added
+                before anything is saved.{% endblocktrans %}
+            </p>
+
+            <form method="post" enctype="multipart/form-data">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                {% for field in form %}
+                    {% form_field field %}
+                {% endfor %}
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url 'management:member_list' %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "upload" size=16 %} {% trans "Upload and preview" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/member_import_preview.html b/management/templates/management/member_import_preview.html
new file mode 100644
index 0000000..5875072
--- /dev/null
+++ b/management/templates/management/member_import_preview.html
@@ -0,0 +1,68 @@
+{% extends "management/base.html" %}
+{% load lucide i18n %}
+
+{% block heading %}{% trans "Review import" %}{% endblock heading %}
+
+{% block panel %}
+    {% if not season %}
+        <div class="alert alert-warning mb-4">
+            {% lucide "triangle-alert" size=16 %}
+            <span>{% trans "No active season — members will still be created, but won't be rostered for one until it exists." %}</span>
+        </div>
+    {% endif %}
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <p class="text-sm opacity-70">
+                {% blocktrans count counter=valid_count %}{{ counter }} member will be created.{% plural %}{{ counter }} members will be created.{% endblocktrans %}
+                {% if skipped_count %}{% blocktrans count counter=skipped_count %}{{ counter }} row will be skipped.{% plural %}{{ counter }} rows will be skipped.{% endblocktrans %}{% endif %}
+            </p>
+
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Row" %}</th>
+                            <th>{% trans "Last name" %}</th>
+                            <th>{% trans "First name" %}</th>
+                            <th>{% trans "Email" %}</th>
+                            <th>{% trans "Outcome" %}</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for result in results %}
+                            <tr>
+                                <td>{{ result.line_number }}</td>
+                                <td>{{ result.raw.last_name }}</td>
+                                <td>{{ result.raw.first_name }}</td>
+                                <td>{{ result.raw.email }}</td>
+                                <td>
+                                    {% if result.member %}
+                                        <span class="badge badge-success badge-sm">{% trans "Will create" %}</span>
+                                    {% else %}
+                                        <span class="badge badge-error badge-sm">{% trans "Skipped" %}</span>
+                                        <div class="text-xs opacity-70 mt-1">{{ result.errors|join:"; " }}</div>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">{% trans "No rows found in the uploaded file." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+
+            <div class="card-actions justify-start pt-2 mt-2">
+                <a class="btn btn-outline gap-2" href="{% url 'management:member_import' %}">{% lucide "arrow-left" size=16 %} {% trans "Back" %}</a>
+                {% if valid_count %}
+                    <form method="post" action="{% url 'management:member_import_confirm' %}">
+                        {% csrf_token %}
+                        <button class="btn btn-primary gap-2" type="submit">{% lucide "check" size=16 %} {% blocktrans %}Confirm import ({{ valid_count }}){% endblocktrans %}</button>
+                    </form>
+                {% endif %}
+            </div>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/member_list.html b/management/templates/management/member_list.html
new file mode 100644
index 0000000..cd1e9f4
--- /dev/null
+++ b/management/templates/management/member_list.html
@@ -0,0 +1,102 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{% trans "Members" %}{% endblock heading %}
+
+{% block actions %}
+<a class="btn btn-outline btn-info gap-2" href="{% url 'management:member_import_template' %}" xmlns:management="http://www.w3.org/1999/xhtml">{% lucide "download" size=16 %} {% trans "Download upload template" %}</a>
+    {% if is_club_admin %}
+        <a class="btn btn-outline btn-info gap-2" href="{% url 'management:member_import' %}">{% lucide "upload" size=16 %} {% trans "Mass upload" %}</a>
+        <a class="btn btn-outline gap-2" href="{% url 'management:family_create' %}">{% lucide "users" size=16 %} {% trans "Add family" %}</a>
+        <a class="btn btn-outline gap-2" href="{% url 'management:member_create' %}">{% lucide "user-plus" size=16 %} {% trans "Add member" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <form method="get" class="mb-4 flex gap-2">
+        <label class="input">
+            <span class="opacity-50">{% lucide "search" size=16 %}</span>
+            <input type="search" name="q" value="{{ search }}" placeholder="{% trans 'Search members ...' %}" class="input input-bordered w-full max-w-xs">
+        </label>
+        <button class="btn btn-outline gap-2" type="submit">{% lucide "search" size=16 %} {% trans "Search" %}</button>
+        {% if search %}
+            <a class="btn gap-2" href="{% url "management:member_list" %}">{% lucide "x" size=16 %} {% trans "Clear filter" %}</a>
+        {% endif %}
+    </form>
+
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Last name" %}</th>
+                            <th>{% trans "First name" %}</th>
+                            <th>{% trans "Email" %}</th>
+                            <th>{% trans "Family" %}</th>
+                            <th>{% trans "Status" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for member in members %}
+                            <tr>
+                                <td><a class="link link-hover" href="{% url 'management:member_detail' member.pk %}">{{ member.last_name }}</a></td>
+                                <td>{{ member.first_name }}</td>
+                                <td>{{ member.contact_email|default:"-" }}</td>
+                                <td>
+                                    {% if member.family_memberships_display %}
+                                        <div class="flex flex-col gap-1">
+                                            {% for fm in member.family_memberships_display %}
+                                                <div>
+                                                    <a class="btn btn-outline btn-sm" href="{% url 'management:family_detail' fm.family.pk %}">{% lucide "users" size=14 %} {{ fm.family }} {% lucide "arrow-right" size=14 %}</a>
+                                                </div>
+                                            {% endfor %}
+                                        </div>
+                                    {% else %}
+                                        <span class="opacity-40">-</span>
+                                    {% endif %}
+                                </td>
+                                <td>
+                                    {% if member.current_membership %}
+                                        <span class="badge badge-sm
+                                            {% if member.current_membership.status == "active" %}badge-success
+                                            {% elif member.current_membership.status == "pending" %}badge-warning
+                                            {% elif member.current_membership.status == "cancelled" %}badge-error
+                                            {% else %}badge-neutral{% endif %}">
+                                            {{ member.current_membership.get_status_display }}
+                                        </span>
+                                    {% else %}
+                                        <span class="badge badge-sm badge-neutral">{% trans "unknown" %}</span>
+                                    {% endif %}
+                                </td>
+                                <td class="text-right">
+                                    {% if is_club_admin %}
+                                        <div class="flex justify-end gap-1">
+                                            <a class="btn btn-outline btn-sm" href="{% url 'management:member_detail' member.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                            <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ member.pk|dom_id:"member_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                        </div>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="6" class="text-center opacity-60">{% trans "No members yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% if is_club_admin %}
+        {% trans "Delete member" as delete_member_title %}
+        {% trans "Delete" as delete_label %}
+        {% for member in members %}
+            {% url 'management:member_delete' member.pk as member_delete_url %}
+            {% blocktrans with full_name=member.get_full_name asvar delete_member_body %}Delete {{ full_name }}? This also removes their club membership, roster spots, staff assignments, and family links. This cannot be undone.{% endblocktrans %}
+            {% include "controlpanel/_confirm_modal.html" with modal_id=member.pk|dom_id:"member_delete_modal" title=delete_member_title body=delete_member_body action_url=member_delete_url submit_label=delete_label %}
+        {% endfor %}
+    {% endif %}
+{% endblock panel %}
diff --git a/management/templates/management/membership_list.html b/management/templates/management/membership_list.html
new file mode 100644
index 0000000..9a39a88
--- /dev/null
+++ b/management/templates/management/membership_list.html
@@ -0,0 +1,226 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Memberships" %}{% endblock heading %}
+{% block subheading %}{% if current_season %}{% blocktrans %}Fee status for season{% endblocktrans %}{% endif %}{% endblock subheading %}
+
+{% block actions %}
+    <a class="btn btn-outline gap-2" href="{% url 'management:membership_export_pdf' %}?{{ request.GET.urlencode }}">{% lucide "file-down" size=16 %} {% trans "Export to PDF" %}</a>
+{% endblock actions %}
+
+{% block panel %}
+    {% if not current_season %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "calendar-x" size=20 %}
+            <span>{% trans "No season covers today, so there's nothing to show fee status for yet." %}</span>
+        </div>
+    {% else %}
+        <div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-6">
+            <div class="card bg-base-100 shadow border-l-4 border-info">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "users" size=16 %} {% trans "Registered" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">{{ kpi_total }}</div>
+                    <div class="text-xs opacity-60">{% trans "This season" %}</div>
+                </div>
+            </div>
+            <div class="card bg-base-100 shadow border-l-4 border-success">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "circle-check" size=16 %} {% trans "Paid" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">{{ kpi_paid }}</div>
+                </div>
+            </div>
+            <div class="card bg-base-100 shadow border-l-4 {% if kpi_partial %}border-warning{% else %}border-success{% endif %}">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "circle-dashed" size=16 %} {% trans "Partially paid" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">{{ kpi_partial }}</div>
+                </div>
+            </div>
+            <div class="card bg-base-100 shadow border-l-4 {% if kpi_unpaid %}border-error{% else %}border-success{% endif %}">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "circle-x" size=16 %} {% trans "Unpaid" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">{{ kpi_unpaid }}</div>
+                </div>
+            </div>
+            <div class="card bg-base-100 shadow border-l-4 border-neutral">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "circle-check" size=16 %} {% trans "Waived" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">{{ kpi_waived }}</div>
+                </div>
+            </div>
+            <div class="card bg-base-100 shadow border-l-4 {% if kpi_paid_rate is None %}border-info{% elif kpi_paid_rate < 50 %}border-error{% elif kpi_paid_rate < 85 %}border-warning{% else %}border-success{% endif %}">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "percent" size=16 %} {% trans "Paid rate" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">
+                        {% if kpi_paid_rate is None %}{% trans "N/A" %}{% else %}{{ kpi_paid_rate }}%{% endif %}
+                    </div>
+                </div>
+            </div>
+        </div>
+    {% endif %}
+
+    <form method="get" class="mb-4">
+        <div class="flex flex-row items-center gap-2">
+            <label class="input">
+                <span class="opacity-50">{% lucide "search" size=16 %}</span>
+                <input type="search" name="q" value="{{ search }}" placeholder="{% trans 'Search members ...' %}" class="input input-bordered">
+            </label>
+
+            <select name="season" class="select select-bordered">
+                {% for season in seasons %}
+                    <option value="{{ season.pk }}" {% if season.pk == selected_season.pk %}selected{% endif %}>{% trans "Season" %} {{ season.start_date|date:"Y" }} - {{ season.end_date|date:"Y" }}</option>
+                {% endfor %}
+            </select>
+
+            <select name="fee_status" class="select select-bordered">
+                <option value="not_paid" {% if selected_fee_status == "not_paid" %}selected{% endif %}>{% trans "Not paid (unpaid or partially)" %}</option>
+                {% for value, label in fee_status_choices %}
+                    <option value="{{ value }}" {% if value == selected_fee_status %}selected{% endif %}>{{ label|capfirst }}</option>
+                {% endfor %}
+                <option value="all" {% if selected_fee_status == "all" %}selected{% endif %}>{% trans "All" %}</option>
+            </select>
+
+            <select name="status" class="select select-bordered">
+                <option value="all" {% if selected_status == "all" %}selected{% endif %}>{% trans "All statuses" %}</option>
+                {% for value, label in status_choices %}
+                    <option value="{{ value }}" {% if value == selected_status %}selected{% endif %}>{{ label|capfirst }}</option>
+                {% endfor %}
+            </select>
+
+            <select name="team" class="select select-bordered">
+                <option value="" {% if not selected_team %}selected{% endif %}>{% trans "All teams" %}</option>
+                {% for team in teams %}
+                    <option value="{{ team.pk }}" {% if team.pk|stringformat:"s" == selected_team %}selected{% endif %}>{{ team }}</option>
+                {% endfor %}
+            </select>
+
+            <button class="btn btn-outline gap-2" type="submit">{% lucide "filter" size=16 %} {% trans "Filter" %}</button>
+            <a class="btn gap-2" href="{% url 'management:membership_list' %}">{% lucide "x" size=16 %} {% trans "Reset" %}</a>
+        </div>
+    </form>
+
+    <form method="post" action="{% url 'management:membership_mark_paid' %}" id="membership-form">
+        {% csrf_token %}
+        <input type="hidden" name="next" value="{{ request.get_full_path }}">
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between mb-2">
+                    <span class="text-sm opacity-70 font-semibold">
+                        {% blocktrans count counter=memberships|length %}{{ counter }} membership{% plural %}{{ counter }} memberships{% endblocktrans %}
+                    </span>
+                    <button class="btn btn-success btn-sm gap-2" type="submit">{% lucide "circle-check" size=14 %} {% trans "Mark selected as paid" %}</button>
+                </div>
+
+                <div class="overflow-x-auto">
+                    <table class="table">
+                        <thead>
+                            <tr>
+                                <th><input type="checkbox" class="checkbox" id="select-all-memberships"></th>
+                                <th>{% trans "Last name" %}</th>
+                                <th>{% trans "First name" %}</th>
+                                <th>{% trans "Email" %}</th>
+                                <th>{% trans "Family" %}</th>
+                                <th>{% trans "Status" %}</th>
+                                <th>{% trans "Fee status" %}</th>
+                                <th>{% trans "Owed" %}</th>
+                                <th>{% trans "Paid" %}</th>
+                                <th>{% trans "License" %}</th>
+                                <th></th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {% for membership in memberships %}
+                                <tr>
+                                    <td><input type="checkbox" class="checkbox membership-row-checkbox" name="membership_ids" value="{{ membership.pk }}"></td>
+                                    <td><a class="link link-hover" href="{% url 'management:member_detail' membership.member.pk %}">{{ membership.member.last_name }}</a></td>
+                                    <td>{{ membership.member.first_name }}</td>
+                                    <td>{{ membership.member.contact_email|default:"-" }}</td>
+                                    <td>
+                                        {% if membership.member.family_memberships_display %}
+                                            {% for fm in membership.member.family_memberships_display %}
+                                                {{ fm.family }} {% if not forloop.last %},{% endif %}
+                                            {% endfor %}
+                                        {% else %}
+                                            <span class="opacity-40">-</span>
+                                        {% endif %}
+                                    </td>
+                                    <td>
+                                        <span class="badge badge-sm
+                                            {% if membership.status == "active" %}badge-success
+                                            {% elif membership.status == "pending" %}badge-warning
+                                            {% elif membership.status == "cancelled" %}badge-error
+                                            {% else %}badge-neutral{% endif %}">
+                                            {{ membership.get_status_display }}
+                                        </span>
+                                    </td>
+                                    <td>
+                                        <span class="badge badge-sm
+                                            {% if membership.fee_status == "paid" %}badge-success
+                                            {% elif membership.fee_status == "partially_paid" %}badge-warning
+                                            {% elif membership.fee_status == "unpaid" %}badge-error
+                                            {% else %}badge-neutral{% endif %}">
+                                            {{ membership.get_fee_status_display }}
+                                        </span>
+                                    </td>
+                                    <td class="tabular-nums">&euro; {{ membership.fee_amount }}</td>
+                                    <td class="tabular-nums">
+                                        &euro; {{ membership.amount_paid }}
+                                        {% if membership.record_payment_form and membership.fee_amount %}
+                                            <div class="text-xs opacity-60">{% blocktrans with remaining=membership.remaining_balance_display %}{{ remaining }} left{% endblocktrans %}</div>
+                                        {% endif %}
+                                    </td>
+                                    <td>{{ membership.license|default:"-" }}</td>
+                                    <td class="text-right">
+                                        {% if membership.record_payment_form %}
+                                            <div class="flex justify-end gap-1">
+                                                <button class="btn btn-outline btn-sm" type="button" onclick="document.getElementById('{{ membership.pk|dom_id:"record_payment_modal" }}').showModal()">
+                                                    {% lucide "receipt" size=12 %} {% trans "Record payment" %}
+                                                </button>
+                                                <button class="btn btn-sm btn-outline btn-success" type="submit" form="{{ membership.pk|dom_id:"mark_fully_paid_form" }}">
+                                                    {% lucide "circle-check" size=12 %} {% trans "Mark fully paid" %}
+                                                </button>
+                                            </div>
+                                        {% endif %}
+                                    </td>
+                                </tr>
+                            {% empty %}
+                                <tr>
+                                    <td colspan="11" class="text-center opacity-60">{% trans "Nobody matches these filters." %}</td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        </div>
+    </form>
+
+    {% trans "Record payment" as record_payment_title %}
+    {% trans "Record" as record_payment_submit_label %}
+    {% for membership in memberships %}
+        {% if membership.record_payment_form %}
+            {# A standalone form, not nested inside the bulk form above -- its submit button lives in the table row and links back here via the form="..." attribute. #}
+            <form method="post" action="{% url 'management:membership_mark_fully_paid' membership.pk %}" id="{{ membership.pk|dom_id:"mark_fully_paid_form" }}">
+                {% csrf_token %}
+                <input type="hidden" name="next" value="{{ request.get_full_path }}">
+            </form>
+            {% url 'management:membership_record_payment' membership.pk as record_payment_url %}
+            {% blocktrans with name=membership.member asvar record_payment_blurb %}For {{ name }}. Any amount is fine -- partial payments accumulate until the fee is settled.{% endblocktrans %}
+            {% include "controlpanel/_modal_form.html" with modal_id=membership.pk|dom_id:"record_payment_modal" title=record_payment_title form=membership.record_payment_form action_url=record_payment_url submit_label=record_payment_submit_label submit_icon="receipt" blurb=record_payment_blurb %}
+        {% endif %}
+    {% endfor %}
+{% endblock panel %}
+
+{% block extra_body %}
+    <script>
+        (() => {
+            const selectAll = document.getElementById("select-all-memberships");
+            const rowCheckboxes = document.querySelectorAll(".membership-row-checkbox");
+            if (!selectAll) return;
+
+            selectAll.addEventListener("change", () => {
+                rowCheckboxes.forEach((checkbox) => { checkbox.checked = selectAll.checked; });
+            });
+        })();
+    </script>
+{% endblock extra_body %}
diff --git a/management/templates/management/membership_list_pdf.html b/management/templates/management/membership_list_pdf.html
new file mode 100644
index 0000000..c746a6c
--- /dev/null
+++ b/management/templates/management/membership_list_pdf.html
@@ -0,0 +1,99 @@
+{% load i18n %}
+
+{% comment %}
+    Rendered by WeasyPrint, not a browser: a standalone document with its own print
+    stylesheet, same convention as billing/templates/billing/invoice.html -- it
+    deliberately doesn't pull in app.css (daisyUI's dark theme/flex layouts mean
+    nothing on paper).
+{% endcomment %}
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <title>{% trans "Memberships" %}</title>
+        <style>
+            @page {
+                size: A4;
+                margin: 18mm;
+                @bottom-center {
+                    content: "{{ club.name }} — {% trans "memberships" %} — " counter(page) " / " counter(pages);
+                    font-size: 8pt;
+                    color: #666;
+                }
+            }
+            body { font-family: sans-serif; font-size: 9.5pt; color: #111; }
+            h1 { font-size: 18pt; margin: 0 0 2mm; }
+            .muted { color: #666; }
+            .header { display: flex; justify-content: space-between; margin-bottom: 8mm; }
+            table { width: 100%; border-collapse: collapse; }
+            th { text-align: left; font-size: 8pt; text-transform: uppercase; letter-spacing: 0.5pt; color: #666; border-bottom: 1px solid #999; padding: 2mm 2mm 1mm 0; }
+            td { padding: 1.5mm 2mm 1.5mm 0; border-bottom: 1px solid #eee; vertical-align: top; }
+            .badge { display: inline-block; padding: 0.5mm 2mm; border-radius: 2mm; font-size: 8pt; }
+            .badge-success { background: #dcfce7; color: #15803d; }
+            .badge-warning { background: #fef3c7; color: #92400e; }
+            .badge-error { background: #fee2e2; color: #b91c1c; }
+            .badge-neutral { background: #e5e7eb; color: #374151; }
+        </style>
+    </head>
+    <body>
+        <div class="header">
+            <div>
+                <h1>{{ club.name }}</h1>
+                <div class="muted">{% trans "Membership fee status" %}{% if selected_season %} — {{ selected_season }}{% endif %}</div>
+            </div>
+            <div class="muted">
+                {% blocktrans with generated=generated_at|date:"j F Y, H:i" %}Generated {{ generated }}{% endblocktrans %}<br>
+                {% blocktrans count counter=memberships|length %}{{ counter }} member{% plural %}{{ counter }} members{% endblocktrans %}
+            </div>
+        </div>
+
+        <table>
+            <thead>
+                <tr>
+                    <th>{% trans "Last name" %}</th>
+                    <th>{% trans "First name" %}</th>
+                    <th>{% trans "Email" %}</th>
+                    <th>{% trans "Family" %}</th>
+                    <th>{% trans "Status" %}</th>
+                    <th>{% trans "Fee status" %}</th>
+                    <th>{% trans "Owed" %}</th>
+                    <th>{% trans "Paid" %}</th>
+                    <th>{% trans "License" %}</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for membership in memberships %}
+                    <tr>
+                        <td>{{ membership.member.last_name }}</td>
+                        <td>{{ membership.member.first_name }}</td>
+                        <td>{{ membership.member.contact_email|default:"—" }}</td>
+                        <td>
+                            {% for fm in membership.member.family_memberships_display %}{{ fm.family }}{% if not forloop.last %}, {% endif %}{% empty %}—{% endfor %}
+                        </td>
+                        <td>
+                            <span class="badge
+                                {% if membership.status == "active" %}badge-success
+                                {% elif membership.status == "pending" %}badge-warning
+                                {% elif membership.status == "cancelled" %}badge-error
+                                {% else %}badge-neutral{% endif %}">{{ membership.get_status_display }}</span>
+                        </td>
+                        <td>
+                            <span class="badge
+                                {% if membership.fee_status == "paid" %}badge-success
+                                {% elif membership.fee_status == "partially_paid" %}badge-warning
+                                {% elif membership.fee_status == "unpaid" %}badge-error
+                                {% else %}badge-neutral{% endif %}">{{ membership.get_fee_status_display }}</span>
+                        </td>
+                        <td>{{ membership.fee_amount }}</td>
+                        <td>{{ membership.amount_paid }}</td>
+                        <td>{{ membership.license|default:"—" }}</td>
+                    </tr>
+                {% empty %}
+                    <tr>
+                        <td colspan="9" class="muted">{% trans "Nobody matches these filters." %}</td>
+                    </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </body>
+</html>
diff --git a/management/templates/management/news_detail.html b/management/templates/management/news_detail.html
new file mode 100644
index 0000000..704b1e1
--- /dev/null
+++ b/management/templates/management/news_detail.html
@@ -0,0 +1,109 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{{ news_item.title }}{% endblock heading %}
+{% block subheading %}
+    {% if news_item.status == "draft" %}
+        {% trans "Draft" %}
+    {% elif news_item.is_scheduled %}
+        {% blocktrans with date=news_item.published_at %}Scheduled for {{ date }}{% endblocktrans %}
+    {% else %}
+        {% blocktrans with date=news_item.published_at %}Published {{ date }}{% endblocktrans %}
+    {% endif %}
+    · {{ news_item.get_visibility_display }}
+{% endblock subheading %}
+
+{% block actions %}
+    {% if can_edit %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:news_update' news_item.pk %}">{% lucide "pencil" size=16 %} {% trans "Edit" %}</a>
+        <button class="btn btn-outline btn-error gap-2" type="button" onclick="document.getElementById('delete_news_modal').showModal()">{% lucide "trash-2" size=16 %} {% trans "Delete" %}</button>
+    {% endif %}
+    {% if can_publish %}
+        {% if news_item.status == "draft" %}
+            <button class="btn btn-primary gap-2" type="button" onclick="document.getElementById('publish_modal').showModal()">{% lucide "upload" size=16 %} {% trans "Publish" %}</button>
+        {% else %}
+            <button class="btn btn-outline btn-warning gap-2" type="button" onclick="document.getElementById('unpublish_modal').showModal()">{% lucide "eye-off" size=16 %} {% trans "Unpublish" %}</button>
+        {% endif %}
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            {% if news_item.teams.all %}
+                <div class="flex flex-wrap gap-2 mb-2">
+                    {% for team in news_item.teams.all %}
+                        <span class="badge badge-neutral">{{ team.short_name }}</span>
+                    {% endfor %}
+                </div>
+            {% endif %}
+            <p class="whitespace-pre-line">{{ news_item.body }}</p>
+        </div>
+    </div>
+
+    <div class="card bg-base-100 shadow mt-4">
+        <div class="card-body">
+            <div class="flex items-center justify-between">
+                <h2 class="card-title text-base">{% trans "Photos" %}</h2>
+                {% if can_edit %}
+                    <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('add_photos_modal').showModal()">{% lucide "image-plus" size=14 %} {% trans "Add photos" %}</button>
+                {% endif %}
+            </div>
+
+            <div class="grid grid-cols-2 md:grid-cols-4 gap-4 mt-2">
+                {% for photo in news_item.photos.all %}
+                    <div class="relative">
+                        <img class="rounded-box aspect-square object-cover w-full" src="{{ photo.image.url }}" alt="">
+                        {% if photo.is_main %}
+                            <span class="badge badge-success badge-sm absolute top-1 left-1">{% trans "Main" %}</span>
+                        {% endif %}
+                        {% if can_edit %}
+                            <div class="flex gap-1 mt-1">
+                                {% if not photo.is_main %}
+                                    <form method="post" action="{% url 'management:news_photo_set_main' news_item.pk photo.pk %}">
+                                        {% csrf_token %}
+                                        <button class="btn btn-outline btn-xs gap-1" type="submit">{% lucide "star" size=12 %} {% trans "Set main" %}</button>
+                                    </form>
+                                {% endif %}
+                                <button class="btn btn-outline btn-error btn-xs gap-1" type="button" onclick="document.getElementById('{{ photo.pk|dom_id:"delete_photo_modal" }}').showModal()">{% lucide "trash-2" size=12 %} {% trans "Delete" %}</button>
+                            </div>
+                            {% url 'management:news_photo_delete' news_item.pk photo.pk as delete_photo_url %}
+                            {% trans "Delete photo" as delete_photo_title %}
+                            {% trans "This photo will be permanently removed." as delete_photo_body %}
+                            {% trans "Delete" as delete_label %}
+                            {% include "controlpanel/_confirm_modal.html" with modal_id=photo.pk|dom_id:"delete_photo_modal" title=delete_photo_title body=delete_photo_body action_url=delete_photo_url submit_label=delete_label submit_icon="trash-2" %}
+                        {% endif %}
+                    </div>
+                {% empty %}
+                    <p class="opacity-60 col-span-full">{% trans "No photos yet." %}</p>
+                {% endfor %}
+            </div>
+        </div>
+    </div>
+
+    {% if can_edit %}
+        {% trans "Add photos" as add_photos_label %}
+        {% url 'management:news_photo_upload' news_item.pk as add_photos_url %}
+        {% include "controlpanel/_modal_form.html" with modal_id="add_photos_modal" title=add_photos_label form=photo_upload_form action_url=add_photos_url submit_label=add_photos_label submit_icon="image-plus" %}
+
+        {% trans "Delete news item" as delete_news_title %}
+        {% blocktrans asvar delete_news_body %}Delete “{{ news_item }}”? Its photos go with it. This cannot be undone.{% endblocktrans %}
+        {% trans "Delete" as delete_label %}
+        {% url 'management:news_delete' news_item.pk as delete_news_url %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id="delete_news_modal" title=delete_news_title body=delete_news_body action_url=delete_news_url submit_label=delete_label %}
+    {% endif %}
+
+    {% if can_publish %}
+        {% if news_item.status == "draft" %}
+            {% trans "Publish" as publish_label %}
+            {% url 'management:news_publish' news_item.pk as publish_url %}
+            {% trans "Leave as now to publish immediately, or pick a future date/time to schedule it." as publish_blurb %}
+            {% include "controlpanel/_modal_form.html" with modal_id="publish_modal" title=publish_label form=publish_form action_url=publish_url submit_label=publish_label submit_icon="upload" blurb=publish_blurb %}
+        {% else %}
+            {% trans "Unpublish" as unpublish_label %}
+            {% blocktrans asvar unpublish_body %}This pulls “{{ news_item }}” back to a draft. It won't be visible anywhere until it's published again.{% endblocktrans %}
+            {% url 'management:news_unpublish' news_item.pk as unpublish_url %}
+            {% include "controlpanel/_confirm_modal.html" with modal_id="unpublish_modal" title=unpublish_label body=unpublish_body action_url=unpublish_url submit_label=unpublish_label submit_icon="eye-off" %}
+        {% endif %}
+    {% endif %}
+{% endblock panel %}
diff --git a/management/templates/management/news_form.html b/management/templates/management/news_form.html
new file mode 100644
index 0000000..9065068
--- /dev/null
+++ b/management/templates/management/news_form.html
@@ -0,0 +1,39 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New news item" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                {% if not update_view %}
+                    <p class="opacity-70 text-sm mb-2">{% trans "Photos can be added once the news item is created." %}</p>
+                {% endif %}
+
+                <div class="grid grid-cols-1 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "management:news_detail" object.pk %}{% else %}{% url "management:news_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+{% endblock extra_body %}
diff --git a/management/templates/management/news_list.html b/management/templates/management/news_list.html
new file mode 100644
index 0000000..75e8a81
--- /dev/null
+++ b/management/templates/management/news_list.html
@@ -0,0 +1,76 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "News" %}{% endblock heading %}
+
+{% block actions %}
+    {% if can_add_news %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:news_create' %}">{% lucide "plus" size=16 %} {% trans "New news item" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Title" %}</th>
+                            <th>{% trans "Teams" %}</th>
+                            <th>{% trans "Visibility" %}</th>
+                            <th>{% trans "Status" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for news_item in news_items %}
+                            <tr>
+                                <td><a class="link link-hover" href="{% url 'management:news_detail' news_item.pk %}">{{ news_item.title }}</a></td>
+                                <td>
+                                    {% for team in news_item.teams.all %}
+                                        <span class="badge badge-neutral badge-sm">{{ team.short_name }}</span>
+                                    {% empty %}
+                                        <span class="opacity-60">{% trans "Club-wide" %}</span>
+                                    {% endfor %}
+                                </td>
+                                <td>{{ news_item.get_visibility_display }}</td>
+                                <td>
+                                    {% if news_item.status == "draft" %}
+                                        <span class="badge badge-neutral badge-sm">{% trans "Draft" %}</span>
+                                    {% elif news_item.is_scheduled %}
+                                        <span class="badge badge-warning badge-sm">{% blocktrans with date=news_item.published_at %}Scheduled for {{ date }}{% endblocktrans %}</span>
+                                    {% else %}
+                                        <span class="badge badge-success badge-sm">{% trans "Published" %}</span>
+                                    {% endif %}
+                                </td>
+                                <td class="text-right">
+                                    {% if news_item.can_edit %}
+                                        <div class="flex justify-end gap-1">
+                                            <a class="btn btn-outline btn-sm" href="{% url 'management:news_detail' news_item.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                            <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ news_item.pk|dom_id:"news_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                        </div>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">{% trans "No news items yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% trans "Delete news item" as delete_news_title %}
+    {% trans "Delete" as delete_label %}
+    {% for news_item in news_items %}
+        {% if news_item.can_edit %}
+            {% url 'management:news_delete' news_item.pk as news_delete_url %}
+            {% blocktrans with title=news_item.title asvar delete_news_body %}Delete “{{ title }}”? Its photos go with it. This cannot be undone.{% endblocktrans %}
+            {% include "controlpanel/_confirm_modal.html" with modal_id=news_item.pk|dom_id:"news_delete_modal" title=delete_news_title body=delete_news_body action_url=news_delete_url submit_label=delete_label %}
+        {% endif %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/management/templates/management/opponent_form.html b/management/templates/management/opponent_form.html
new file mode 100644
index 0000000..215f36a
--- /dev/null
+++ b/management/templates/management/opponent_form.html
@@ -0,0 +1,31 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New opponent" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post" enctype="multipart/form-data">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url "management:opponent_list" %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/opponent_list.html b/management/templates/management/opponent_list.html
new file mode 100644
index 0000000..e1480d2
--- /dev/null
+++ b/management/templates/management/opponent_list.html
@@ -0,0 +1,56 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Opponents" %}{% endblock heading %}
+
+{% block actions %}
+    <a class="btn btn-primary gap-2" href="{% url 'management:opponent_create' %}">{% lucide "plus" size=16 %} {% trans "New opponent" %}</a>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th></th>
+                            <th>{% trans "Name" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for opponent in opponents %}
+                            <tr>
+                                <td>
+                                    {% if opponent.logo %}
+                                        <img src="{{ opponent.logo.url }}" alt="" class="size-8 rounded object-contain">
+                                    {% endif %}
+                                </td>
+                                <td>{{ opponent.name }}</td>
+                                <td class="text-right">
+                                    <div class="flex justify-end gap-1">
+                                        <a class="btn btn-outline btn-sm" href="{% url 'management:opponent_update' opponent.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                        <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ opponent.pk|dom_id:"opponent_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                    </div>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="3" class="text-center opacity-60">{% trans "No opponents yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% trans "Delete opponent" as delete_opponent_title %}
+    {% trans "Delete" as delete_label %}
+    {% for opponent in opponents %}
+        {% url 'management:opponent_delete' opponent.pk as opponent_delete_url %}
+        {% blocktrans with name=opponent.name asvar delete_opponent_body %}Delete “{{ name }}”? Any events against this opponent keep their history but lose the link. This cannot be undone.{% endblocktrans %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id=opponent.pk|dom_id:"opponent_delete_modal" title=delete_opponent_title body=delete_opponent_body action_url=opponent_delete_url submit_label=delete_label %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/management/templates/management/position_form.html b/management/templates/management/position_form.html
new file mode 100644
index 0000000..709c405
--- /dev/null
+++ b/management/templates/management/position_form.html
@@ -0,0 +1,38 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New position" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.name %}
+                    {% form_field form.short_name %}
+                    {% form_field form.ordering %}
+                </div>
+
+                <div class="divider"></div>
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% form_field form.staff_position %}
+                    {% form_field form.management_position %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url "management:position_list" %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/position_list.html b/management/templates/management/position_list.html
new file mode 100644
index 0000000..99ec28e
--- /dev/null
+++ b/management/templates/management/position_list.html
@@ -0,0 +1,59 @@
+{% extends "management/base.html" %}
+{% load i18n lucide %}
+
+{% block heading %}{% trans "Positions" %}{% endblock heading %}
+
+{% block actions %}
+    {% if is_club_admin %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:position_create' %}">{% lucide "plus" size=16 %} {% trans "New position" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Ordering" %}</th>
+                            <th>{% trans "Name" %}</th>
+                            <th>{% trans "Short name" %}</th>
+                            <th>{% trans "Staff position" %}</th>
+                            <th>{% trans "Management position" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for position in positions %}
+                            <tr>
+                                <td>{{ position.ordering }}</td>
+                                <td>{{ position.name }}</td>
+                                <td>{{ position.short_name }}</td>
+                                <td>
+                                    <span class="badge badge-sm {% if position.staff_position %}badge-success{% else %}badge-neutral{% endif %}">
+                                        {% if position.staff_position %}{% trans "Yes" %}{% else %}{% trans "No" %}{% endif %}
+                                    </span>
+                                </td>
+                                <td>
+                                    <span class="badge badge-sm {% if position.management_position %}badge-success{% else %}badge-neutral{% endif %}">
+                                        {% if position.management_position %}{% trans "Yes" %}{% else %}{% trans "No" %}{% endif %}
+                                    </span>
+                                </td>
+                                <td class="text-right">
+                                    {% if is_club_admin %}
+                                        <a class="btn btn-outline btn-sm gap-2" href="{% url 'management:position_update' position.pk %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="6" class="text-center opacity-60">{% trans "No positions yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/rbihf_import_form.html b/management/templates/management/rbihf_import_form.html
new file mode 100644
index 0000000..df39c57
--- /dev/null
+++ b/management/templates/management/rbihf_import_form.html
@@ -0,0 +1,35 @@
+{% extends "management/base.html" %}
+{% load lucide ui i18n %}
+
+{% block heading %}{% trans "Import from RBIHF" %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <p class="text-sm opacity-70">
+                {% blocktrans %}Paste the URL of a team's page on the RBIHF website and pick which of
+                your teams it's for. Nothing is created yet: you'll see exactly what will
+                be added, changed, or removed before anything is saved.{% endblocktrans %}
+            </p>
+
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                {% for field in form %}
+                    {% form_field field %}
+                {% endfor %}
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url 'management:event_list' %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "download" size=16 %} {% trans "Fetch and preview" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/rbihf_import_preview.html b/management/templates/management/rbihf_import_preview.html
new file mode 100644
index 0000000..f6c7cf4
--- /dev/null
+++ b/management/templates/management/rbihf_import_preview.html
@@ -0,0 +1,152 @@
+{% extends "management/base.html" %}
+{% load lucide i18n %}
+
+{% block heading %}{% trans "Review import" %}{% endblock heading %}
+
+{% block panel %}
+    <div class="alert alert-info mb-4">
+        {% lucide "info" size=16 %}
+        <span>{% blocktrans with scraped=plan.scraped_team_name team=plan.team %}Importing fixtures for “{{ scraped }}” onto your team “{{ team }}”. Double check that's the right match before confirming.{% endblocktrans %}</span>
+    </div>
+
+    <form method="post" action="{% url 'management:rbihf_import_confirm' %}">
+        {% csrf_token %}
+
+        <div class="card bg-base-100 shadow mb-4">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "plus" size=18 %} {% blocktrans count counter=plan.to_create|length %}{{ counter }} game to create{% plural %}{{ counter }} games to create{% endblocktrans %}</h2>
+
+                {% if plan.to_create %}
+                    <div class="overflow-x-auto">
+                        <table class="table">
+                            <thead>
+                                <tr>
+                                    <th>{% trans "#" %}</th>
+                                    <th>{% trans "Start" %}</th>
+                                    <th>{% trans "Opponent" %}</th>
+                                    <th>{% trans "Location" %}</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {% for planned in plan.to_create %}
+                                    <tr>
+                                        <td>{{ planned.fixture.external_game_id }}</td>
+                                        <td>{{ planned.fixture.start|date:"Y-m-d H:i" }}</td>
+                                        <td>
+                                            <div class="flex items-center gap-2">
+                                                <select name="opponent_{{ planned.fixture.external_game_id }}" class="select select-sm w-full">
+                                                    <option value="">{% trans "Use scraped name" %}</option>
+                                                    {% for opponent in plan.opponent_choices %}
+                                                        <option value="{{ opponent.pk }}" {% if planned.suggested_opponent.pk == opponent.pk %}selected{% endif %}>{{ opponent.name }}</option>
+                                                    {% endfor %}
+                                                </select>
+                                                <span class="text-xs opacity-60 whitespace-nowrap">{% blocktrans with opponent=planned.fixture.opponent_name %}RBIHF: {{ opponent }}{% endblocktrans %}</span>
+                                            </div>
+                                        </td>
+                                        <td>
+                                            <div class="flex items-center gap-2">
+                                                <select name="location_{{ planned.fixture.external_game_id }}" class="select select-sm w-full">
+                                                    <option value="">&mdash;</option>
+                                                    {% for location in plan.location_choices %}
+                                                        <option value="{{ location.pk }}" {% if planned.suggested_location.pk == location.pk %}selected{% endif %}>{{ location.name }}</option>
+                                                    {% endfor %}
+                                                </select>
+                                                <span class="text-xs opacity-60 whitespace-nowrap">{% blocktrans with venue=planned.fixture.venue_text %}RBIHF: {{ venue }}{% endblocktrans %}</span>
+                                            </div>
+                                        </td>
+                                    </tr>
+                                {% endfor %}
+                            </tbody>
+                        </table>
+                    </div>
+                {% endif %}
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow mb-4">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "refresh-cw" size=18 %} {% blocktrans count counter=plan.to_update|length %}{{ counter }} game to update{% plural %}{{ counter }} games to update{% endblocktrans %}</h2>
+
+                {% if plan.to_update %}
+                    <div class="overflow-x-auto">
+                        <table class="table">
+                            <thead>
+                                <tr>
+                                    <th>{% trans "#" %}</th>
+                                    <th>{% trans "Changes" %}</th>
+                                    <th>{% trans "Opponent" %}</th>
+                                    <th>{% trans "Location" %}</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {% for planned in plan.to_update %}
+                                    <tr>
+                                        <td>{{ planned.fixture.external_game_id }}</td>
+                                        <td>
+                                            {% for field, change in planned.changes.items %}
+                                                <div class="text-xs">
+                                                    <span class="font-semibold">{{ field }}:</span>
+                                                    <span class="opacity-60 line-through">{{ change.0|default:"—" }}</span>
+                                                    &rarr;
+                                                    <span>{{ change.1 }}</span>
+                                                </div>
+                                            {% endfor %}
+                                        </td>
+                                        <td>
+                                            <div class="flex items-center gap-2">
+                                                <select name="opponent_{{ planned.fixture.external_game_id }}" class="select select-sm w-full">
+                                                    <option value="">{% trans "Use scraped name" %}</option>
+                                                    {% for opponent in plan.opponent_choices %}
+                                                        <option value="{{ opponent.pk }}" {% if planned.suggested_opponent.pk == opponent.pk %}selected{% endif %}>{{ opponent.name }}</option>
+                                                    {% endfor %}
+                                                </select>
+                                                <span class="text-xs opacity-60 whitespace-nowrap">{% blocktrans with opponent=planned.fixture.opponent_name %}RBIHF: {{ opponent }}{% endblocktrans %}</span>
+                                            </div>
+                                        </td>
+                                        <td>
+                                            <div class="flex items-center gap-2">
+                                                <select name="location_{{ planned.fixture.external_game_id }}" class="select select-sm w-full">
+                                                    <option value="">&mdash;</option>
+                                                    {% for location in plan.location_choices %}
+                                                        <option value="{{ location.pk }}" {% if planned.suggested_location.pk == location.pk %}selected{% endif %}>{{ location.name }}</option>
+                                                    {% endfor %}
+                                                </select>
+                                                <span class="text-xs opacity-60 whitespace-nowrap">{% blocktrans with venue=planned.fixture.venue_text %}RBIHF: {{ venue }}{% endblocktrans %}</span>
+                                            </div>
+                                        </td>
+                                    </tr>
+                                {% endfor %}
+                            </tbody>
+                        </table>
+                    </div>
+                {% endif %}
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow mb-4">
+            <div class="card-body">
+                <h2 class="card-title text-base">{% lucide "trash-2" size=18 %} {% blocktrans count counter=plan.to_delete|length %}{{ counter }} game to delete{% plural %}{{ counter }} games to delete{% endblocktrans %}</h2>
+                <p class="text-sm opacity-70">{% trans "No longer listed on the RBIHF page — only upcoming games are ever removed this way, past results are left alone." %}</p>
+
+                {% if plan.to_delete %}
+                    <ul class="list-disc list-inside text-sm">
+                        {% for event in plan.to_delete %}
+                            <li>{{ event.start|date:"Y-m-d H:i" }} &mdash; {{ event }}</li>
+                        {% endfor %}
+                    </ul>
+                {% endif %}
+            </div>
+        </div>
+
+        {% if plan.unchanged_count %}
+            <p class="text-sm opacity-60 mb-4">{% blocktrans count counter=plan.unchanged_count %}{{ counter }} game is already up to date.{% plural %}{{ counter }} games are already up to date.{% endblocktrans %}</p>
+        {% endif %}
+
+        <div class="card-actions justify-start pt-2 mt-2">
+            <a class="btn btn-outline gap-2" href="{% url 'management:rbihf_import' %}">{% lucide "arrow-left" size=16 %} {% trans "Back" %}</a>
+            {% if plan.to_create or plan.to_update or plan.to_delete %}
+                <button class="btn btn-primary gap-2" type="submit">{% lucide "check" size=16 %} {% trans "Confirm import" %}</button>
+            {% endif %}
+        </div>
+    </form>
+{% endblock panel %}
diff --git a/management/templates/management/role_list.html b/management/templates/management/role_list.html
new file mode 100644
index 0000000..88092e3
--- /dev/null
+++ b/management/templates/management/role_list.html
@@ -0,0 +1,66 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static %}
+
+{% comment %}
+    One section per non-MEMBER role (management.views.ClubRoleListView) -- the
+    plain MEMBER role every active club member holds automatically is excluded
+    entirely, since listing it here would just be noise. "Grant role" opens a
+    modal (controlpanel/_modal_form.html) rather than a separate page -- role_create
+    is POST-only, see ClubRoleCreateView.
+{% endcomment %}
+
+{% block heading %}{% trans "Roles" %}{% endblock heading %}
+
+{% block actions %}
+    <button class="btn btn-outline gap-2" type="button" onclick="document.getElementById('grant_role_modal').showModal()">{% lucide "plus" size=16 %} {% trans "Grant role" %}</button>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="flex flex-col gap-4">
+        {% for value, label, description, roles_for_section in sections %}
+            {% with role_label=label|capfirst %}
+                <div class="card bg-base-100 shadow">
+                    <div class="card-body">
+                        <h2 class="card-title text-base">{{ role_label }}</h2>
+                        {% if description %}<p class="text-sm opacity-70">{{ description }}</p>{% endif %}
+                        <div class="overflow-x-auto">
+                            <table class="table">
+                                <thead>
+                                    <tr>
+                                        <th>{% trans "Member" %}</th>
+                                        <th></th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    {% for role in roles_for_section %}
+                                        <tr>
+                                            <td>{{ role.member }}</td>
+                                            <td class="text-right">
+                                                <form method="post" action="{% url 'management:role_revoke' role.pk %}">
+                                                    {% csrf_token %}
+                                                    <button class="btn btn-outline btn-error btn-sm gap-2" type="submit">{% lucide "x" size=14 %} {% trans "Revoke" %}</button>
+                                                </form>
+                                            </td>
+                                        </tr>
+                                    {% empty %}
+                                        <tr>
+                                            <td colspan="2" class="text-center opacity-60">{% blocktrans %}No one has the {{ role_label }} role yet.{% endblocktrans %}</td>
+                                        </tr>
+                                    {% endfor %}
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </div>
+            {% endwith %}
+        {% endfor %}
+    </div>
+
+    {% trans "Grant role" as grant_role_label %}
+    {% url 'management:role_create' as role_create_url %}
+    {% include "controlpanel/_modal_form.html" with modal_id="grant_role_modal" title=grant_role_label form=role_form action_url=role_create_url submit_label=grant_role_label submit_icon="shield-check" %}
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+{% endblock extra_body %}
diff --git a/management/templates/management/sponsor_form.html b/management/templates/management/sponsor_form.html
new file mode 100644
index 0000000..cb1d4e7
--- /dev/null
+++ b/management/templates/management/sponsor_form.html
@@ -0,0 +1,31 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New sponsor" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post" enctype="multipart/form-data">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% url "management:sponsor_list" %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/sponsor_list.html b/management/templates/management/sponsor_list.html
new file mode 100644
index 0000000..9940fc3
--- /dev/null
+++ b/management/templates/management/sponsor_list.html
@@ -0,0 +1,68 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Sponsors" %}{% endblock heading %}
+
+{% block actions %}
+    <a class="btn btn-primary gap-2" href="{% url 'management:sponsor_create' %}">{% lucide "plus" size=16 %} {% trans "New sponsor" %}</a>
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th></th>
+                            <th>{% trans "Name" %}</th>
+                            <th>{% trans "URL" %}</th>
+                            <th>{% trans "Start date" %}</th>
+                            <th>{% trans "End date" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for sponsor in sponsors %}
+                            <tr>
+                                <td>
+                                    {% if sponsor.logo %}
+                                        <img src="{{ sponsor.logo.url }}" alt="" class="size-8 rounded object-contain">
+                                    {% endif %}
+                                </td>
+                                <td>{{ sponsor.name }}</td>
+                                <td>
+                                    {% if sponsor.url %}
+                                        <a class="link link-hover" href="{{ sponsor.url }}" target="_blank" rel="noopener noreferrer">{{ sponsor.url }}</a>
+                                    {% else %}
+                                        <span class="opacity-50">&mdash;</span>
+                                    {% endif %}
+                                </td>
+                                <td>{{ sponsor.start_date|date:"Y-m-d" }}</td>
+                                <td>{{ sponsor.end_date|date:"Y-m-d"|default:"—" }}</td>
+                                <td class="text-right">
+                                    <div class="flex justify-end gap-1">
+                                        <a class="btn btn-outline btn-sm" href="{% url 'management:sponsor_update' sponsor.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                        <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ sponsor.pk|dom_id:"sponsor_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                    </div>
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="6" class="text-center opacity-60">{% trans "No sponsors yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% trans "Delete sponsor" as delete_sponsor_title %}
+    {% trans "Delete" as delete_label %}
+    {% for sponsor in sponsors %}
+        {% url 'management:sponsor_delete' sponsor.pk as sponsor_delete_url %}
+        {% blocktrans with name=sponsor.name asvar delete_sponsor_body %}Delete “{{ name }}”? This cannot be undone.{% endblocktrans %}
+        {% include "controlpanel/_confirm_modal.html" with modal_id=sponsor.pk|dom_id:"sponsor_delete_modal" title=delete_sponsor_title body=delete_sponsor_body action_url=sponsor_delete_url submit_label=delete_label %}
+    {% endfor %}
+{% endblock panel %}
diff --git a/management/templates/management/team_detail.html b/management/templates/management/team_detail.html
new file mode 100644
index 0000000..496dd6e
--- /dev/null
+++ b/management/templates/management/team_detail.html
@@ -0,0 +1,306 @@
+{% extends "management/base.html" %}
+{% load i18n lucide static ui %}
+
+{% block heading %}{{ team.name }}{% endblock heading %}
+{% block subheading %}
+    <span class="flex flex-row gap-2 items-center">
+        <span>{{ team.short_name }}</span>
+        <span>&middot;</span>
+        <span class="badge-sm badge badge-outline">{% lucide "bookmark" size=14 %} {{ team.pk }}</span>
+    </span>
+{% endblock subheading %}
+
+{% block actions %}
+    {% if is_club_admin %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:team_update' team.pk %}">{% lucide "pencil" size=16 %} {% trans "Edit" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <form method="get" class="mb-4">
+        <div class="flex flex-row items-center gap-2">
+            <select name="season" class="select select-bordered">
+                {% for season in seasons %}
+                    <option value="{{ season.pk }}" {% if season.pk == selected_season.pk %}selected{% endif %}>{% trans "Season" %} {{ season.start_date|date:"Y" }} - {{ season.end_date|date:"Y" }}</option>
+                {% endfor %}
+            </select>
+            <button class="btn btn-outline gap-2" type="submit">{% lucide "filter" size=16 %} {% trans "View" %}</button>
+        </div>
+    </form>
+
+    {% if not selected_season %}
+        <div class="alert alert-warning mb-6">
+            {% lucide "calendar-x" size=20 %}
+            <span>{% trans "This club has no seasons yet, so there's no roster or staff to show." %}</span>
+        </div>
+    {% else %}
+        {% if can_manage %}
+            {% if team_photo %}
+                {% trans "Replace photo" as photo_modal_title %}
+            {% else %}
+                {% trans "Upload photo" as photo_modal_title %}
+            {% endif %}
+            {% url 'management:team_photo_set' team.pk selected_season.pk as team_photo_set_url %}
+            {% include "controlpanel/_modal_form.html" with modal_id="team_photo_modal" title=photo_modal_title form=team_photo_form action_url=team_photo_set_url submit_label="Save" submit_icon="save" %}
+
+            {% if team_photo %}
+                {% trans "Remove team photo?" as remove_photo_body %}
+                {% trans "Remove photo" as remove_photo_title %}
+                {% url 'management:team_photo_delete' team.pk selected_season.pk as team_photo_delete_url %}
+                {% include "controlpanel/_confirm_modal.html" with modal_id="team_photo_delete_modal" title=remove_photo_title body=remove_photo_body action_url=team_photo_delete_url submit_label="Remove" submit_icon="trash-2" %}
+            {% endif %}
+        {% endif %}
+
+        <div class="mb-4 grid gap-4 lg:grid-cols-3">
+            <div class="card bg-base-100 shadow border-l-4 {% if attendance_rate is None %}border-info{% elif attendance_rate < 30 %}border-error{% elif attendance_rate < 65 %}border-warning{% else %}border-success{% endif %}">
+                <div class="card-body p-4">
+                    <div class="flex items-center gap-2 text-sm opacity-70 mb-3">{% lucide "user-check" size=16 %} {% trans "Attendance rate" %}</div>
+                    <div class="text-4xl font-bold tabular-nums font-mono">
+                        {% if attendance_rate is None %}
+                            {% trans "N/A" %}
+                        {% else %}
+                            {{ attendance_rate }}%
+                        {% endif %}
+                    </div>
+                    <div class="text-xs opacity-60">
+                        {% if attendance_rate is None %}
+                            {% trans "No past events this season" %}
+                        {% else %}
+                            <progress class="progress w-full {% if attendance_rate < 30 %}progress-error{% elif attendance_rate < 65 %}progress-warning{% else %}progress-success{% endif %}" value="{{ attendance_rate }}" max="100"></progress>
+                        {% endif %}
+                    </div>
+                </div>
+            </div>
+
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "trending-up" size=18 %} {% trans "Top attenders" %}</h2>
+                    <ul class="divide-y divide-base-200">
+                        {% for entry in top_attenders %}
+                            <li class="flex items-center justify-between py-2">
+                                <span class="text-sm">{{ entry.member }}</span>
+                                <span class="font-semibold tabular-nums font-mono">{{ entry.rate }}%</span>
+                            </li>
+                        {% empty %}
+                            <li class="py-2 text-center text-sm opacity-60">{% trans "Not enough data yet." %}</li>
+                        {% endfor %}
+                    </ul>
+                </div>
+            </div>
+
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "trending-down" size=18 %} {% trans "Needs attention" %}</h2>
+                    <ul class="divide-y divide-base-200">
+                        {% for entry in bottom_attenders %}
+                            <li class="flex items-center justify-between py-2">
+                                <span class="text-sm">{{ entry.member }}</span>
+                                <span class="font-semibold tabular-nums font-mono">{{ entry.rate }}%</span>
+                            </li>
+                        {% empty %}
+                            <li class="py-2 text-center text-sm opacity-60">{% trans "Not enough data yet." %}</li>
+                        {% endfor %}
+                    </ul>
+                </div>
+            </div>
+        </div>
+
+        <div class="mb-6 grid gap-4 lg:grid-cols-2">
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "alert-triangle" size=18 %} {% trans "Missed the last 2 practices" %}</h2>
+                    <ul class="divide-y divide-base-200">
+                        {% for member in missed_practices %}
+                            <li class="py-2 text-sm">{{ member }}</li>
+                        {% empty %}
+                            <li class="py-2 text-center text-sm opacity-60">{% trans "No one -- or not enough practice history yet." %}</li>
+                        {% endfor %}
+                    </ul>
+                </div>
+            </div>
+
+            <div class="card bg-base-100 shadow">
+                <div class="card-body">
+                    <h2 class="card-title text-base">{% lucide "user-x" size=18 %} {% trans "No-shows" %}</h2>
+                    <!-- <p class="text-sm opacity-70">{% trans "Said they'd attend, but were checked in as absent." %}</p> -->
+                    <div class="overflow-x-auto">
+                        <table class="table">
+                            <tbody>
+                                {% for entry in no_shows %}
+                                    <tr>
+                                        <td>{{ entry.member }}</td>
+                                        <td class="opacity-70">{{ entry.event.title }}</td>
+                                        <td class="whitespace-nowrap text-right opacity-60">{{ entry.event.start|date:"j M" }}</td>
+                                    </tr>
+                                {% empty %}
+                                    <tr>
+                                        <td colspan="3" class="text-center opacity-60">{% trans "None recorded." %}</td>
+                                    </tr>
+                                {% endfor %}
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% trans "Roster" %}</h2>
+                    {% if can_manage %}
+                        <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('add_player_modal').showModal()">{% lucide "user-plus" size=14 %} {% trans "Add player" %}</button>
+                    {% endif %}
+                </div>
+                <div class="overflow-x-auto">
+                    <table class="table">
+                        <thead>
+                            <tr>
+                                <th>{% trans "Member" %}</th>
+                                <th>{% trans "Position" %}</th>
+                                <th>{% trans "Jersey #" %}</th>
+                                <th></th>
+                                <th></th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {% for membership in roster %}
+                                <tr>
+                                    <td>{{ membership.member }}</td>
+                                    <td>{{ membership.position }}</td>
+                                    <td>{{ membership.jersey_number|default:"—" }}</td>
+                                    <td>
+                                        {% if membership.is_captain %}<span class="badge badge-neutral badge-sm">{% trans "Captain" %}</span>{% endif %}
+                                        {% if membership.is_alternate_captain %}<span class="badge badge-neutral badge-sm">{% trans "Alternate captain" %}</span>{% endif %}
+                                    </td>
+                                    <td class="text-right">
+                                        {% if can_manage %}
+                                            <div class="flex justify-end gap-1">
+                                                <button class="btn btn-outline btn-sm" type="button" onclick="document.getElementById('{{ membership.pk|dom_id:"edit_player_modal" }}').showModal()" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</button>
+                                                <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ membership.pk|dom_id:"remove_player_modal" }}').showModal()" aria-label="{% trans 'Remove' %}">{% lucide "user-minus" size=14 %} {% trans "Remove" %}</button>
+                                            </div>
+                                        {% endif %}
+                                    </td>
+                                </tr>
+                            {% empty %}
+                                <tr>
+                                    <td colspan="5" class="text-center opacity-60">{% trans "No one on the roster for this season yet." %}</td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow mt-4">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% trans "Staff" %}</h2>
+                    {% if can_manage %}
+                        <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('add_staff_modal').showModal()">{% lucide "user-plus" size=14 %} {% trans "Assign staff" %}</button>
+                    {% endif %}
+                </div>
+                <div class="overflow-x-auto">
+                    <table class="table">
+                        <thead>
+                            <tr>
+                                <th>{% trans "Member" %}</th>
+                                <th>{% trans "Position" %}</th>
+                                <th></th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {% for assignment in staff %}
+                                <tr>
+                                    <td>{{ assignment.member }}</td>
+                                    <td>{{ assignment.position }}</td>
+                                    <td class="text-right">
+                                        {% if can_manage %}
+                                            <div class="flex justify-end gap-1">
+                                                <button class="btn btn-outline btn-sm" type="button" onclick="document.getElementById('{{ assignment.pk|dom_id:"edit_staff_modal" }}').showModal()" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</button>
+                                                <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ assignment.pk|dom_id:"remove_staff_modal" }}').showModal()" aria-label="{% trans 'Remove' %}">{% lucide "user-minus" size=14 %} {% trans "Remove" %}</button>
+                                            </div>
+                                        {% endif %}
+                                    </td>
+                                </tr>
+                            {% empty %}
+                                <tr>
+                                    <td colspan="3" class="text-center opacity-60">{% trans "No staff assigned for this season yet." %}</td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        </div>
+
+        <div class="card bg-base-100 shadow mt-4">
+            <div class="card-body">
+                <div class="flex items-center justify-between">
+                    <h2 class="card-title text-base">{% trans "Team photo" %}</h2>
+                    {% if can_manage %}
+                    <div class="flex gap-2">
+                        {% trans "Upload photo" as upload_photo_label %}
+                        {% trans "Replace photo" as replace_photo_label %}
+                        <button class="btn btn-outline btn-sm gap-2" type="button" onclick="document.getElementById('team_photo_modal').showModal()">
+                            {% if team_photo %}
+                            {% lucide "pencil" size=14 %} {{ replace_photo_label }}
+                            {% else %}
+                            {% lucide "upload" size=14 %} {{ upload_photo_label }}
+                            {% endif %}
+                        </button>
+                        {% if team_photo %}
+                        <button class="btn btn-outline btn-error btn-sm gap-2" type="button" onclick="document.getElementById('team_photo_delete_modal').showModal()">{% lucide "trash-2" size=14 %} {% trans "Remove" %}</button>
+                        {% endif %}
+                    </div>
+                    {% endif %}
+                </div>
+
+                {% if team_photo %}
+                <img class="mt-2 w-full max-w-md rounded-lg object-cover" src="{{ team_photo.image.url }}" alt="{{ team }}">
+                {% else %}
+                <p class="text-sm opacity-60">{% trans "No photo uploaded for this season yet." %}</p>
+                {% endif %}
+            </div>
+        </div>
+
+        {% if can_manage %}
+            {% trans "Add player" as add_player_label %}
+            {% url 'management:team_roster_add' team.pk selected_season.pk as add_player_url %}
+            {% include "controlpanel/_modal_form.html" with modal_id="add_player_modal" title=add_player_label form=roster_form action_url=add_player_url submit_label=add_player_label submit_icon="user-plus" %}
+
+            {% trans "Assign staff" as add_staff_label %}
+            {% url 'management:team_staff_add' team.pk selected_season.pk as add_staff_url %}
+            {% include "controlpanel/_modal_form.html" with modal_id="add_staff_modal" title=add_staff_label form=staff_form action_url=add_staff_url submit_label=add_staff_label submit_icon="user-plus" %}
+
+            {% trans "Edit player" as edit_player_label %}
+            {% trans "Save" as save_label %}
+            {% for membership in roster %}
+                {% url 'management:team_roster_update' team.pk membership.pk as edit_player_url %}
+                {% include "controlpanel/_modal_form.html" with modal_id=membership.pk|dom_id:"edit_player_modal" title=edit_player_label form=membership.edit_form action_url=edit_player_url submit_label=save_label submit_icon="save" %}
+
+                {% blocktrans asvar remove_player_body with member=membership.member %}Remove {{ member }} from the roster?{% endblocktrans %}
+                {% trans "Remove player" as remove_player_title %}
+                {% trans "Remove" as remove_label %}
+                {% url 'management:team_roster_remove' team.pk membership.pk as remove_player_url %}
+                {% include "controlpanel/_confirm_modal.html" with modal_id=membership.pk|dom_id:"remove_player_modal" title=remove_player_title body=remove_player_body action_url=remove_player_url submit_label=remove_label submit_icon="user-minus" %}
+            {% endfor %}
+
+            {% trans "Edit staff assignment" as edit_staff_label %}
+            {% for assignment in staff %}
+                {% url 'management:team_staff_update' team.pk assignment.pk as edit_staff_url %}
+                {% include "controlpanel/_modal_form.html" with modal_id=assignment.pk|dom_id:"edit_staff_modal" title=edit_staff_label form=assignment.edit_form action_url=edit_staff_url submit_label=save_label submit_icon="save" %}
+
+                {% blocktrans asvar remove_staff_body with member=assignment.member %}Remove {{ member }} from staff?{% endblocktrans %}
+                {% trans "Remove staff" as remove_staff_title %}
+                {% url 'management:team_staff_remove' team.pk assignment.pk as remove_staff_url %}
+                {% include "controlpanel/_confirm_modal.html" with modal_id=assignment.pk|dom_id:"remove_staff_modal" title=remove_staff_title body=remove_staff_body action_url=remove_staff_url submit_label=remove_label submit_icon="user-minus" %}
+            {% endfor %}
+        {% endif %}
+    {% endif %}
+{% endblock panel %}
+
+{% block extra_body %}
+    <script src="{% static 'js/searchable-select.js' %}"></script>
+{% endblock extra_body %}
diff --git a/management/templates/management/team_form.html b/management/templates/management/team_form.html
new file mode 100644
index 0000000..c25cc3c
--- /dev/null
+++ b/management/templates/management/team_form.html
@@ -0,0 +1,31 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% if update_view %}{% blocktrans %}Edit {{ object }}{% endblocktrans %}{% else %}{% trans "New team" %}{% endif %}{% endblock heading %}
+
+{% block panel %}
+    <div class="card w-full bg-base-100 shadow">
+        <div class="card-body">
+            <form method="post">
+                {% csrf_token %}
+
+                {% for error in form.non_field_errors %}
+                    <div class="alert alert-error my-2">
+                        <span>{{ error }}</span>
+                    </div>
+                {% endfor %}
+
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                    {% for field in form %}
+                        {% form_field field %}
+                    {% endfor %}
+                </div>
+
+                <div class="card-actions justify-start pt-2 mt-2">
+                    <a class="btn btn-outline gap-2" href="{% if update_view %}{% url "management:team_detail" object.pk %}{% else %}{% url "management:team_list" %}{% endif %}">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+                    <button class="btn btn-primary gap-2" type="submit">{% lucide "save" size=16 %} {% trans "Save" %}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+{% endblock panel %}
diff --git a/management/templates/management/team_list.html b/management/templates/management/team_list.html
new file mode 100644
index 0000000..703d49e
--- /dev/null
+++ b/management/templates/management/team_list.html
@@ -0,0 +1,62 @@
+{% extends "management/base.html" %}
+{% load i18n lucide ui %}
+
+{% block heading %}{% trans "Teams" %}{% endblock heading %}
+
+{% block actions %}
+    {% if is_club_admin %}
+        <a class="btn btn-outline gap-2" href="{% url 'management:team_create' %}">{% lucide "plus" size=16 %} {% trans "New team" %}</a>
+    {% endif %}
+{% endblock actions %}
+
+{% block panel %}
+    <div class="card bg-base-100 shadow">
+        <div class="card-body">
+            <div class="overflow-x-auto">
+                <table class="table">
+                    <thead>
+                        <tr>
+                            <th>{% trans "Name" %}</th>
+                            <th>{% trans "Short name" %}</th>
+                            <th>{% trans "Players" %}</th>
+                            <th>{% trans "Staff" %}</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% for team in teams %}
+                            <tr>
+                                <td><a class="link link-hover" href="{% url 'management:team_detail' team.pk %}">{{ team.name }}</a></td>
+                                <td>{{ team.short_name }}</td>
+                                <td>{{ team.player_count }}</td>
+                                <td>{{ team.staff_count }}</td>
+                                <td class="text-right">
+                                    {% if is_club_admin %}
+                                        <div class="flex justify-end gap-1">
+                                            <a class="btn btn-outline btn-sm" href="{% url 'management:team_detail' team.pk %}" aria-label="{% trans 'Edit' %}">{% lucide "pencil" size=14 %} {% trans "Edit" %}</a>
+                                            <button class="btn btn-sm btn-outline btn-error" type="button" onclick="document.getElementById('{{ team.pk|dom_id:"team_delete_modal" }}').showModal()" aria-label="{% trans 'Delete' %}">{% lucide "trash-2" size=14 %} {% trans "Delete" %}</button>
+                                        </div>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% empty %}
+                            <tr>
+                                <td colspan="5" class="text-center opacity-60">{% trans "No teams yet." %}</td>
+                            </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    {% if is_club_admin %}
+        {% trans "Delete team" as delete_team_title %}
+        {% trans "Delete" as delete_label %}
+        {% for team in teams %}
+            {% url 'management:team_delete' team.pk as team_delete_url %}
+            {% blocktrans with name=team.name asvar delete_team_body %}Delete “{{ name }}”? This also removes its roster and staff assignments. This cannot be undone.{% endblocktrans %}
+            {% include "controlpanel/_confirm_modal.html" with modal_id=team.pk|dom_id:"team_delete_modal" title=delete_team_title body=delete_team_body action_url=team_delete_url submit_label=delete_label %}
+        {% endfor %}
+    {% endif %}
+{% endblock panel %}
diff --git a/management/tests.py b/management/tests.py
new file mode 100644
index 0000000..493cbc1
--- /dev/null
+++ b/management/tests.py
@@ -0,0 +1,3601 @@
+import datetime
+import os
+import sys
+from decimal import Decimal
+from io import BytesIO
+from unittest import mock
+
+import openpyxl
+from allauth.mfa.models import Authenticator
+from django.contrib.auth import get_user_model
+from django.core.cache import cache
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.test import TestCase, override_settings
+from django.urls import NoReverseMatch, reverse
+from django.utils import timezone
+from waffle import get_waffle_flag_model
+
+from billing.models import Tier, TierPrice
+from billing.services.dues import subscribe
+from club.models import Club, ClubMembership, ClubRole, FeePayment, Season, Sponsor
+from events.models import Attendance, Competition, Event, EventSeries, Location, Opponent
+from events.services.rbihf_import import RBIHFImportError
+from events.services.recurrence import detach_occurrence, generate_occurrences
+from management.bulk_import import TEMPLATE_COLUMNS
+from management.pdf import PDFExportError, render_pdf
+from management.recurrence_ui import build_rrule, describe_rrule, parse_rrule
+from members.models import Family, FamilyMembership, Member
+from news.models import News, NewsPhoto
+from shop.models import Order
+from teams.models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+User = get_user_model()
+
+XLSX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+
+
+def make_import_workbook(rows):
+    """An in-memory .xlsx upload -- header matching the real template, plus
+    whatever data rows a test wants to exercise."""
+    workbook = openpyxl.Workbook()
+    sheet = workbook.active
+    sheet.append(TEMPLATE_COLUMNS)
+    for row in rows:
+        sheet.append(row)
+
+    buffer = BytesIO()
+    workbook.save(buffer)
+    buffer.seek(0)
+    return SimpleUploadedFile("members.xlsx", buffer.read(), content_type=XLSX_CONTENT_TYPE)
+
+
+def enrol_mfa(user):
+    return Authenticator.objects.create(user=user, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+
+
+def make_season(club):
+    # Must genuinely cover *today*: current_season()/teams_staffed_by() key off
+    # Season.covering(club, timezone.localdate()), not just any season row.
+    today = timezone.localdate()
+    return Season.objects.create(club=club, start_date=today - datetime.timedelta(days=30), end_date=today + datetime.timedelta(days=300))
+
+
+@override_settings(
+    ROSTERCHIEF_BASE_DOMAIN="rosterchief.app",
+    ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "rival-fc.rosterchief.app", "testserver"],
+)
+class ManagementTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.season = make_season(self.club)
+
+        self.admin_user = User.objects.create_user(email="admin@example.com", password="pw-secret-123")
+        self.admin_member = Member.objects.create(user=self.admin_user, first_name="Ada", last_name="Admin")
+        ClubMembership.objects.create(club=self.club, member=self.admin_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        ClubRole.objects.filter(club=self.club, member=self.admin_member).update(role=ClubRole.Roles.ADMIN)
+        enrol_mfa(self.admin_user)
+
+    def club_get(self, name, *args):
+        return self.client.get(reverse(f"management:{name}", args=args), HTTP_HOST="ajax-united.rosterchief.app")
+
+    def club_post(self, name, data, *args):
+        return self.client.post(reverse(f"management:{name}", args=args), data, HTTP_HOST="ajax-united.rosterchief.app")
+
+
+class AccessTests(ManagementTestBase):
+    def test_anonymous_is_sent_to_login(self):
+        response = self.club_get("home")
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(reverse("account_login"), response.url)
+
+    def test_a_club_member_with_no_role_or_staff_assignment_gets_403(self):
+        plain_user = User.objects.create_user(email="plain@example.com", password="pw-secret-123")
+        self.client.force_login(plain_user)
+
+        self.assertEqual(self.club_get("home").status_code, 403)
+
+    def test_a_plain_active_club_member_gets_403(self):
+        # An active ClubMembership auto-grants a MEMBER ClubRole (club/signals.py) --
+        # every signed-up player has one. That alone must not be enough to get in, or
+        # players would reach the staff UI they're explicitly excluded from.
+        player_user = User.objects.create_user(email="player@example.com", password="pw-secret-123")
+        player_member = Member.objects.create(user=player_user, first_name="Paul", last_name="Player")
+        ClubMembership.objects.create(club=self.club, member=player_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.force_login(player_user)
+
+        self.assertEqual(self.club_get("home").status_code, 403)
+
+    def test_a_club_admin_can_reach_it(self):
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("home").status_code, 200)
+
+    def test_it_does_not_exist_on_the_base_domain(self):
+        # The management UI manages one club; the mirror image of controlpanel
+        # refusing to exist on a club subdomain.
+        self.client.force_login(self.admin_user)
+
+        response = self.client.get(reverse("management:home"), HTTP_HOST="rosterchief.app")
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_staff_with_only_a_staff_assignment_can_reach_staff_pages(self):
+        # No ClubRole at all -- authority comes purely from a current-season
+        # StaffAssignment, per club.services.access.
+        coach_user = User.objects.create_user(email="coach@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U12", short_name="U12")
+        position = Position.objects.create(club=self.club, name="Coach", short_name="C", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        self.assertEqual(self.club_get("member_list").status_code, 200)
+
+    def test_staff_without_admin_role_cannot_reach_admin_only_pages(self):
+        coach_user = User.objects.create_user(email="coach2@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cody", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U13", short_name="U13")
+        position = Position.objects.create(club=self.club, name="Coach2", short_name="C2", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        # position_list itself is open to any staff (see TeamAndPositionAccessTests)
+        # -- creating and editing positions stays admin-only.
+        self.assertEqual(self.club_get("position_create").status_code, 403)
+        self.assertEqual(self.club_post("member_create", {"first_name": "X", "last_name": "Y"}).status_code, 403)
+
+
+class NavLinkTests(ManagementTestBase):
+    """The global navbar's "Management" link, next to Django admin -- see
+    management.context_processors.management_link and templates/_base.html."""
+
+    def test_a_club_admin_sees_the_link_on_the_club_subdomain(self):
+        self.client.force_login(self.admin_user)
+
+        self.assertContains(self.club_get("home"), reverse("management:home"))
+
+    def test_a_plain_active_club_member_does_not_see_the_link(self):
+        player_user = User.objects.create_user(email="player2@example.com", password="pw-secret-123")
+        player_member = Member.objects.create(user=player_user, first_name="Pia", last_name="Player")
+        ClubMembership.objects.create(club=self.club, member=player_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.login(email="player2@example.com", password="pw-secret-123")
+
+        # 403 on /manage/ itself, but the link must not appear on pages this user *can*
+        # reach either -- assert against a page outside the gate: the account view.
+        response = self.client.get(reverse("mfa_index"), HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertNotContains(response, reverse("management:home"))
+
+    def test_the_link_is_absent_on_the_base_domain_even_for_a_club_admin(self):
+        # has_management_access requires a resolved club; the control panel/base domain
+        # has none, so the link -- which points at a single club's management app --
+        # correctly never appears there regardless of who's signed in.
+        self.client.force_login(self.admin_user)
+
+        response = self.client.get(reverse("mfa_index"), HTTP_HOST="rosterchief.app")
+
+        self.assertNotContains(response, reverse("management:home"))
+
+
+class ActiveNavHighlightTests(ManagementTestBase):
+    """The sidebar/mobile nav highlights whichever section the current page
+    belongs to -- see management.context_processors.active_nav_section."""
+
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_the_members_list_page_highlights_members(self):
+        response = self.club_get("member_list")
+
+        self.assertContains(response, f'class="menu-active" href="{reverse("management:member_list")}"')
+        self.assertNotContains(response, f'class="menu-active" href="{reverse("management:home")}"')
+
+    def test_a_member_detail_sub_page_still_highlights_members(self):
+        # member_detail has no nav entry of its own -- it belongs to the Members
+        # section, same as member_list, member_update, family_detail, etc.
+        member = Member.objects.create(first_name="Sub", last_name="Page")
+        ClubMembership.objects.create(club=self.club, member=member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        response = self.club_get("member_detail", member.pk)
+
+        self.assertContains(response, f'class="menu-active" href="{reverse("management:member_list")}"')
+
+    def test_the_dashboard_highlights_dashboard_only(self):
+        response = self.club_get("home")
+
+        self.assertContains(response, f'class="menu-active" href="{reverse("management:home")}"')
+        self.assertNotContains(response, f'class="menu-active" href="{reverse("management:member_list")}"')
+
+
+class MemberManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_member_list_is_scoped_to_the_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_season = make_season(other_club)
+        other_member = Member.objects.create(first_name="Other", last_name="Person")
+        ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        response = self.club_get("member_list")
+
+        self.assertNotContains(response, "Other Person")
+
+    def test_creating_a_member_also_signs_them_up_for_the_current_season(self):
+        response = self.club_post("member_create", {"first_name": "New", "last_name": "Player", "email": "new@example.com"})
+
+        member = Member.objects.get(first_name="New", last_name="Player")
+        self.assertRedirects(response, reverse("management:member_detail", args=[member.pk]))
+        self.assertTrue(ClubMembership.objects.filter(club=self.club, member=member, season=self.season).exists())
+
+    def test_updating_a_member(self):
+        member = Member.objects.create(first_name="Old", last_name="Name")
+        ClubMembership.objects.create(club=self.club, member=member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        # This member has a current-season membership, so its section renders too --
+        # one combined submit, so its (required) fields must come along.
+        self.club_post(
+            "member_update",
+            {"first_name": "New", "last_name": "Name", "status": ClubMembership.StatusChoices.ACTIVE, "fee_status": ClubMembership.FeeStatus.UNPAID},
+            member.pk,
+        )
+
+        member.refresh_from_db()
+        self.assertEqual(member.first_name, "New")
+
+
+class TeamManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_team_list_is_scoped_to_the_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Team.objects.create(club=other_club, name="Rival Team", short_name="RT")
+
+        response = self.club_get("team_list")
+
+        self.assertNotContains(response, "Rival Team")
+
+    def test_creating_a_team(self):
+        response = self.club_post("team_create", {"name": "U15", "short_name": "U15"})
+
+        team = Team.objects.get(club=self.club, name="U15")
+        self.assertRedirects(response, reverse("management:team_detail", args=[team.pk]))
+
+    def test_deleting_a_team(self):
+        team = Team.objects.create(club=self.club, name="U16", short_name="U16")
+
+        response = self.club_post("team_delete", {}, team.pk)
+
+        self.assertRedirects(response, reverse("management:team_list"))
+        self.assertFalse(Team.objects.filter(pk=team.pk).exists())
+
+    def test_deleting_a_team_cascades_its_roster_and_staff(self):
+        team = Team.objects.create(club=self.club, name="U17", short_name="U17")
+        position = Position.objects.create(club=self.club, name="Coach17", short_name="C17", staff_position=True)
+        member = Member.objects.create(first_name="Sam", last_name="Staffer")
+        StaffAssignment.objects.create(team=team, member=member, season=self.season, position=position)
+
+        self.club_post("team_delete", {}, team.pk)
+
+        self.assertFalse(StaffAssignment.objects.filter(team=team).exists())
+
+    def test_a_non_admin_cannot_delete_a_team(self):
+        team = Team.objects.create(club=self.club, name="U18", short_name="U18")
+        coach_user = User.objects.create_user(email="coach-team-delete@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        position = Position.objects.create(club=self.club, name="CoachTeamDelete", short_name="CTD", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("team_delete", {}, team.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(Team.objects.filter(pk=team.pk).exists())
+
+
+class TeamRosterStaffTests(ManagementTestBase):
+    """Roster/staff management folded into the team page -- see
+    management.views.TeamDetailView and the TeamRoster*/TeamStaff* views."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.player_position = Position.objects.create(club=self.club, name="Forward", short_name="FW", staff_position=False)
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+        self.player = Member.objects.create(first_name="Peter", last_name="Player")
+        ClubMembership.objects.create(club=self.club, member=self.player, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def make_team_coach(self, team, email="coach-roster@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=self.coach_position)
+        return coach_user
+
+    def test_nav_no_longer_lists_roster_or_staff(self):
+        # Not a bare "Roster"/"Staff" substring check -- "RosterChief" branding is
+        # on every page regardless. The nav's old icons are a safe, specific proxy.
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_list")
+
+        self.assertNotContains(response, "clipboard-list")
+        self.assertNotContains(response, "hard-hat")
+
+    def test_roster_and_staff_urls_no_longer_resolve(self):
+        with self.assertRaises(NoReverseMatch):
+            reverse("management:roster_list")
+        with self.assertRaises(NoReverseMatch):
+            reverse("management:staff_list")
+
+    def test_season_switcher_defaults_to_the_current_season(self):
+        self.client.force_login(self.admin_user)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "Peter Player")
+
+    def test_season_switcher_honours_the_query_param(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 1, 1), end_date=datetime.date(2020, 12, 31))
+        TeamMembership.objects.create(team=self.team, season=other_season, member=self.player, position=self.player_position)
+        self.client.force_login(self.admin_user)
+
+        default_response = self.club_get("team_detail", self.team.pk)
+        other_response = self.client.get(f"{reverse('management:team_detail', args=[self.team.pk])}?season={other_season.pk}", HTTP_HOST="ajax-united.rosterchief.app")
+
+        # Not assertNotContains("Peter Player") on the default response -- he's
+        # still a valid pick in the "Add player" combobox even when he isn't on
+        # *this* season's roster, so his name legitimately appears there too.
+        self.assertContains(default_response, "No one on the roster for this season yet.")
+        self.assertContains(other_response, "Peter Player")
+
+    def test_a_teams_own_coach_can_add_a_player(self):
+        self.client.force_login(self.make_team_coach(self.team))
+
+        response = self.club_post("team_roster_add", {"member": str(self.player.pk), "position": str(self.player_position.pk), "jersey_number": "9"}, self.team.pk, self.season.pk)
+
+        self.assertRedirects(response, f"{reverse('management:team_detail', args=[self.team.pk])}?season={self.season.pk}")
+        membership = TeamMembership.objects.get(team=self.team, season=self.season, member=self.player)
+        self.assertEqual(membership.jersey_number, 9)
+
+    def test_a_different_teams_coach_cannot_add_a_player(self):
+        self.client.force_login(self.make_team_coach(self.other_team))
+
+        response = self.club_post("team_roster_add", {"member": str(self.player.pk), "position": str(self.player_position.pk)}, self.team.pk, self.season.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(TeamMembership.objects.filter(team=self.team, season=self.season).exists())
+
+    def test_a_different_teams_coach_can_still_view_the_team(self):
+        self.client.force_login(self.make_team_coach(self.other_team))
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertEqual(response.status_code, 200)
+
+    def test_admin_can_add_a_player_to_any_team(self):
+        self.client.force_login(self.admin_user)
+
+        self.club_post("team_roster_add", {"member": str(self.player.pk), "position": str(self.player_position.pk)}, self.team.pk, self.season.pk)
+
+        self.assertTrue(TeamMembership.objects.filter(team=self.team, season=self.season, member=self.player).exists())
+
+    def test_the_add_player_dropdown_excludes_a_member_with_no_active_membership(self):
+        lapsed_player = Member.objects.create(first_name="Lex", last_name="Lapsed")
+        ClubMembership.objects.create(club=self.club, member=lapsed_player, season=self.season, status=ClubMembership.StatusChoices.LAPSED)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertNotContains(response, "Lex Lapsed")
+
+    def test_the_add_player_dropdown_includes_a_member_active_only_next_season(self):
+        next_season = Season.objects.create(club=self.club, start_date=self.season.end_date + datetime.timedelta(days=1), end_date=self.season.end_date + datetime.timedelta(days=300))
+        upcoming_player = Member.objects.create(first_name="Uma", last_name="Upcoming")
+        ClubMembership.objects.create(club=self.club, member=upcoming_player, season=next_season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "Uma Upcoming")
+
+    def test_the_add_player_dropdown_excludes_a_member_active_only_in_a_past_season(self):
+        past_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 1, 1), end_date=datetime.date(2020, 12, 31))
+        past_player = Member.objects.create(first_name="Pip", last_name="Past")
+        ClubMembership.objects.create(club=self.club, member=past_player, season=past_season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertNotContains(response, "Pip Past")
+
+    def test_adding_the_same_member_twice_fails_with_a_form_error_not_a_500(self):
+        self.client.force_login(self.admin_user)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position)
+
+        response = self.club_post("team_roster_add", {"member": str(self.player.pk), "position": str(self.player_position.pk)}, self.team.pk, self.season.pk)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(TeamMembership.objects.filter(team=self.team, season=self.season).count(), 1)
+
+    def test_a_duplicate_jersey_number_fails_with_a_form_error_not_a_500(self):
+        # team/season aren't TeamMembershipForm fields, so Django's own
+        # validate_unique() can't see unique_jersey_number_per_team_per_season --
+        # this constraint only gets checked because the form does it by hand.
+        other_player = Member.objects.create(first_name="Olly", last_name="Other")
+        ClubMembership.objects.create(club=self.club, member=other_player, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position, jersey_number=7)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("team_roster_add", {"member": str(other_player.pk), "position": str(self.player_position.pk), "jersey_number": "7"}, self.team.pk, self.season.pk)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertFalse(TeamMembership.objects.filter(team=self.team, season=self.season, member=other_player).exists())
+
+    def test_editing_a_roster_entry_to_a_clashing_jersey_number_fails_gracefully(self):
+        other_player = Member.objects.create(first_name="Olly", last_name="Other")
+        ClubMembership.objects.create(club=self.club, member=other_player, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position, jersey_number=7)
+        other_membership = TeamMembership.objects.create(team=self.team, season=self.season, member=other_player, position=self.player_position, jersey_number=8)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post(
+            "team_roster_update",
+            {"member": str(other_player.pk), "position": str(self.player_position.pk), "jersey_number": "7"},
+            self.team.pk,
+            other_membership.pk,
+        )
+
+        self.assertEqual(response.status_code, 302)
+        other_membership.refresh_from_db()
+        self.assertEqual(other_membership.jersey_number, 8)
+
+    def test_editing_a_roster_entry_updates_it(self):
+        membership = TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position, jersey_number=9)
+        self.client.force_login(self.admin_user)
+
+        self.club_post(
+            "team_roster_update",
+            {"member": str(self.player.pk), "position": str(self.player_position.pk), "jersey_number": "10", "is_captain": "on"},
+            self.team.pk,
+            membership.pk,
+        )
+
+        membership.refresh_from_db()
+        self.assertEqual(membership.jersey_number, 10)
+        self.assertTrue(membership.is_captain)
+
+    def test_removing_a_roster_entry_deletes_it(self):
+        membership = TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.player_position)
+        self.client.force_login(self.admin_user)
+
+        self.club_post("team_roster_remove", {}, self.team.pk, membership.pk)
+
+        self.assertFalse(TeamMembership.objects.filter(pk=membership.pk).exists())
+
+    def test_a_teams_own_coach_can_assign_staff(self):
+        physio_position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True)
+        physio = Member.objects.create(first_name="Pat", last_name="Physio")
+        ClubMembership.objects.create(club=self.club, member=physio, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.force_login(self.make_team_coach(self.team))
+
+        self.club_post("team_staff_add", {"member": str(physio.pk), "position": str(physio_position.pk)}, self.team.pk, self.season.pk)
+
+        self.assertTrue(StaffAssignment.objects.filter(team=self.team, season=self.season, member=physio).exists())
+
+    def test_the_assign_staff_dropdown_excludes_a_member_active_only_in_a_past_season(self):
+        # Same eligibility rule as the "Add player" dropdown -- see
+        # test_the_add_player_dropdown_excludes_a_member_active_only_in_a_past_season.
+        past_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 1, 1), end_date=datetime.date(2020, 12, 31))
+        past_member = Member.objects.create(first_name="Sam", last_name="Stale")
+        ClubMembership.objects.create(club=self.club, member=past_member, season=past_season, status=ClubMembership.StatusChoices.ACTIVE)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertNotContains(response, "Sam Stale")
+
+    def test_a_different_teams_coach_cannot_assign_staff(self):
+        physio_position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True)
+        physio = Member.objects.create(first_name="Pat", last_name="Physio")
+        self.client.force_login(self.make_team_coach(self.other_team))
+
+        response = self.club_post("team_staff_add", {"member": str(physio.pk), "position": str(physio_position.pk)}, self.team.pk, self.season.pk)
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_removing_a_staff_assignment_deletes_it(self):
+        assignment = StaffAssignment.objects.create(team=self.team, season=self.season, member=self.player, position=self.coach_position)
+        self.client.force_login(self.admin_user)
+
+        self.club_post("team_staff_remove", {}, self.team.pk, assignment.pk)
+
+        self.assertFalse(StaffAssignment.objects.filter(pk=assignment.pk).exists())
+
+
+ONE_PIXEL_PNG = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\x00\x01\x00\x00\x05\x00\x01\r\n-\xb4\x00\x00\x00\x00IEND\xaeB`\x82"
+
+
+def make_image_file(name="photo.png"):
+    return SimpleUploadedFile(name, ONE_PIXEL_PNG, content_type="image/png")
+
+
+class TeamPhotoTests(ManagementTestBase):
+    """One photo per (team, season), uploaded from the team page -- see
+    management.views.TeamPhotoSetView/TeamPhotoDeleteView."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+    def make_team_coach(self, team, email="coach-photo@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=self.coach_position)
+        return coach_user
+
+    def make_plain_staff(self, email="physio-photo@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=self.team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+    def test_uploading_creates_a_photo(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("team_photo_set", {"image": make_image_file()}, self.team.pk, self.season.pk)
+
+        self.assertRedirects(response, f"{reverse('management:team_detail', args=[self.team.pk])}?season={self.season.pk}")
+        self.assertEqual(TeamPhoto.objects.filter(team=self.team, season=self.season).count(), 1)
+
+    def test_uploading_again_replaces_it_in_place(self):
+        self.client.force_login(self.admin_user)
+        self.club_post("team_photo_set", {"image": make_image_file("first.png")}, self.team.pk, self.season.pk)
+        first = TeamPhoto.objects.get(team=self.team, season=self.season)
+
+        self.club_post("team_photo_set", {"image": make_image_file("second.png")}, self.team.pk, self.season.pk)
+
+        self.assertEqual(TeamPhoto.objects.filter(team=self.team, season=self.season).count(), 1)
+        second = TeamPhoto.objects.get(team=self.team, season=self.season)
+        self.assertEqual(first.pk, second.pk)
+        self.assertIn("second", second.image.name)
+
+    def test_a_different_teams_coach_cannot_upload(self):
+        self.client.force_login(self.make_team_coach(self.other_team))
+
+        response = self.club_post("team_photo_set", {"image": make_image_file()}, self.team.pk, self.season.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(TeamPhoto.objects.filter(team=self.team).exists())
+
+    def test_this_teams_coach_can_upload(self):
+        self.client.force_login(self.make_team_coach(self.team))
+
+        response = self.club_post("team_photo_set", {"image": make_image_file()}, self.team.pk, self.season.pk)
+
+        self.assertRedirects(response, f"{reverse('management:team_detail', args=[self.team.pk])}?season={self.season.pk}")
+        self.assertTrue(TeamPhoto.objects.filter(team=self.team, season=self.season).exists())
+
+    def test_deleting_removes_the_photo(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image=make_image_file())
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("team_photo_delete", {}, self.team.pk, self.season.pk)
+
+        self.assertRedirects(response, f"{reverse('management:team_detail', args=[self.team.pk])}?season={self.season.pk}")
+        self.assertFalse(TeamPhoto.objects.filter(team=self.team, season=self.season).exists())
+
+    def test_the_team_page_shows_the_photo_when_set(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image=make_image_file())
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "Replace photo")
+        self.assertNotContains(response, "No photo uploaded")
+
+    def test_the_team_page_shows_a_placeholder_when_not_set(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "No photo uploaded")
+        self.assertContains(response, "Upload photo")
+
+    def test_upload_ui_is_hidden_from_a_plain_staff_member(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image=make_image_file())
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertNotContains(response, "Replace photo")
+        self.assertNotContains(response, "Upload photo")
+
+
+class PositionManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_position_list_is_scoped_to_the_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Position.objects.create(club=other_club, name="Rival Coach", short_name="RC", staff_position=True)
+
+        response = self.club_get("position_list")
+
+        self.assertNotContains(response, "Rival Coach")
+
+    def test_creating_a_position(self):
+        response = self.club_post("position_create", {"name": "Physio", "short_name": "PH", "ordering": 0, "staff_position": "on", "management_position": ""})
+
+        position = Position.objects.get(club=self.club, name="Physio")
+        self.assertRedirects(response, reverse("management:position_list"))
+        self.assertTrue(position.staff_position)
+        self.assertFalse(position.management_position)
+
+    def test_updating_a_position(self):
+        position = Position.objects.create(club=self.club, name="Old name", short_name="ON")
+
+        self.club_post("position_update", {"name": "New name", "short_name": "NN", "ordering": 0}, position.pk)
+
+        position.refresh_from_db()
+        self.assertEqual(position.name, "New name")
+
+    def test_a_management_position_must_also_be_a_staff_position(self):
+        response = self.club_post("position_create", {"name": "Bad", "short_name": "B", "ordering": 0, "management_position": "on"})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(Position.objects.filter(club=self.club, name="Bad").exists())
+        self.assertFormError(response.context["form"], "management_position", "A management position must also be a staff position.")
+
+
+class ClubRoleManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Future", last_name="Editor")
+        # An active membership already grants an implicit MEMBER role (club/signals.py) --
+        # granting EDITOR must promote that row, not insert a second one.
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_granting_a_role_promotes_the_existing_membership_role(self):
+        self.club_post("role_create", {"member": str(self.member.pk), "role": ClubRole.Roles.EDITOR})
+
+        role = ClubRole.objects.get(club=self.club, member=self.member)
+        self.assertEqual(role.role, ClubRole.Roles.EDITOR)
+        self.assertEqual(ClubRole.objects.filter(club=self.club, member=self.member).count(), 1)
+
+    def test_revoking_a_role(self):
+        role = ClubRole.objects.get(club=self.club, member=self.member)
+
+        self.club_post("role_revoke", {}, role.pk)
+
+        self.assertFalse(ClubRole.objects.filter(pk=role.pk).exists())
+
+    def test_the_plain_member_role_never_appears_on_the_list(self):
+        # self.admin_member and self.member both hold an implicit MEMBER role --
+        # noise this page must never show. (self.member's name still legitimately
+        # appears once, in the "Grant role" modal's member picker.)
+        response = self.club_get("role_list")
+
+        self.assertContains(response, "No one has the Editor role yet.")
+
+    def test_a_granted_role_appears_under_its_own_section(self):
+        self.club_post("role_create", {"member": str(self.member.pk), "role": ClubRole.Roles.EDITOR})
+
+        response = self.club_get("role_list")
+
+        self.assertContains(response, "Future Editor")
+
+    def test_grant_role_is_a_modal_on_the_list_page(self):
+        response = self.club_get("role_list")
+
+        self.assertContains(response, 'id="grant_role_modal"')
+
+    def test_each_section_explains_what_the_role_grants(self):
+        response = self.club_get("role_list")
+
+        self.assertContains(response, "Full control over the club")
+        self.assertContains(response, "Can create and edit events")
+
+    def test_an_invalid_submission_redirects_back_to_the_list_instead_of_a_page(self):
+        response = self.club_post("role_create", {"member": "", "role": ClubRole.Roles.EDITOR})
+
+        self.assertRedirects(response, reverse("management:role_list"))
+
+
+class FamilyManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_registering_a_family_creates_a_login_parent_and_a_login_less_child(self):
+        response = self.club_post(
+            "family_create",
+            {
+                "parent_first_name": "Pat",
+                "parent_last_name": "Parent",
+                "parent_email": "pat.parent@example.com",
+                "child_first_name": "Cody",
+                "child_last_name": "Child",
+                "child_date_of_birth": "2015-04-01",
+            },
+        )
+
+        family = Family.objects.get(memberships__member__first_name="Cody")
+        self.assertRedirects(response, reverse("management:family_detail", args=[family.pk]))
+
+        parent = Member.objects.get(first_name="Pat", last_name="Parent")
+        child = Member.objects.get(first_name="Cody", last_name="Child")
+        self.assertEqual(parent.user.email, "pat.parent@example.com")
+        self.assertFalse(parent.user.has_usable_password(), "should set a password via the reset link, not be given one")
+        self.assertIsNone(child.user)
+
+        self.assertEqual(FamilyMembership.objects.get(family=family, member=parent).role, FamilyMembership.FamilyRole.PARENT)
+        self.assertEqual(FamilyMembership.objects.get(family=family, member=child).role, FamilyMembership.FamilyRole.CHILD)
+
+        # Both get signed up for the current season, same as a plain MemberCreateView.
+        self.assertTrue(ClubMembership.objects.filter(club=self.club, member=parent, season=self.season).exists())
+        self.assertTrue(ClubMembership.objects.filter(club=self.club, member=child, season=self.season).exists())
+
+    def test_reusing_an_existing_login_by_email(self):
+        # A parent who's already a Member elsewhere (an existing login) must be
+        # reused, not duplicated, when registered onto a second family.
+        existing_user = User.objects.create_user(email="existing@example.com", password="pw-secret-123")
+        existing_member = Member.objects.create(user=existing_user, first_name="Existing", last_name="Parent")
+
+        self.club_post(
+            "family_create",
+            {
+                "parent_first_name": "Ignored",
+                "parent_last_name": "Ignored",
+                "parent_email": "existing@example.com",
+                "child_first_name": "New",
+                "child_last_name": "Kid",
+            },
+        )
+
+        self.assertEqual(Member.objects.filter(user=existing_user).count(), 1)
+        family = Family.objects.get(memberships__member__first_name="New")
+        self.assertIn(existing_member, family.guardians)
+
+    def make_existing_family(self):
+        # A family only counts as "of this club" once at least one of its members
+        # has actually signed up (families_of_club, management/views.py) -- exactly
+        # what registering the first child through this app already does.
+        family = Family.objects.create()
+        first_kid = Member.objects.create(first_name="First", last_name="Kid")
+        FamilyMembership.objects.create(family=family, member=first_kid, role=FamilyMembership.FamilyRole.CHILD)
+        ClubMembership.objects.create(club=self.club, member=first_kid, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        return family
+
+    def test_adding_a_child_to_an_existing_family(self):
+        family = self.make_existing_family()
+
+        response = self.club_post("family_add_child", {"first_name": "Second", "last_name": "Kid", "date_of_birth": "2018-01-01"}, family.pk)
+
+        self.assertRedirects(response, reverse("management:family_detail", args=[family.pk]))
+        self.assertEqual(family.children.count(), 2)
+        self.assertTrue(ClubMembership.objects.filter(club=self.club, member__first_name="Second", season=self.season).exists())
+
+    def test_adding_a_parent_to_an_existing_family_is_idempotent(self):
+        family = self.make_existing_family()
+
+        self.club_post("family_add_parent", {"email": "new.parent@example.com", "first_name": "New", "last_name": "Parent"}, family.pk)
+        self.club_post("family_add_parent", {"email": "new.parent@example.com", "first_name": "", "last_name": ""}, family.pk)
+
+        self.assertEqual(family.guardians.count(), 1)
+
+
+class MemberListFamilyColumnTests(ManagementTestBase):
+    """The member list is one flat table -- family is a column (each member's family/
+    role attached in Python, management.views.MemberListView), not a grouping."""
+
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def make_family(self, parent_name, child_name):
+        family = Family.objects.create()
+        parent = Member.objects.create(first_name=parent_name, last_name="Guardian")
+        child = Member.objects.create(first_name=child_name, last_name="Kid")
+        FamilyMembership.objects.create(family=family, member=parent, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family, member=child, role=FamilyMembership.FamilyRole.CHILD)
+        ClubMembership.objects.create(club=self.club, member=parent, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        ClubMembership.objects.create(club=self.club, member=child, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        return family, parent, child
+
+    def test_a_family_renders_as_one_group_on_the_member_list(self):
+        family, parent, child = self.make_family("Pat", "Cody")
+
+        response = self.club_get("member_list")
+
+        self.assertContains(response, str(family))
+        self.assertContains(response, str(parent))
+        self.assertContains(response, str(child))
+
+    def test_a_member_with_no_family_has_an_empty_family_column(self):
+        loner = Member.objects.create(first_name="Lone", last_name="Member")
+        ClubMembership.objects.create(club=self.club, member=loner, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {member.pk: member for member in response.context["members"]}
+        self.assertEqual(members_by_pk[loner.pk].family_memberships_display, [])
+
+    def test_a_family_members_column_shows_the_family_and_role(self):
+        family, parent, child = self.make_family("Pat", "Cody")
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {member.pk: member for member in response.context["members"]}
+        parent_fms = members_by_pk[parent.pk].family_memberships_display
+        child_fms = members_by_pk[child.pk].family_memberships_display
+        self.assertEqual([fm.family for fm in parent_fms], [family])
+        self.assertEqual(parent_fms[0].role, "parent")
+        self.assertEqual(child_fms[0].role, "child")
+
+    def test_a_member_in_two_families_shows_both_on_the_member_list(self):
+        family, parent, _child = self.make_family("Pat", "Cody")
+        other_family = Family.objects.create()
+        FamilyMembership.objects.create(family=other_family, member=parent, role=FamilyMembership.FamilyRole.OTHER)
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {member.pk: member for member in response.context["members"]}
+        parent_fms = members_by_pk[parent.pk].family_memberships_display
+        self.assertEqual({fm.family for fm in parent_fms}, {family, other_family})
+
+    def test_families_of_other_clubs_do_not_appear(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_season = make_season(other_club)
+        other_member = Member.objects.create(first_name="Other", last_name="Kid")
+        ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, status=ClubMembership.StatusChoices.ACTIVE)
+        other_family = Family.objects.create()
+        FamilyMembership.objects.create(family=other_family, member=other_member, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_get("member_list")
+
+        self.assertNotContains(response, str(other_family))
+        self.assertNotContains(response, "Other Kid")
+
+    def test_a_non_admin_never_sees_a_family_mate_outside_their_own_visibility(self):
+        # group_by_family must bucket the already-scoped members_visible_to() result,
+        # never Family.guardians/.children directly -- those ignore scoping entirely
+        # and would leak a family-mate a non-admin has no other reason to see.
+        _family, parent, child = self.make_family("Pat", "Cody")
+
+        coach_user = User.objects.create_user(email="coach3@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U14", short_name="U14")
+        position = Position.objects.create(club=self.club, name="Coach3", short_name="C3", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("member_list")
+
+        self.assertNotContains(response, str(parent))
+        self.assertNotContains(response, str(child))
+
+
+class MemberListStatusColumnTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def test_current_season_status_is_shown(self):
+        member = Member.objects.create(first_name="Sam", last_name="Pending")
+        ClubMembership.objects.create(club=self.club, member=member, season=self.season, status=ClubMembership.StatusChoices.PENDING)
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {m.pk: m for m in response.context["members"]}
+        self.assertEqual(members_by_pk[member.pk].current_membership.status, ClubMembership.StatusChoices.PENDING)
+        self.assertContains(response, "Pending")
+
+    def test_a_member_with_no_current_season_membership_shows_a_dash(self):
+        ClubMembership.objects.filter(club=self.club, member=self.admin_member).delete()
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {m.pk: m for m in response.context["members"]}
+        self.assertIsNone(members_by_pk[self.admin_member.pk].current_membership)
+
+    def test_a_lapsed_season_membership_does_not_count_as_current(self):
+        lapsed_season = Season.objects.create(club=self.club, start_date=self.season.start_date - datetime.timedelta(days=400), end_date=self.season.start_date - datetime.timedelta(days=40))
+        member = Member.objects.create(first_name="Old", last_name="Season")
+        ClubMembership.objects.create(club=self.club, member=member, season=lapsed_season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        response = self.club_get("member_list")
+
+        members_by_pk = {m.pk: m for m in response.context["members"]}
+        self.assertIsNone(members_by_pk[member.pk].current_membership)
+
+
+class MemberGrantLoginTests(ManagementTestBase):
+    """A login-less child getting their own account -- see
+    members.services.family.grant_login and management.forms.GrantLoginForm."""
+
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.family = Family.objects.create()
+        self.child = Member.objects.create(first_name="Cody", last_name="Kid")
+        FamilyMembership.objects.create(family=self.family, member=self.child, role=FamilyMembership.FamilyRole.CHILD)
+        ClubMembership.objects.create(club=self.club, member=self.child, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_family_page_offers_the_button_for_a_login_less_child(self):
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertContains(response, reverse("management:member_grant_login", args=[self.child.pk]))
+
+    def test_no_button_once_the_child_already_has_a_login(self):
+        self.child.user = User.objects.create_user(email="already@example.com", password="pw-secret-123")
+        self.child.save()
+
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertNotContains(response, reverse("management:member_grant_login", args=[self.child.pk]))
+
+    def test_no_button_for_a_parent(self):
+        parent = Member.objects.create(first_name="Pat", last_name="Parent")
+        FamilyMembership.objects.create(family=self.family, member=parent, role=FamilyMembership.FamilyRole.PARENT)
+        ClubMembership.objects.create(club=self.club, member=parent, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertNotContains(response, reverse("management:member_grant_login", args=[parent.pk]))
+
+    def test_the_form_is_prefilled_with_the_childs_contact_email_if_set(self):
+        self.child.email = "cody.kid@example.com"
+        self.child.save()
+
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertContains(response, "cody.kid@example.com")
+
+    def test_granting_a_login_creates_a_usable_account(self):
+        response = self.club_post("member_grant_login", {"email": "cody.kid@example.com"}, self.child.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.child.pk]))
+        self.child.refresh_from_db()
+        self.assertIsNotNone(self.child.user)
+        self.assertEqual(self.child.user.email, "cody.kid@example.com")
+        self.assertFalse(self.child.user.has_usable_password())
+
+    def test_an_email_already_in_use_is_rejected(self):
+        User.objects.create_user(email="taken@example.com", password="pw-secret-123")
+
+        response = self.club_post("member_grant_login", {"email": "taken@example.com"}, self.child.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.child.pk]))
+        self.child.refresh_from_db()
+        self.assertIsNone(self.child.user)
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-grant@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U18", short_name="U18")
+        position = Position.objects.create(club=self.club, name="Coach7", short_name="C7", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("member_grant_login", {"email": "cody.kid@example.com"}, self.child.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.child.refresh_from_db()
+        self.assertIsNone(self.child.user)
+
+
+class MemberFamilyAttachDetachTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.standalone = Member.objects.create(first_name="Stan", last_name="Alone")
+        ClubMembership.objects.create(club=self.club, member=self.standalone, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_attaching_to_a_new_family(self):
+        response = self.club_post("member_attach_family", {"role": FamilyMembership.FamilyRole.PARENT, "family": ""}, self.standalone.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.standalone.pk]))
+        family = Family.objects.get(memberships__member=self.standalone)
+        self.assertIn(self.standalone, family.guardians)
+
+    def test_attaching_to_an_existing_family(self):
+        family = Family.objects.create()
+        kid = Member.objects.create(first_name="Existing", last_name="Kid")
+        ClubMembership.objects.create(club=self.club, member=kid, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        FamilyMembership.objects.create(family=family, member=kid, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.club_post("member_attach_family", {"role": FamilyMembership.FamilyRole.PARENT, "family": str(family.pk)}, self.standalone.pk)
+
+        self.assertIn(self.standalone, family.guardians)
+        self.assertEqual(Family.objects.filter(memberships__member=self.standalone).count(), 1)
+
+    def test_detaching_from_family_removes_it_when_left_empty(self):
+        family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_post("member_detach_family", {}, self.standalone.pk, family.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.standalone.pk]))
+        self.assertFalse(FamilyMembership.objects.filter(member=self.standalone).exists())
+        self.assertFalse(Family.objects.filter(pk=family.pk).exists())
+
+    def test_detaching_from_family_keeps_it_when_others_remain(self):
+        family = Family.objects.create()
+        sibling = Member.objects.create(first_name="Sibling", last_name="Kid")
+        ClubMembership.objects.create(club=self.club, member=sibling, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=family, member=sibling, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.club_post("member_detach_family", {}, self.standalone.pk, family.pk)
+
+        self.assertTrue(Family.objects.filter(pk=family.pk).exists())
+        self.assertIn(sibling, family.children)
+
+    def test_detaching_from_one_family_keeps_membership_in_another(self):
+        family = Family.objects.create()
+        other_family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=other_family, member=self.standalone, role=FamilyMembership.FamilyRole.OTHER)
+
+        self.club_post("member_detach_family", {}, self.standalone.pk, family.pk)
+
+        self.assertFalse(FamilyMembership.objects.filter(member=self.standalone, family=family).exists())
+        self.assertTrue(FamilyMembership.objects.filter(member=self.standalone, family=other_family).exists())
+
+    def test_a_member_can_join_a_second_family(self):
+        family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_post("member_attach_family", {"role": FamilyMembership.FamilyRole.OTHER, "family": ""}, self.standalone.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.standalone.pk]))
+        self.assertEqual(FamilyMembership.objects.filter(member=self.standalone).count(), 2)
+        self.assertTrue(FamilyMembership.objects.filter(member=self.standalone, family=family).exists())
+
+    def test_member_detail_shows_a_card_per_family(self):
+        family = Family.objects.create()
+        other_family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=other_family, member=self.standalone, role=FamilyMembership.FamilyRole.OTHER)
+
+        response = self.club_get("member_detail", self.standalone.pk)
+
+        self.assertEqual(len(response.context["family_groups"]), 2)
+        self.assertContains(response, str(family))
+        self.assertContains(response, str(other_family))
+        # "Add to family" stays available even though the member is already in two.
+        self.assertContains(response, "Add to family")
+
+    def test_attach_form_excludes_families_already_joined(self):
+        family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.standalone, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_get("member_detail", self.standalone.pk)
+
+        self.assertNotIn(family, response.context["attach_to_family_form"].fields["family"].queryset)
+
+
+class MemberDeleteTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Doomed", last_name="Member")
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_deleting_a_member(self):
+        response = self.club_post("member_delete", {}, self.member.pk)
+
+        self.assertRedirects(response, reverse("management:member_list"))
+        self.assertFalse(Member.objects.filter(pk=self.member.pk).exists())
+
+    def test_deleting_the_last_member_of_a_family_cleans_it_up(self):
+        family = Family.objects.create()
+        FamilyMembership.objects.create(family=family, member=self.member, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.club_post("member_delete", {}, self.member.pk)
+
+        self.assertFalse(Family.objects.filter(pk=family.pk).exists())
+
+    def test_a_member_referenced_by_an_order_cannot_be_deleted(self):
+        # shop.Order.purchaser is PROTECT -- deleting must fail gracefully, not 500.
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("10.00"))
+
+        response = self.club_post("member_delete", {}, self.member.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.member.pk]))
+        self.assertTrue(Member.objects.filter(pk=self.member.pk).exists())
+
+
+class MemberClubMembershipFormTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Fee", last_name="Payer")
+        self.membership = ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_editing_a_member_also_updates_their_current_membership(self):
+        response = self.club_post(
+            "member_update",
+            {
+                "first_name": "Fee",
+                "last_name": "Payer",
+                "license": "BE-9999",
+                "status": ClubMembership.StatusChoices.ACTIVE,
+                "fee_status": ClubMembership.FeeStatus.PAID,
+            },
+            self.member.pk,
+        )
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.member.pk]))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.license, "BE-9999")
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+
+    def test_membership_section_is_fillable_when_not_yet_rostered_this_season(self):
+        member = Member.objects.create(first_name="Unrostered", last_name="Member")
+        # Visible (has *a* membership in this club), but not for the current season --
+        # this is exactly the case that should now offer a fillable section to sign
+        # them up, rather than hiding it because nothing exists yet.
+        old_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 8, 1), end_date=datetime.date(2021, 5, 31))
+        ClubMembership.objects.create(club=self.club, member=member, season=old_season, status=ClubMembership.StatusChoices.LAPSED)
+
+        response = self.club_get("member_update", member.pk)
+
+        self.assertContains(response, "This season")
+        self.assertFalse(ClubMembership.objects.filter(club=self.club, member=member, season=self.season).exists())
+
+    def test_saving_the_membership_section_signs_up_a_previously_unrostered_member(self):
+        member = Member.objects.create(first_name="Unrostered", last_name="Member")
+        # A ClubRole, not a ClubMembership -- gives the admin visibility into this
+        # member without a season-bound row already existing, which is exactly the
+        # "not signed up for anything yet" case this test means to exercise.
+        ClubRole.objects.create(club=self.club, member=member, role=ClubRole.Roles.MEMBER)
+
+        response = self.club_post(
+            "member_update",
+            {"first_name": "Unrostered", "last_name": "Member", "status": ClubMembership.StatusChoices.ACTIVE, "fee_status": ClubMembership.FeeStatus.PAID},
+            member.pk,
+        )
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[member.pk]))
+        membership = ClubMembership.objects.get(club=self.club, member=member, season=self.season)
+        self.assertEqual(membership.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(membership.fee_status, ClubMembership.FeeStatus.PAID)
+
+    def test_membership_section_absent_with_no_season_at_all(self):
+        # A fresh club, never given a season -- there's nothing sensible to sign up
+        # for, so unlike the "not rostered yet" case above, this stays hidden.
+        empty_club = Club.objects.create(name="No Season FC", slug="no-season-fc")
+        admin_member = Member.objects.create(first_name="Empty", last_name="Admin")
+        ClubRole.objects.create(club=empty_club, member=admin_member, role=ClubRole.Roles.ADMIN)
+        admin_user = User.objects.create_user(email="noseasonadmin@example.com", password="pw-secret-123")
+        admin_member.user = admin_user
+        admin_member.save()
+        enrol_mfa(admin_user)
+        self.client.force_login(admin_user)
+        member = Member.objects.create(first_name="No", last_name="Season")
+        ClubRole.objects.create(club=empty_club, member=member, role=ClubRole.Roles.MEMBER)
+
+        with override_settings(ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "no-season-fc.rosterchief.app", "testserver"]):
+            response = self.client.get(reverse("management:member_update", args=[member.pk]), HTTP_HOST="no-season-fc.rosterchief.app")
+
+        self.assertNotContains(response, "This season")
+
+    def test_detail_page_shows_season_history(self):
+        old_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 8, 1), end_date=datetime.date(2021, 5, 31))
+        ClubMembership.objects.create(club=self.club, member=self.member, season=old_season, status=ClubMembership.StatusChoices.LAPSED, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+        response = self.club_get("member_detail", self.member.pk)
+
+        self.assertContains(response, f"{self.season.start_date:%Y} - {self.season.end_date:%Y}")
+        self.assertContains(response, f"{old_season.start_date:%Y} - {old_season.end_date:%Y}")
+        self.assertContains(response, "lapsed")
+
+    def test_formatted_phone_number_is_shown(self):
+        self.member.phone = "+32476123456"
+        self.member.save()
+
+        response = self.club_get("member_detail", self.member.pk)
+
+        self.assertContains(response, "+32 476 12 34 56")
+
+
+class FamilyDetailViewTests(ManagementTestBase):
+    """The family overview page, reached by clicking a family's name -- there's no
+    standalone "Families" nav entry or list."""
+
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.family = Family.objects.create()
+        self.parent = Member.objects.create(first_name="Pat", last_name="Guardian")
+        self.child = Member.objects.create(first_name="Cody", last_name="Kid")
+        FamilyMembership.objects.create(family=self.family, member=self.parent, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=self.family, member=self.child, role=FamilyMembership.FamilyRole.CHILD)
+        ClubMembership.objects.create(club=self.club, member=self.parent, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        ClubMembership.objects.create(club=self.club, member=self.child, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_shows_every_member_of_the_family(self):
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Guardian")
+        self.assertContains(response, "Kid")
+
+    def test_a_family_from_another_club_404s(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_family = Family.objects.create()
+        other_member = Member.objects.create(first_name="Other", last_name="Kid")
+        other_season = make_season(other_club)
+        ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, status=ClubMembership.StatusChoices.ACTIVE)
+        FamilyMembership.objects.create(family=other_family, member=other_member, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_get("family_detail", other_family.pk)
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_only_admins_see_edit_and_delete_actions(self):
+        # Give the coach visibility into this family's child (rostered on their team),
+        # so the assertion below actually exercises the admin-only button gating --
+        # not just "the coach can't see this row at all".
+        coach_user = User.objects.create_user(email="coach4@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U15", short_name="U15")
+        staff_position = Position.objects.create(club=self.club, name="Coach4", short_name="C4", staff_position=True, management_position=True)
+        player_position = Position.objects.create(club=self.club, name="Player4", short_name="P4", staff_position=False)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=staff_position)
+        TeamMembership.objects.create(team=team, member=self.child, season=self.season, position=player_position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertContains(response, "Kid")
+        # The edit icon links straight to member_detail, same as the row's own name
+        # link -- not admin-exclusive, so member_delete is the actual gating signal.
+        self.assertNotContains(response, reverse("management:member_delete", args=[self.child.pk]))
+
+    def test_admin_sees_a_remove_from_family_action_per_row(self):
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertContains(response, reverse("management:member_detach_family", args=[self.parent.pk, self.family.pk]))
+        self.assertContains(response, reverse("management:member_detach_family", args=[self.child.pk, self.family.pk]))
+
+    def test_non_admin_does_not_see_the_remove_from_family_action(self):
+        coach_user = User.objects.create_user(email="coach6@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U17", short_name="U17")
+        staff_position = Position.objects.create(club=self.club, name="Coach6", short_name="C6", staff_position=True, management_position=True)
+        player_position = Position.objects.create(club=self.club, name="Player6", short_name="P6", staff_position=False)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=staff_position)
+        TeamMembership.objects.create(team=team, member=self.child, season=self.season, position=player_position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertNotContains(response, reverse("management:member_detach_family", args=[self.child.pk, self.family.pk]))
+
+    def test_removing_a_family_member_from_the_row_button_detaches_only_them(self):
+        response = self.club_post("member_detach_family", {}, self.child.pk, self.family.pk)
+
+        self.assertRedirects(response, reverse("management:member_detail", args=[self.child.pk]))
+        self.assertFalse(FamilyMembership.objects.filter(family=self.family, member=self.child).exists())
+        self.assertTrue(FamilyMembership.objects.filter(family=self.family, member=self.parent).exists())
+
+
+class FamilyMembershipRoleUpdateTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.family = Family.objects.create()
+        self.member = Member.objects.create(first_name="Cody", last_name="Kid")
+        self.membership = FamilyMembership.objects.create(family=self.family, member=self.member, role=FamilyMembership.FamilyRole.CHILD)
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_admin_can_change_the_role(self):
+        response = self.club_post("family_membership_role_update", {"role": FamilyMembership.FamilyRole.GUARDIAN}, self.family.pk, self.member.pk)
+
+        self.assertRedirects(response, reverse("management:family_detail", args=[self.family.pk]))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.role, FamilyMembership.FamilyRole.GUARDIAN)
+
+    def test_only_changes_the_role_in_the_targeted_family(self):
+        other_family = Family.objects.create()
+        other_membership = FamilyMembership.objects.create(family=other_family, member=self.member, role=FamilyMembership.FamilyRole.OTHER)
+
+        self.club_post("family_membership_role_update", {"role": FamilyMembership.FamilyRole.PARENT}, self.family.pk, self.member.pk)
+
+        self.membership.refresh_from_db()
+        other_membership.refresh_from_db()
+        self.assertEqual(self.membership.role, FamilyMembership.FamilyRole.PARENT)
+        self.assertEqual(other_membership.role, FamilyMembership.FamilyRole.OTHER)
+
+    def test_an_invalid_role_is_rejected(self):
+        response = self.club_post("family_membership_role_update", {"role": "not-a-role"}, self.family.pk, self.member.pk)
+
+        self.assertRedirects(response, reverse("management:family_detail", args=[self.family.pk]))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.role, FamilyMembership.FamilyRole.CHILD)
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-role@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U16", short_name="U16")
+        position = Position.objects.create(club=self.club, name="Coach5", short_name="C5", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("family_membership_role_update", {"role": FamilyMembership.FamilyRole.PARENT}, self.family.pk, self.member.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.role, FamilyMembership.FamilyRole.CHILD)
+
+    def test_a_family_from_another_club_404s(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_season = make_season(other_club)
+        other_family = Family.objects.create()
+        other_member = Member.objects.create(first_name="Other", last_name="Kid")
+        ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, status=ClubMembership.StatusChoices.ACTIVE)
+        FamilyMembership.objects.create(family=other_family, member=other_member, role=FamilyMembership.FamilyRole.CHILD)
+
+        response = self.club_post("family_membership_role_update", {"role": FamilyMembership.FamilyRole.PARENT}, other_family.pk, other_member.pk)
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_the_dropdown_reflects_the_role_specific_to_that_family(self):
+        # Same member, a different role in a second family -- the "others" bucket
+        # used to read person.family_memberships.first(), which could silently show
+        # a role from the wrong family. This is exactly that scenario.
+        other_family = Family.objects.create()
+        FamilyMembership.objects.create(family=other_family, member=self.member, role=FamilyMembership.FamilyRole.OTHER)
+
+        this_family_response = self.club_get("family_detail", self.family.pk)
+        other_family_response = self.club_get("family_detail", other_family.pk)
+
+        self.assertContains(this_family_response, 'value="child" selected')
+        self.assertContains(other_family_response, 'value="other" selected')
+
+    def test_redirects_to_next_when_changed_from_the_member_page(self):
+        next_url = reverse("management:member_detail", args=[self.member.pk])
+
+        response = self.club_post("family_membership_role_update", {"role": FamilyMembership.FamilyRole.GUARDIAN, "next": next_url}, self.family.pk, self.member.pk)
+
+        self.assertRedirects(response, next_url)
+
+    def test_ignores_an_unsafe_next_url(self):
+        response = self.club_post(
+            "family_membership_role_update", {"role": FamilyMembership.FamilyRole.GUARDIAN, "next": "https://evil.example.com/steal"}, self.family.pk, self.member.pk
+        )
+
+        self.assertRedirects(response, reverse("management:family_detail", args=[self.family.pk]))
+
+    def test_member_detail_page_sends_its_own_url_as_next(self):
+        response = self.club_get("member_detail", self.member.pk)
+
+        self.assertContains(response, f'name="next" value="{reverse("management:member_detail", args=[self.member.pk])}"')
+
+    def test_family_detail_page_sends_no_next(self):
+        response = self.club_get("family_detail", self.family.pk)
+
+        self.assertNotContains(response, 'name="next"')
+
+
+class MembershipListViewTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        # The base class's own admin ClubMembership (fee_status defaults to UNPAID)
+        # would otherwise pollute every count below -- ClubRole (not ClubMembership)
+        # is what actually makes them an admin, so this is safe to drop.
+        ClubMembership.objects.filter(club=self.club, member=self.admin_member).delete()
+
+    def make_membership(self, first_name, last_name, *, status=ClubMembership.StatusChoices.ACTIVE, fee_status=ClubMembership.FeeStatus.UNPAID, season=None, license=""):
+        member = Member.objects.create(first_name=first_name, last_name=last_name)
+        return ClubMembership.objects.create(club=self.club, member=member, season=season or self.season, status=status, fee_status=fee_status, license=license)
+
+    def test_kpi_counts_for_the_current_season(self):
+        self.make_membership("Paid", "One", fee_status=ClubMembership.FeeStatus.PAID)
+        self.make_membership("Partial", "One", fee_status=ClubMembership.FeeStatus.PARTIALLY_PAID)
+        self.make_membership("Unpaid", "One", fee_status=ClubMembership.FeeStatus.UNPAID)
+        self.make_membership("Unpaid", "Two", fee_status=ClubMembership.FeeStatus.UNPAID)
+        self.make_membership("Waived", "One", fee_status=ClubMembership.FeeStatus.WAIVED)
+
+        response = self.club_get("membership_list")
+
+        self.assertEqual(response.context["kpi_total"], 5)
+        self.assertEqual(response.context["kpi_paid"], 1)
+        self.assertEqual(response.context["kpi_partial"], 1)
+        self.assertEqual(response.context["kpi_unpaid"], 2)
+        self.assertEqual(response.context["kpi_waived"], 1)
+        self.assertEqual(response.context["kpi_paid_rate"], 20)
+
+    def test_default_list_excludes_paid_but_includes_waived(self):
+        paid = self.make_membership("Paid", "One", fee_status=ClubMembership.FeeStatus.PAID)
+        unpaid = self.make_membership("Unpaid", "One", fee_status=ClubMembership.FeeStatus.UNPAID)
+        waived = self.make_membership("Waived", "One", fee_status=ClubMembership.FeeStatus.WAIVED)
+
+        response = self.club_get("membership_list")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertNotIn(paid.pk, ids)
+        self.assertIn(unpaid.pk, ids)
+        self.assertIn(waived.pk, ids)
+
+    def test_fee_status_filter_narrows_to_one_value(self):
+        unpaid = self.make_membership("Unpaid", "One", fee_status=ClubMembership.FeeStatus.UNPAID)
+        waived = self.make_membership("Waived", "One", fee_status=ClubMembership.FeeStatus.WAIVED)
+
+        response = self.client.get(reverse("management:membership_list") + "?fee_status=waived", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertNotIn(unpaid.pk, ids)
+        self.assertIn(waived.pk, ids)
+
+    def test_fee_status_all_includes_paid(self):
+        paid = self.make_membership("Paid", "One", fee_status=ClubMembership.FeeStatus.PAID)
+
+        response = self.client.get(reverse("management:membership_list") + "?fee_status=all", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(paid.pk, ids)
+
+    def test_status_filter(self):
+        active = self.make_membership("Active", "One", status=ClubMembership.StatusChoices.ACTIVE)
+        pending = self.make_membership("Pending", "One", status=ClubMembership.StatusChoices.PENDING)
+
+        response = self.client.get(reverse("management:membership_list") + "?status=pending", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertNotIn(active.pk, ids)
+        self.assertIn(pending.pk, ids)
+
+    def test_team_filter(self):
+        on_team = self.make_membership("OnTeam", "Kid")
+        off_team = self.make_membership("OffTeam", "Kid")
+        team = Team.objects.create(club=self.club, name="U10", short_name="U10")
+        position = Position.objects.create(club=self.club, name="Player", short_name="P")
+        TeamMembership.objects.create(team=team, member=on_team.member, season=self.season, position=position)
+
+        response = self.client.get(reverse("management:membership_list") + f"?team={team.pk}", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(on_team.pk, ids)
+        self.assertNotIn(off_team.pk, ids)
+
+    def test_search_filter(self):
+        match = self.make_membership("Findme", "Person")
+        other = self.make_membership("Other", "Person")
+
+        response = self.client.get(reverse("management:membership_list") + "?q=Findme", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(match.pk, ids)
+        self.assertNotIn(other.pk, ids)
+
+    def test_search_matches_by_family_surname(self):
+        # Searching "Smith" should find a family member even when their own name
+        # isn't Smith -- e.g. a parent with a different surname than their kid.
+        family = Family.objects.create()
+        smith_kid = self.make_membership("Junior", "Smith")
+        FamilyMembership.objects.create(family=family, member=smith_kid.member, role=FamilyMembership.FamilyRole.CHILD)
+        other_parent = self.make_membership("Alex", "Jones")
+        FamilyMembership.objects.create(family=family, member=other_parent.member, role=FamilyMembership.FamilyRole.PARENT)
+        unrelated = self.make_membership("Nobody", "Related")
+
+        response = self.client.get(reverse("management:membership_list") + "?q=Smith", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(smith_kid.pk, ids)
+        self.assertIn(other_parent.pk, ids)
+        self.assertNotIn(unrelated.pk, ids)
+
+    def test_search_matches_an_explicit_family_name(self):
+        family = Family.objects.create(name="The Andersons")
+        membership = self.make_membership("Pat", "Vandermeer")
+        FamilyMembership.objects.create(family=family, member=membership.member, role=FamilyMembership.FamilyRole.PARENT)
+        unrelated = self.make_membership("Nobody", "Related")
+
+        response = self.client.get(reverse("management:membership_list") + "?q=Anderson", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(membership.pk, ids)
+        self.assertNotIn(unrelated.pk, ids)
+
+    def test_family_column_shows_every_family_a_member_belongs_to(self):
+        family = Family.objects.create()
+        other_family = Family.objects.create()
+        membership = self.make_membership("Multi", "Family")
+        FamilyMembership.objects.create(family=family, member=membership.member, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=other_family, member=membership.member, role=FamilyMembership.FamilyRole.OTHER)
+
+        response = self.club_get("membership_list")
+
+        by_pk = {m.pk: m for m in response.context["memberships"]}
+        family_ids = {fm.family_id for fm in by_pk[membership.pk].member.family_memberships_display}
+        self.assertEqual(family_ids, {family.pk, other_family.pk})
+
+    def test_season_filter_switches_away_from_current(self):
+        old_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 8, 1), end_date=datetime.date(2021, 5, 31))
+        current_membership = self.make_membership("Current", "Season")
+        old_membership = self.make_membership("Old", "Season", season=old_season, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+        response = self.client.get(reverse("management:membership_list") + f"?season={old_season.pk}", HTTP_HOST="ajax-united.rosterchief.app")
+
+        ids = {m.pk for m in response.context["memberships"]}
+        self.assertIn(old_membership.pk, ids)
+        self.assertNotIn(current_membership.pk, ids)
+        # KPIs stay pinned to the *current* season regardless of the list's own filter.
+        self.assertEqual(response.context["current_season"], self.season)
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-membership@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U19", short_name="U19")
+        position = Position.objects.create(club=self.club, name="Coach8", short_name="C8", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("membership_list")
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_nav_entry_is_admin_only(self):
+        admin_response = self.club_get("home")
+        self.assertContains(admin_response, reverse("management:membership_list"))
+
+
+class MembershipMarkPaidTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Owed", last_name="Fee")
+        self.membership = ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.PENDING, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+    def test_marking_paid_sets_active_and_paid(self):
+        response = self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)]})
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+        self.assertEqual(self.membership.activated_at, timezone.localdate())
+
+    def test_marking_paid_grants_the_member_role(self):
+        # The whole reason this loops and calls .save() instead of .update() --
+        # club/signals.py grants MEMBER via a post_save signal.
+        self.assertFalse(ClubRole.objects.filter(club=self.club, member=self.member, role=ClubRole.Roles.MEMBER).exists())
+
+        self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)]})
+
+        self.assertTrue(ClubRole.objects.filter(club=self.club, member=self.member, role=ClubRole.Roles.MEMBER).exists())
+
+    def test_does_not_overwrite_an_existing_activated_at(self):
+        earlier = datetime.date(2026, 1, 1)
+        self.membership.activated_at = earlier
+        self.membership.save()
+
+        self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)]})
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.activated_at, earlier)
+
+    def test_does_not_touch_unselected_rows(self):
+        other = ClubMembership.objects.create(club=self.club, member=Member.objects.create(first_name="Not", last_name="Selected"), season=self.season, status=ClubMembership.StatusChoices.PENDING, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+        self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)]})
+
+        other.refresh_from_db()
+        self.assertEqual(other.status, ClubMembership.StatusChoices.PENDING)
+        self.assertEqual(other.fee_status, ClubMembership.FeeStatus.UNPAID)
+
+    def test_a_membership_from_another_club_is_ignored(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_season = make_season(other_club)
+        other_member = Member.objects.create(first_name="Other", last_name="Club")
+        other_membership = ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, status=ClubMembership.StatusChoices.PENDING, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+        self.club_post("membership_mark_paid", {"membership_ids": [str(other_membership.pk)]})
+
+        other_membership.refresh_from_db()
+        self.assertEqual(other_membership.status, ClubMembership.StatusChoices.PENDING)
+
+    def test_redirects_to_a_safe_next(self):
+        next_url = reverse("management:membership_list") + "?status=pending"
+
+        response = self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)], "next": next_url})
+
+        self.assertRedirects(response, next_url)
+
+    def test_ignores_an_unsafe_next(self):
+        response = self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)], "next": "https://evil.example.com/"})
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+
+    def test_nothing_selected_is_a_harmless_no_op(self):
+        response = self.club_post("membership_mark_paid", {})
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.PENDING)
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-markpaid@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U20", short_name="U20")
+        position = Position.objects.create(club=self.club, name="Coach9", short_name="C9", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("membership_mark_paid", {"membership_ids": [str(self.membership.pk)]})
+
+        self.assertEqual(response.status_code, 403)
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.PENDING)
+
+
+class MembershipRecordPaymentTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Owed", last_name="Fee")
+        self.membership = ClubMembership.objects.create(
+            club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.PENDING, fee_status=ClubMembership.FeeStatus.UNPAID, fee_amount=Decimal("150.00")
+        )
+
+    def test_recording_a_partial_payment(self):
+        response = self.club_post("membership_record_payment", {"amount": "50.00", "method": FeePayment.Method.CASH, "reference": "R1"}, self.membership.pk)
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.amount_paid, Decimal("50.00"))
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PARTIALLY_PAID)
+        payment = FeePayment.objects.get(membership=self.membership)
+        self.assertEqual(payment.reference, "R1")
+        self.assertEqual(payment.recorded_by, self.admin_user)
+
+    def test_recording_the_full_remaining_amount_settles_it(self):
+        self.club_post("membership_record_payment", {"amount": "150.00", "method": FeePayment.Method.BANK_TRANSFER}, self.membership.pk)
+
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.ACTIVE)
+
+    def test_an_invalid_amount_is_rejected_without_recording_anything(self):
+        response = self.club_post("membership_record_payment", {"amount": "0", "method": FeePayment.Method.CASH}, self.membership.pk)
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+        self.assertFalse(FeePayment.objects.filter(membership=self.membership).exists())
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.amount_paid, Decimal("0.00"))
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-recordpay@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U22", short_name="U22")
+        position = Position.objects.create(club=self.club, name="Coach11", short_name="C11", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("membership_record_payment", {"amount": "50.00", "method": FeePayment.Method.CASH}, self.membership.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(FeePayment.objects.filter(membership=self.membership).exists())
+
+
+class MembershipMarkFullyPaidTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Owed", last_name="Fee")
+        self.membership = ClubMembership.objects.create(
+            club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.PENDING, fee_status=ClubMembership.FeeStatus.UNPAID, fee_amount=Decimal("150.00")
+        )
+
+    def test_settles_the_remaining_balance_in_one_click(self):
+        response = self.club_post("membership_mark_fully_paid", {}, self.membership.pk)
+
+        self.assertRedirects(response, reverse("management:membership_list"))
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.fee_status, ClubMembership.FeeStatus.PAID)
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(self.membership.amount_paid, Decimal("150.00"))
+
+    def test_a_membership_from_another_club_404s(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        other_season = make_season(other_club)
+        other_member = Member.objects.create(first_name="Other", last_name="Club")
+        other_membership = ClubMembership.objects.create(club=other_club, member=other_member, season=other_season, fee_amount=Decimal("100.00"))
+
+        response = self.club_post("membership_mark_fully_paid", {}, other_membership.pk)
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_redirects_to_a_safe_next(self):
+        next_url = reverse("management:membership_list") + "?status=pending"
+
+        response = self.club_post("membership_mark_fully_paid", {"next": next_url}, self.membership.pk)
+
+        self.assertRedirects(response, next_url)
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-fullypaid@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U23", short_name="U23")
+        position = Position.objects.create(club=self.club, name="Coach12", short_name="C12", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_post("membership_mark_fully_paid", {}, self.membership.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.membership.refresh_from_db()
+        self.assertEqual(self.membership.status, ClubMembership.StatusChoices.PENDING)
+
+
+class MembershipListButtonVisibilityTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def make_membership(self, fee_status):
+        member = Member.objects.create(first_name=fee_status, last_name="Row")
+        return ClubMembership.objects.create(club=self.club, member=member, season=self.season, fee_status=fee_status, fee_amount=Decimal("100.00"))
+
+    def test_buttons_hidden_for_a_paid_row(self):
+        membership = self.make_membership(ClubMembership.FeeStatus.PAID)
+
+        response = self.client.get(reverse("management:membership_list") + "?fee_status=all", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertNotContains(response, reverse("management:membership_mark_fully_paid", args=[membership.pk]))
+
+    def test_buttons_hidden_for_a_waived_row(self):
+        membership = self.make_membership(ClubMembership.FeeStatus.WAIVED)
+
+        response = self.client.get(reverse("management:membership_list") + "?fee_status=all", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertNotContains(response, reverse("management:membership_mark_fully_paid", args=[membership.pk]))
+
+    def test_buttons_shown_for_an_unpaid_row(self):
+        membership = self.make_membership(ClubMembership.FeeStatus.UNPAID)
+
+        response = self.client.get(reverse("management:membership_list") + "?fee_status=all", HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertContains(response, reverse("management:membership_mark_fully_paid", args=[membership.pk]))
+
+
+class RenderPdfTests(TestCase):
+    """management.pdf.render_pdf itself -- see billing/tests.py's equivalent
+    coverage of billing.services.invoices.render_pdf, same lazy-import shape."""
+
+    def test_the_pdf_library_is_only_needed_when_a_pdf_is_asked_for(self):
+        with mock.patch.dict(sys.modules, {"weasyprint": mock.MagicMock()}):
+            sys.modules["weasyprint"].HTML.return_value.write_pdf.return_value = b"%PDF-1.7"
+
+            self.assertEqual(render_pdf("<p>hi</p>"), b"%PDF-1.7")
+
+    def test_a_missing_pdf_library_says_what_is_missing(self):
+        with mock.patch.dict(sys.modules, {"weasyprint": None}), self.assertRaises(PDFExportError):
+            render_pdf("<p>hi</p>")
+
+
+class MembershipExportPdfTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+        self.member = Member.objects.create(first_name="Print", last_name="Me")
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+    def test_downloads_as_a_pdf(self):
+        with mock.patch("management.views.membership_list_pdf", return_value=b"%PDF-fake") as renderer:
+            response = self.club_get("membership_export_pdf")
+
+        self.assertEqual(response["Content-Type"], "application/pdf")
+        self.assertIn(".pdf", response["Content-Disposition"])
+        self.assertEqual(response.content, b"%PDF-fake")
+        renderer.assert_called_once()
+
+    def test_export_uses_the_same_filters_as_the_page(self):
+        # Same fixture as the "on-team" filter test for the page itself -- the PDF
+        # must reflect whatever's filtered, not the whole club.
+        other = Member.objects.create(first_name="Other", last_name="Person")
+        ClubMembership.objects.create(club=self.club, member=other, season=self.season, status=ClubMembership.StatusChoices.ACTIVE, fee_status=ClubMembership.FeeStatus.UNPAID)
+
+        with mock.patch("management.views.membership_list_pdf", return_value=b"%PDF-fake") as renderer:
+            self.client.get(reverse("management:membership_export_pdf") + "?q=Print", HTTP_HOST="ajax-united.rosterchief.app")
+
+        context = renderer.call_args[0][0]
+        names = {m.member.last_name for m in context["memberships"]}
+        self.assertEqual(names, {"Me"})
+
+    def test_a_missing_pdf_library_is_reported_rather_than_a_500(self):
+        # WeasyPrint needs native libs. Without them the button must explain itself.
+        with mock.patch("management.views.membership_list_pdf", side_effect=PDFExportError("PDF rendering needs the native pango/cairo libraries.")):
+            response = self.club_get("membership_export_pdf")
+        response = self.client.get(response.url, HTTP_HOST="ajax-united.rosterchief.app")
+
+        self.assertContains(response, "pango")
+
+    def test_non_admin_gets_403(self):
+        coach_user = User.objects.create_user(email="coach-export@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U21", short_name="U21")
+        position = Position.objects.create(club=self.club, name="Coach10", short_name="C10", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("membership_export_pdf")
+
+        self.assertEqual(response.status_code, 403)
+
+
+class MemberListRowActionsTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.member = Member.objects.create(first_name="Row", last_name="Actions")
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+
+    def test_admin_sees_edit_and_delete_buttons(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("member_list")
+
+        self.assertContains(response, reverse("management:member_delete", args=[self.member.pk]))
+
+    def test_non_admin_does_not_see_edit_and_delete_buttons(self):
+        # Roster self.member on the coach's team so this actually tests the
+        # admin-only button gating, not just "the coach can't see this row at all".
+        coach_user = User.objects.create_user(email="coach5@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U16", short_name="U16")
+        staff_position = Position.objects.create(club=self.club, name="Coach5", short_name="C5", staff_position=True, management_position=True)
+        player_position = Position.objects.create(club=self.club, name="Player5", short_name="P5", staff_position=False)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=staff_position)
+        TeamMembership.objects.create(team=team, member=self.member, season=self.season, position=player_position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("member_list")
+
+        self.assertContains(response, "Row")
+        self.assertNotContains(response, reverse("management:member_delete", args=[self.member.pk]))
+
+
+class HomeViewTests(ManagementTestBase):
+    """The dashboard reuses controlpanel.services.statistics' club_attention/
+    club_charts/club_statistics -- already club-scoped, so directly usable for this
+    club's own staff. Financial pieces (fee chart, Shop stat group) are admin-only,
+    same line the nav already draws around the Shop section."""
+
+    def make_coach(self, email):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name=f"Team-{email}", short_name="T")
+        position = Position.objects.create(club=self.club, name=f"Coach-{email}", short_name="C", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def test_admin_sees_the_financial_sections(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'id="fees-chart"')
+        self.assertContains(response, 'id="signups-chart"')
+        self.assertContains(response, "Renewal rate")
+        self.assertContains(response, "Open carts")
+        self.assertContains(response, "md:grid-cols-4")
+
+    def test_non_admin_staff_does_not_see_the_financial_sections(self):
+        self.client.force_login(self.make_coach("coach6@example.com"))
+
+        response = self.club_get("home")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, 'id="fees-chart"')
+        self.assertNotContains(response, 'id="signups-chart"')
+        self.assertNotContains(response, "Renewal rate")
+        self.assertNotContains(response, "Open carts")
+        self.assertContains(response, "md:grid-cols-3")
+
+    def test_published_news_is_shown_to_everyone(self):
+        item = News.objects.create(club=self.club, title="Season kickoff", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_coach("coach-news-home@example.com"))
+
+        response = self.club_get("home")
+
+        self.assertContains(response, "Season kickoff")
+
+    def test_a_draft_or_scheduled_news_item_is_not_shown_on_the_home_page(self):
+        draft = News.objects.create(club=self.club, title="Still a draft", body="Body.")
+        scheduled = News.objects.create(club=self.club, title="Scheduled for later", body="Body.")
+        scheduled.publish(at=timezone.now() + datetime.timedelta(days=7))
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertNotContains(response, draft.title)
+        self.assertNotContains(response, scheduled.title)
+
+    def test_upcoming_events_are_listed_in_order_and_future_only(self):
+        now = timezone.now()
+        past = Event.objects.create(club=self.club, kind=Event.EventKind.TRAINING, title="Past training", start=now - datetime.timedelta(days=1))
+        soon = Event.objects.create(club=self.club, kind=Event.EventKind.TRAINING, title="Sooner training", start=now + datetime.timedelta(days=1))
+        later = Event.objects.create(club=self.club, kind=Event.EventKind.GAME, title="Later game", start=now + datetime.timedelta(days=5))
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        body = response.content.decode()
+        self.assertNotIn(past.title, body)
+        self.assertLess(body.index(soon.title), body.index(later.title))
+
+    def test_loads_fine_with_no_season_and_no_events(self):
+        # A fresh club, never given a season -- ClubMembership.season is PROTECT, so
+        # this is a new club rather than deleting self.season out from under setUp's
+        # own ClubMembership.
+        empty_club = Club.objects.create(name="Empty FC", slug="empty-fc")
+        admin_member = Member.objects.create(first_name="Empty", last_name="Admin")
+        ClubRole.objects.create(club=empty_club, member=admin_member, role=ClubRole.Roles.ADMIN)
+        admin_user = User.objects.create_user(email="emptyadmin@example.com", password="pw-secret-123")
+        admin_member.user = admin_user
+        admin_member.save()
+        enrol_mfa(admin_user)
+        self.client.force_login(admin_user)
+
+        with override_settings(ALLOWED_HOSTS=["rosterchief.app", "ajax-united.rosterchief.app", "empty-fc.rosterchief.app", "testserver"]):
+            response = self.client.get(reverse("management:home"), HTTP_HOST="empty-fc.rosterchief.app")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "cannot take a signup")
+        self.assertContains(response, "Nothing scheduled.")
+
+
+class MemberBulkImportTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.client.force_login(self.admin_user)
+
+    def make_non_admin_staff(self):
+        coach_user = User.objects.create_user(email="coach-import@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        team = Team.objects.create(club=self.club, name="U14", short_name="U14")
+        position = Position.objects.create(club=self.club, name="CoachImport", short_name="CI", staff_position=True)
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def test_template_download_has_expected_headers_and_dropdowns(self):
+        response = self.club_get("member_import_template")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Content-Type"], XLSX_CONTENT_TYPE)
+
+        workbook = openpyxl.load_workbook(BytesIO(response.content))
+        sheet = workbook.active
+        header = [cell.value for cell in sheet[1]]
+        self.assertEqual(header, TEMPLATE_COLUMNS)
+        self.assertTrue(sheet.data_validations.dataValidation)
+
+    def test_non_admin_can_download_template_but_not_upload(self):
+        coach_user = self.make_non_admin_staff()
+        self.client.force_login(coach_user)
+
+        template_response = self.club_get("member_import_template")
+        upload_response = self.club_post("member_import", {"file": make_import_workbook([["Jamie", "Kid", "", "jamie@example.com", "", "", "", "", ""]])})
+
+        self.assertEqual(template_response.status_code, 200)
+        self.assertEqual(upload_response.status_code, 403)
+
+    def test_anonymous_is_redirected_to_login_for_both(self):
+        self.client.logout()
+
+        self.assertEqual(self.club_get("member_import_template").status_code, 302)
+        self.assertEqual(self.club_get("member_import").status_code, 302)
+
+    def test_a_clean_row_previews_as_will_create(self):
+        upload = make_import_workbook([["Jamie", "Kid", "2010-01-01", "jamie.kid@example.com", "+32470111111", "", "", "", ""]])
+
+        response = self.club_post("member_import", {"file": upload})
+
+        self.assertEqual(response.context["valid_count"], 1)
+        self.assertEqual(response.context["skipped_count"], 0)
+        result = response.context["results"][0]
+        self.assertIsNotNone(result["member"])
+        self.assertEqual(result["membership_kwargs"]["status"], ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(result["membership_kwargs"]["fee_status"], ClubMembership.FeeStatus.UNPAID)
+
+    def test_a_row_missing_a_required_name_is_skipped(self):
+        upload = make_import_workbook([["", "Noname", "", "", "", "", "", "", ""]])
+
+        response = self.club_post("member_import", {"file": upload})
+
+        self.assertEqual(response.context["valid_count"], 0)
+        result = response.context["results"][0]
+        self.assertIsNone(result["member"])
+        self.assertTrue(result["errors"])
+
+    def test_an_invalid_email_is_skipped(self):
+        upload = make_import_workbook([["Bad", "Email", "", "not-an-email", "", "", "", "", ""]])
+
+        response = self.club_post("member_import", {"file": upload})
+
+        result = response.context["results"][0]
+        self.assertIsNone(result["member"])
+
+    def test_an_invalid_status_value_is_skipped(self):
+        upload = make_import_workbook([["Bad", "Status", "", "bad.status@example.com", "", "", "", "not-a-status", ""]])
+
+        response = self.club_post("member_import", {"file": upload})
+
+        result = response.context["results"][0]
+        self.assertIsNone(result["member"])
+        self.assertTrue(any("status" in error.lower() for error in result["errors"]))
+
+    def test_a_duplicate_email_within_the_file_is_flagged_on_the_second_row(self):
+        upload = make_import_workbook(
+            [
+                ["First", "Dup", "", "dup@example.com", "", "", "", "", ""],
+                ["Second", "Dup", "", "dup@example.com", "", "", "", "", ""],
+            ]
+        )
+
+        response = self.club_post("member_import", {"file": upload})
+
+        results = response.context["results"]
+        self.assertIsNotNone(results[0]["member"])
+        self.assertIsNone(results[1]["member"])
+        self.assertIn("Duplicate email in this file.", results[1]["errors"])
+
+    def test_an_email_already_in_the_club_is_skipped(self):
+        upload = make_import_workbook([["Ada", "Admin", "", self.admin_user.email, "", "", "", "", ""]])
+
+        response = self.club_post("member_import", {"file": upload})
+
+        result = response.context["results"][0]
+        self.assertIsNone(result["member"])
+        self.assertIn("Already a member of this club.", result["errors"])
+
+    def test_confirm_creates_only_the_valid_rows_with_defaults(self):
+        upload = make_import_workbook(
+            [
+                ["Jamie", "Kid", "2010-01-01", "jamie.kid@example.com", "", "", "LIC-1", "", ""],
+                ["", "Noname", "", "", "", "", "", "", ""],
+            ]
+        )
+        self.club_post("member_import", {"file": upload})
+
+        response = self.club_post("member_import_confirm", {})
+
+        self.assertRedirects(response, reverse("management:member_list"))
+        member = Member.objects.get(email="jamie.kid@example.com")
+        membership = ClubMembership.objects.get(club=self.club, member=member)
+        self.assertEqual(membership.status, ClubMembership.StatusChoices.ACTIVE)
+        self.assertEqual(membership.fee_status, ClubMembership.FeeStatus.UNPAID)
+        self.assertEqual(membership.license, "LIC-1")
+        self.assertFalse(Member.objects.filter(last_name="Noname").exists())
+
+    def test_confirm_without_a_prior_upload_creates_nothing(self):
+        response = self.club_post("member_import_confirm", {})
+
+        self.assertRedirects(response, reverse("management:member_import"))
+        self.assertEqual(Member.objects.filter(last_name="Kid").count(), 0)
+
+    def test_confirm_is_admin_only(self):
+        coach_user = self.make_non_admin_staff()
+        upload = make_import_workbook([["Jamie", "Kid", "", "jamie.kid2@example.com", "", "", "", "", ""]])
+        self.club_post("member_import", {"file": upload})
+
+        self.client.force_login(coach_user)
+        response = self.club_post("member_import_confirm", {})
+
+        self.assertEqual(response.status_code, 403)
+
+
+class NewsManagementTests(ManagementTestBase):
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+
+    def make_coach_manager(self, email="coach-news@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=self.team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def make_plain_staff(self, email="physio-news@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=self.team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+    def make_editor(self, email="editor-news@example.com"):
+        editor_user = User.objects.create_user(email=email, password="pw-secret-123")
+        editor_member = Member.objects.create(user=editor_user, first_name="Eve", last_name="Editor")
+        ClubMembership.objects.create(club=self.club, member=editor_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        ClubRole.objects.filter(club=self.club, member=editor_member).update(role=ClubRole.Roles.EDITOR)
+        enrol_mfa(editor_user)  # ClubRole ADMIN/EDITOR requires a second factor; StaffAssignment-only doesn't.
+        return editor_user
+
+    def test_list_is_scoped_to_the_club(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        News.objects.create(club=other_club, title="Rival news", body="Body.")
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("news_list")
+
+        self.assertNotContains(response, "Rival news")
+
+    def test_a_coach_manager_can_create_a_draft(self):
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_create", {"title": "Season Kickoff", "body": "Big news.", "visibility": News.Visibility.INTERNAL, "teams": [str(self.team.pk)]})
+
+        item = News.objects.get(club=self.club, title="Season Kickoff")
+        self.assertRedirects(response, reverse("management:news_detail", args=[item.pk]))
+        self.assertEqual(item.status, News.Status.DRAFT)
+
+    def test_plain_staff_cannot_create_news(self):
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("news_create", {"title": "Not allowed", "body": "Body.", "visibility": News.Visibility.INTERNAL})
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(News.objects.filter(club=self.club, title="Not allowed").exists())
+
+    def test_coach_manager_cannot_publish(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_publish", {"published_at": "2026-08-10T10:00"}, item.pk)
+
+        self.assertEqual(response.status_code, 403)
+        item.refresh_from_db()
+        self.assertEqual(item.status, News.Status.DRAFT)
+
+    def test_editor_can_publish(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+        self.client.force_login(self.make_editor())
+
+        self.club_post("news_publish", {"published_at": "2026-08-10T10:00"}, item.pk)
+
+        item.refresh_from_db()
+        self.assertEqual(item.status, News.Status.PUBLISHED)
+
+    def test_publishing_with_a_future_date_leaves_it_scheduled(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+        self.client.force_login(self.make_editor())
+        future = timezone.now() + datetime.timedelta(days=7)
+
+        self.club_post("news_publish", {"published_at": future.strftime("%Y-%m-%dT%H:%M")}, item.pk)
+
+        item.refresh_from_db()
+        self.assertTrue(item.is_scheduled)
+
+    def test_publishing_with_now_makes_it_live_immediately(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+        self.client.force_login(self.make_editor())
+
+        self.club_post("news_publish", {"published_at": timezone.now().strftime("%Y-%m-%dT%H:%M")}, item.pk)
+
+        item.refresh_from_db()
+        self.assertFalse(item.is_scheduled)
+
+    def test_unpublishing_reverts_to_draft(self):
+        item = News.objects.create(club=self.club, title="Live item", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_editor())
+
+        self.club_post("news_unpublish", {}, item.pk)
+
+        item.refresh_from_db()
+        self.assertEqual(item.status, News.Status.DRAFT)
+        self.assertIsNone(item.published_at)
+
+    def test_a_coach_manager_can_edit_someone_elses_draft(self):
+        item = News.objects.create(club=self.club, title="Old title", body="Body.")
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("news_update", {"title": "New title", "body": "Body.", "visibility": News.Visibility.INTERNAL}, item.pk)
+
+        item.refresh_from_db()
+        self.assertEqual(item.title, "New title")
+
+    def test_a_coach_manager_cannot_edit_once_published(self):
+        item = News.objects.create(club=self.club, title="Old title", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_update", {"title": "New title", "body": "Body.", "visibility": News.Visibility.INTERNAL}, item.pk)
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_an_editor_can_still_edit_once_published(self):
+        item = News.objects.create(club=self.club, title="Old title", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_editor())
+
+        self.club_post("news_update", {"title": "New title", "body": "Body.", "visibility": News.Visibility.INTERNAL}, item.pk)
+
+        item.refresh_from_db()
+        self.assertEqual(item.title, "New title")
+
+    def test_uploading_multiple_photos_creates_one_per_file_and_marks_the_first_main(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        self.client.force_login(self.make_coach_manager())
+        images = [
+            SimpleUploadedFile("one.jpg", b"fake-bytes-one", content_type="image/jpeg"),
+            SimpleUploadedFile("two.jpg", b"fake-bytes-two", content_type="image/jpeg"),
+        ]
+
+        self.club_post("news_photo_upload", {"images": images}, item.pk)
+
+        self.assertEqual(item.photos.count(), 2)
+        self.assertEqual(item.photos.filter(is_main=True).count(), 1)
+
+    def test_set_main_moves_the_main_flag(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        first = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("one.jpg", b"one", content_type="image/jpeg"), is_main=True)
+        second = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("two.jpg", b"two", content_type="image/jpeg"), is_main=False)
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("news_photo_set_main", {}, item.pk, second.pk)
+
+        first.refresh_from_db()
+        second.refresh_from_db()
+        self.assertFalse(first.is_main)
+        self.assertTrue(second.is_main)
+
+    def test_deleting_a_photo_removes_it(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        photo = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("one.jpg", b"one", content_type="image/jpeg"))
+        photo_path = photo.image.path
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("news_photo_delete", {}, item.pk, photo.pk)
+
+        self.assertFalse(NewsPhoto.objects.filter(pk=photo.pk).exists())
+        self.assertFalse(os.path.exists(photo_path))
+
+    def test_deleting_the_main_photo_promotes_another_one(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        main = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("one.jpg", b"one", content_type="image/jpeg"), is_main=True)
+        other = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("two.jpg", b"two", content_type="image/jpeg"), is_main=False)
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("news_photo_delete", {}, item.pk, main.pk)
+
+        other.refresh_from_db()
+        self.assertTrue(other.is_main)
+
+    def test_deleting_the_only_photo_leaves_nothing_to_promote(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        photo = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("one.jpg", b"one", content_type="image/jpeg"), is_main=True)
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_photo_delete", {}, item.pk, photo.pk)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(item.photos.count(), 0)
+
+    def test_a_coach_manager_can_delete_a_draft(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_delete", {}, item.pk)
+
+        self.assertRedirects(response, reverse("management:news_list"))
+        self.assertFalse(News.objects.filter(pk=item.pk).exists())
+
+    def test_a_coach_manager_cannot_delete_once_published(self):
+        item = News.objects.create(club=self.club, title="Live item", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("news_delete", {}, item.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(News.objects.filter(pk=item.pk).exists())
+
+    def test_an_editor_can_delete_once_published(self):
+        item = News.objects.create(club=self.club, title="Live item", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_editor())
+
+        self.club_post("news_delete", {}, item.pk)
+
+        self.assertFalse(News.objects.filter(pk=item.pk).exists())
+
+    def test_deleting_a_news_item_removes_its_photos(self):
+        item = News.objects.create(club=self.club, title="Match report", body="Body.")
+        photo = NewsPhoto.objects.create(news_item=item, image=SimpleUploadedFile("one.jpg", b"one", content_type="image/jpeg"))
+        photo_path = photo.image.path
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("news_delete", {}, item.pk)
+
+        self.assertFalse(NewsPhoto.objects.filter(pk=photo.pk).exists())
+        self.assertFalse(os.path.exists(photo_path))
+
+    def test_the_edit_and_delete_buttons_are_hidden_once_published_for_a_coach_manager(self):
+        item = News.objects.create(club=self.club, title="Live item", body="Body.")
+        item.publish()
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_get("news_list")
+
+        self.assertNotContains(response, reverse("management:news_update", args=[item.pk]))
+
+
+class TeamAttendancePanelTests(ManagementTestBase):
+    """The attendance KPI panel on the team page -- see
+    management.views.TeamDetailView and events.services.attendance."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.position = Position.objects.create(club=self.club, name="Forward", short_name="FW", staff_position=False)
+        self.player = Member.objects.create(first_name="Peter", last_name="Player")
+        ClubMembership.objects.create(club=self.club, member=self.player, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.position)
+
+    def make_past_training(self, days_ago=1):
+        event = Event.objects.create(club=self.club, title="Practice", kind=Event.EventKind.TRAINING, season=self.season, start=timezone.now() - datetime.timedelta(days=days_ago))
+        event.teams.add(self.team)
+        return event
+
+    def test_attendance_panel_shows_the_rate_and_rankings(self):
+        event = self.make_past_training()
+        Attendance.objects.create(event=event, member=self.player, status=Attendance.AttendanceStatus.PRESENT)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "Attendance rate")
+        self.assertContains(response, "Peter Player")
+
+    def test_a_present_rsvp_without_a_check_in_is_never_a_no_show(self):
+        event = self.make_past_training()
+        Attendance.objects.create(event=event, member=self.player, status=Attendance.AttendanceStatus.PRESENT)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "None recorded.")
+
+    def test_a_checked_in_no_show_appears_in_the_panel(self):
+        event = self.make_past_training()
+        attendance = Attendance.objects.create(event=event, member=self.player, status=Attendance.AttendanceStatus.PRESENT, showed_up=False)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_detail", self.team.pk)
+
+        self.assertContains(response, "Peter Player")
+        self.assertContains(response, attendance.event.title)
+        self.assertNotContains(response, "None recorded.")
+
+
+class TeamAndPositionAccessTests(ManagementTestBase):
+    """Non-admin coaches/managers: scoped to their own teams, read-only on
+    positions -- see club.mixins.TeamManagerRequiredMixin and
+    management.views.TeamListView/PositionListView."""
+
+    def setUp(self):
+        super().setUp()
+        self.own_team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.manager_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+        self.coach_user = User.objects.create_user(email="coach3@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=self.coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=self.own_team, member=coach_member, season=self.season, position=self.manager_position)
+
+    def test_a_coach_only_sees_their_own_team_in_the_list(self):
+        self.client.force_login(self.coach_user)
+
+        response = self.club_get("team_list")
+
+        self.assertContains(response, "First Team")
+        self.assertNotContains(response, "Second Team")
+
+    def test_an_admin_sees_every_team_in_the_list(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("team_list")
+
+        self.assertContains(response, "First Team")
+        self.assertContains(response, "Second Team")
+
+    def test_a_coach_does_not_see_the_new_team_button(self):
+        self.client.force_login(self.coach_user)
+
+        response = self.club_get("team_list")
+
+        self.assertNotContains(response, reverse("management:team_create"))
+
+    def test_a_coach_does_not_see_the_edit_button_on_their_team_page(self):
+        self.client.force_login(self.coach_user)
+
+        response = self.club_get("team_detail", self.own_team.pk)
+
+        self.assertNotContains(response, reverse("management:team_update", args=[self.own_team.pk]))
+
+    def test_a_coach_can_view_positions_but_not_edit_them(self):
+        self.client.force_login(self.coach_user)
+
+        response = self.club_get("position_list")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Head Coach")
+        self.assertNotContains(response, reverse("management:position_create"))
+        self.assertNotContains(response, reverse("management:position_update", args=[self.manager_position.pk]))
+
+    def test_a_coach_cannot_create_or_edit_a_position(self):
+        self.client.force_login(self.coach_user)
+
+        self.assertEqual(self.club_get("position_create").status_code, 403)
+        self.assertEqual(self.club_get("position_update", self.manager_position.pk).status_code, 403)
+
+
+class TeamListCountsTests(ManagementTestBase):
+    """Player/staff counts on the team list -- see TeamListView.get_queryset."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.player_position = Position.objects.create(club=self.club, name="Forward", short_name="FW", staff_position=False)
+        self.coach_position = Position.objects.create(club=self.club, name="Coach", short_name="C", staff_position=True, management_position=True)
+        self.client.force_login(self.admin_user)
+
+    def test_counts_reflect_the_current_seasons_roster_and_staff(self):
+        peter = Member.objects.create(first_name="Peter", last_name="Player")
+        paula = Member.objects.create(first_name="Paula", last_name="Player")
+        cara = Member.objects.create(first_name="Cara", last_name="Coach")
+        TeamMembership.objects.create(team=self.team, season=self.season, member=peter, position=self.player_position)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=paula, position=self.player_position)
+        StaffAssignment.objects.create(team=self.team, season=self.season, member=cara, position=self.coach_position)
+
+        response = self.club_get("team_list")
+
+        team = response.context["teams"].get(pk=self.team.pk)
+        self.assertEqual(team.player_count, 2)
+        self.assertEqual(team.staff_count, 1)
+
+    def test_counts_exclude_a_different_season(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2020, 1, 1), end_date=datetime.date(2020, 12, 31))
+        peter = Member.objects.create(first_name="Peter", last_name="Player")
+        TeamMembership.objects.create(team=self.team, season=other_season, member=peter, position=self.player_position)
+
+        response = self.club_get("team_list")
+
+        team = response.context["teams"].get(pk=self.team.pk)
+        self.assertEqual(team.player_count, 0)
+
+
+class LocationOpponentManagementTests(ManagementTestBase):
+    """Full CRUD for Location/Opponent -- restricted to ADMIN and anyone with a
+    current-season management position, see club.mixins.ManagementPositionRequiredMixin
+    and management.views.LocationListView/OpponentListView (and their Create/Update/Delete
+    siblings)."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+
+    def make_coach_manager(self, email="coach-loc@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=self.team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def make_plain_staff(self, email="physio-loc@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=self.team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+    # --- Locations ---------------------------------------------------------
+
+    def test_a_management_position_can_view_the_location_list(self):
+        Location.objects.create(club=self.club, name="Main Field", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_get("location_list")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Main Field")
+
+    def test_the_location_form_renders_country_as_a_dropdown(self):
+        # Regression: CountryField's widget reports widget_type "lazyselect", which
+        # the form_field templatetag didn't recognise -- it fell through to the
+        # "input" case and rendered a plain <input type="lazyselect"> (i.e. a
+        # broken text box), not a <select>.
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_get("location_create")
+
+        self.assertNotContains(response, 'type="lazyselect"')
+        self.assertContains(response, "Belgium")
+        self.assertContains(response, '<select')
+
+    def test_plain_staff_cannot_view_the_location_list(self):
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("location_list").status_code, 403)
+
+    def test_a_management_position_can_create_a_location(self):
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("location_create", {"name": "New Field", "address": "2 St", "city": "Town", "zip_code": "1000", "country": "BE"})
+
+        self.assertRedirects(response, reverse("management:location_list"))
+        self.assertTrue(Location.objects.filter(club=self.club, name="New Field").exists())
+
+    def test_plain_staff_cannot_create_a_location(self):
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("location_create", {"name": "New Field", "address": "2 St", "city": "Town", "zip_code": "1000", "country": "BE"})
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(Location.objects.filter(club=self.club, name="New Field").exists())
+
+    def test_a_management_position_can_edit_a_location(self):
+        location = Location.objects.create(club=self.club, name="Old name", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.client.force_login(self.make_coach_manager())
+
+        self.club_post("location_update", {"name": "New name", "address": "1 St", "city": "Town", "zip_code": "1000", "country": "BE"}, location.pk)
+
+        location.refresh_from_db()
+        self.assertEqual(location.name, "New name")
+
+    def test_a_management_position_can_delete_a_location(self):
+        location = Location.objects.create(club=self.club, name="Doomed", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("location_delete", {}, location.pk)
+
+        self.assertRedirects(response, reverse("management:location_list"))
+        self.assertFalse(Location.objects.filter(pk=location.pk).exists())
+
+    def test_deleting_a_location_nulls_it_on_events_instead_of_erroring(self):
+        location = Location.objects.create(club=self.club, name="Doomed", address="1 St", city="Town", zip_code="1000", country="BE")
+        event = Event.objects.create(club=self.club, title="Match", start=timezone.now() + datetime.timedelta(days=1), location=location)
+        self.client.force_login(self.admin_user)
+
+        self.club_post("location_delete", {}, location.pk)
+
+        event.refresh_from_db()
+        self.assertIsNone(event.location)
+
+    def test_an_admin_has_full_rights_without_any_staff_assignment(self):
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("location_list").status_code, 200)
+        response = self.club_post("location_create", {"name": "Admin Field", "address": "3 St", "city": "Town", "zip_code": "1000", "country": "BE"})
+        self.assertRedirects(response, reverse("management:location_list"))
+
+    # --- Opponents -----------------------------------------------------------
+
+    def test_a_management_position_can_view_the_opponent_list(self):
+        Opponent.objects.create(club=self.club, name="Rivals FC")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_get("opponent_list")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Rivals FC")
+
+    def test_plain_staff_cannot_view_the_opponent_list(self):
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("opponent_list").status_code, 403)
+
+    def test_a_management_position_can_create_an_opponent_with_a_logo(self):
+        self.client.force_login(self.make_coach_manager())
+        # Opponent.logo is a real ImageField (unlike NewsPhoto.image, set outside any
+        # ModelForm) -- Django's ImageField.clean() runs it through Pillow, so this
+        # needs to actually decode as an image, not just carry an image/png header.
+        one_pixel_png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\x00\x01\x00\x00\x05\x00\x01\r\n-\xb4\x00\x00\x00\x00IEND\xaeB`\x82"
+        logo = SimpleUploadedFile("logo.png", one_pixel_png, content_type="image/png")
+
+        response = self.club_post("opponent_create", {"name": "Rivals FC", "logo": logo})
+
+        self.assertRedirects(response, reverse("management:opponent_list"))
+        opponent = Opponent.objects.get(club=self.club, name="Rivals FC")
+        self.assertTrue(opponent.logo)
+
+    def test_a_management_position_can_delete_an_opponent(self):
+        opponent = Opponent.objects.create(club=self.club, name="Doomed FC")
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("opponent_delete", {}, opponent.pk)
+
+        self.assertRedirects(response, reverse("management:opponent_list"))
+        self.assertFalse(Opponent.objects.filter(pk=opponent.pk).exists())
+
+    def test_plain_staff_cannot_delete_an_opponent(self):
+        opponent = Opponent.objects.create(club=self.club, name="Safe FC")
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("opponent_delete", {}, opponent.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(Opponent.objects.filter(pk=opponent.pk).exists())
+
+
+class SponsorManagementTests(ManagementTestBase):
+    """Full CRUD for Sponsor -- admin-only, unlike Location/Opponent which any
+    management position can maintain (see club.mixins.ClubAdminRequiredMixin
+    and management.views.Sponsor*View)."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+
+    def make_coach_manager(self, email="coach-sponsor@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=self.team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def sponsor_data(self, **overrides):
+        data = {"name": "Acme Corp", "url": "https://acme.example.com", "start_date": "2026-01-01", "end_date": ""}
+        data.update(overrides)
+        return data
+
+    def test_an_admin_can_view_the_sponsor_list(self):
+        Sponsor.objects.create(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("sponsor_list")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Acme Corp")
+
+    def test_a_management_position_cannot_view_the_sponsor_list(self):
+        self.client.force_login(self.make_coach_manager())
+
+        self.assertEqual(self.club_get("sponsor_list").status_code, 403)
+
+    def test_plain_staff_cannot_view_the_sponsor_list(self):
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("sponsor_list").status_code, 403)
+
+    def test_an_admin_can_create_a_sponsor_with_a_logo(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("sponsor_create", self.sponsor_data(logo=make_image_file()))
+
+        self.assertRedirects(response, reverse("management:sponsor_list"))
+        sponsor = Sponsor.objects.get(club=self.club, name="Acme Corp")
+        self.assertTrue(sponsor.logo)
+
+    def test_a_management_position_cannot_create_a_sponsor(self):
+        self.client.force_login(self.make_coach_manager())
+
+        response = self.club_post("sponsor_create", self.sponsor_data())
+
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(Sponsor.objects.filter(club=self.club, name="Acme Corp").exists())
+
+    def test_an_end_date_before_the_start_date_is_a_form_error_not_a_500(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("sponsor_create", self.sponsor_data(start_date="2026-06-01", end_date="2026-01-01"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "before the start date")
+        self.assertFalse(Sponsor.objects.filter(club=self.club).exists())
+
+    def test_an_admin_can_edit_a_sponsor(self):
+        sponsor = Sponsor.objects.create(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("sponsor_update", self.sponsor_data(name="Acme Corp Renamed"), sponsor.pk)
+
+        self.assertRedirects(response, reverse("management:sponsor_list"))
+        sponsor.refresh_from_db()
+        self.assertEqual(sponsor.name, "Acme Corp Renamed")
+
+    def test_plain_staff_cannot_edit_a_sponsor(self):
+        sponsor = Sponsor.objects.create(club=self.club, name="Acme Corp", start_date=datetime.date(2026, 1, 1))
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("sponsor_update", self.sponsor_data(), sponsor.pk)
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_an_admin_can_delete_a_sponsor(self):
+        sponsor = Sponsor.objects.create(club=self.club, name="Doomed Corp", start_date=datetime.date(2026, 1, 1))
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("sponsor_delete", {}, sponsor.pk)
+
+        self.assertRedirects(response, reverse("management:sponsor_list"))
+        self.assertFalse(Sponsor.objects.filter(pk=sponsor.pk).exists())
+
+    def test_plain_staff_cannot_delete_a_sponsor(self):
+        sponsor = Sponsor.objects.create(club=self.club, name="Safe Corp", start_date=datetime.date(2026, 1, 1))
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("sponsor_delete", {}, sponsor.pk)
+
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(Sponsor.objects.filter(pk=sponsor.pk).exists())
+
+    def test_nav_only_shows_sponsors_for_an_admin(self):
+        self.client.force_login(self.admin_user)
+        self.assertContains(self.club_get("home"), "Sponsors")
+
+        self.client.force_login(self.make_coach_manager())
+        self.assertNotContains(self.club_get("home"), "Sponsors")
+
+    def make_plain_staff(self, email="physio-sponsor@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=self.team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+
+class BillingEndingBannerTests(ManagementTestBase):
+    """The club dashboard's "billing is about to stop" warning -- see
+    management.views.HomeView and management/templates/management/home.html.
+    Admin-only, and only within RENEWAL_LEAD_DAYS of the current period ending."""
+
+    def setUp(self):
+        super().setUp()
+        self.tier = Tier.objects.create(name="Standard")
+        TierPrice.objects.create(tier=self.tier, active_from=self.season.start_date - datetime.timedelta(days=1200), amount=Decimal("500.00"))
+
+    def test_admin_sees_the_banner_when_the_period_ends_soon(self):
+        subscribe(self.club, self.tier, start=timezone.localdate() - datetime.timedelta(days=350), auto_renew=False)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertContains(response, "billing is about to stop")
+
+    def test_admin_does_not_see_the_banner_when_the_period_is_not_ending_soon(self):
+        subscribe(self.club, self.tier, start=timezone.localdate())
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertNotContains(response, "billing is about to stop")
+
+    def test_a_non_admin_manager_never_sees_the_banner(self):
+        subscribe(self.club, self.tier, start=timezone.localdate() - datetime.timedelta(days=350), auto_renew=False)
+        team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        position = Position.objects.create(club=self.club, name="Coach", short_name="C", staff_position=True, management_position=True)
+        coach_user = User.objects.create_user(email="coach-banner@example.com", password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=position)
+        self.client.force_login(coach_user)
+
+        response = self.club_get("home")
+
+        self.assertNotContains(response, "billing is about to stop")
+
+    def test_a_club_with_no_subscription_shows_no_banner(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertNotContains(response, "billing is about to stop")
+        self.assertNotContains(response, "will renew automatically")
+
+    def test_an_auto_renewing_club_gets_a_reassuring_banner_instead(self):
+        subscribe(self.club, self.tier, start=timezone.localdate() - datetime.timedelta(days=350), auto_renew=True)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertContains(response, "will renew automatically")
+        self.assertNotContains(response, "billing is about to stop")
+
+
+class RecurrenceUiTests(TestCase):
+    """management.recurrence_ui's friendly builder <-> raw RRULE round-trip."""
+
+    def test_weekly_round_trips(self):
+        rrule = build_rrule("weekly", 2, ["WE", "MO"])
+
+        self.assertEqual(rrule, "FREQ=WEEKLY;INTERVAL=2;BYDAY=MO,WE")
+        self.assertEqual(parse_rrule(rrule), {"frequency": "weekly", "interval": 2, "weekdays": ["MO", "WE"]})
+        self.assertEqual(str(describe_rrule(rrule)), "Every 2 weeks on Mon, Wed")
+
+    def test_monthly_round_trips(self):
+        rrule = build_rrule("monthly", 1)
+
+        self.assertEqual(rrule, "FREQ=MONTHLY;INTERVAL=1")
+        self.assertEqual(parse_rrule(rrule), {"frequency": "monthly", "interval": 1, "weekdays": []})
+        self.assertEqual(str(describe_rrule(rrule)), "Every month")
+
+    def test_an_unrecognised_rrule_falls_back_to_the_raw_string(self):
+        self.assertIsNone(parse_rrule("FREQ=DAILY;COUNT=5"))
+        self.assertEqual(describe_rrule("FREQ=DAILY;COUNT=5"), "FREQ=DAILY;COUNT=5")
+
+
+class EventManagementTests(ManagementTestBase):
+    """Event CRUD -- permissions are scoped per-team (like roster/staff), not
+    club-wide, since an event's teams field is M2M: a manager of at least one
+    of an event's current teams can edit it, see club.mixins.EventManagerRequiredMixin."""
+
+    def setUp(self):
+        super().setUp()
+        self.own_team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+    def make_coach(self, team, email="coach-events@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=self.coach_position)
+        return coach_user
+
+    def make_plain_staff(self, email="physio-events@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=self.own_team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+    def event_data(self, **overrides):
+        data = {
+            "title": "Training",
+            "kind": "training",
+            "teams": [str(self.own_team.pk)],
+            "invited_members": [],
+            "excluded_members": [],
+            "location": "",
+            "opponent": "",
+            "start": "2026-09-01T18:00",
+            "end": "",
+            "gathering": "",
+            "deadline": "",
+        }
+        data.update(overrides)
+        return data
+
+    def test_a_team_manager_can_create_an_event_for_their_own_team(self):
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_post("event_create", self.event_data())
+
+        event = Event.objects.get(title="Training")
+        self.assertRedirects(response, reverse("management:event_detail", args=[event.pk]))
+        self.assertIn(self.own_team, event.teams.all())
+
+    def test_creating_an_event_with_a_same_club_location_does_not_raise_a_cross_club_error(self):
+        # Regression: Event.clean() rejects a location from another club by
+        # comparing against self.club_id, which was still None on a brand-new
+        # instance at validation time (club is only auto-assigned in save(),
+        # which runs after full_clean()) -- so a same-club location falsely
+        # failed as "must belong to the same club". See EventCreateView.get_form_kwargs.
+        location = Location.objects.create(club=self.club, name="Home Ground", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_post("event_create", self.event_data(location=str(location.pk)))
+
+        event = Event.objects.get(title="Training")
+        self.assertRedirects(response, reverse("management:event_detail", args=[event.pk]))
+        self.assertEqual(event.location, location)
+
+    def test_the_new_event_forms_competition_dropdown_shows_every_competition_regardless_of_flag(self):
+        # Unlike the Django-admin form, this dropdown isn't filtered by whether the
+        # competition's flag is active for the club -- see management.forms.EventForm
+        # and events.services.competitions.fetch_game_info (which is where that
+        # per-club gate actually lives).
+        Competition.objects.create(name="Active Cup", module="events.competition.active")
+        Competition.objects.create(name="Inactive Cup", module="events.competition.inactive")
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_create")
+
+        self.assertContains(response, "Active Cup")
+        self.assertContains(response, "Inactive Cup")
+
+    def test_creating_a_game_with_a_competition_selected(self):
+        Competition.objects.create(name="Regional Cup", module="events.competition.regional")
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_post("event_create", self.event_data(kind="game", competition="Regional Cup"))
+
+        event = Event.objects.get(title="Training")
+        self.assertRedirects(response, reverse("management:event_detail", args=[event.pk]))
+        self.assertEqual(event.competition, "Regional Cup")
+
+    def test_a_team_manager_cannot_create_an_event_for_a_team_they_dont_manage(self):
+        self.client.force_login(self.make_coach(self.own_team))
+
+        self.club_post("event_create", self.event_data(teams=[str(self.other_team.pk)]))
+
+        self.assertFalse(Event.objects.filter(title="Training").exists())
+
+    def test_a_plain_staff_member_gets_403_creating_an_event(self):
+        self.client.force_login(self.make_plain_staff())
+
+        response = self.club_post("event_create", self.event_data())
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_a_plain_staff_member_can_still_view_the_event_list(self):
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("event_list").status_code, 200)
+
+    def test_the_list_shows_edit_and_delete_only_for_events_the_manager_manages(self):
+        own_event = Event.objects.create(club=self.club, title="My event", start=timezone.now() + datetime.timedelta(days=1))
+        own_event.teams.add(self.own_team)
+        other_event = Event.objects.create(club=self.club, title="Other event", start=timezone.now() + datetime.timedelta(days=2))
+        other_event.teams.add(self.other_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_list")
+
+        # The Edit link goes to the detail page, not straight to the edit form (same
+        # convention as Teams/News), so what actually distinguishes a manageable row
+        # is the delete action being present.
+        self.assertContains(response, reverse("management:event_delete", args=[own_event.pk]))
+        self.assertNotContains(response, reverse("management:event_delete", args=[other_event.pk]))
+
+    def test_a_manager_only_sees_events_for_teams_they_manage(self):
+        own_event = Event.objects.create(club=self.club, title="My event", start=timezone.now() + datetime.timedelta(days=1))
+        own_event.teams.add(self.own_team)
+        other_event = Event.objects.create(club=self.club, title="Other event", start=timezone.now() + datetime.timedelta(days=2))
+        other_event.teams.add(self.other_team)
+        Event.objects.create(club=self.club, title="AGM", start=timezone.now() + datetime.timedelta(days=3))
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_list")
+
+        self.assertContains(response, "My event")
+        self.assertNotContains(response, "Other event")
+        self.assertContains(response, "AGM")  # team-less events stay visible to everyone
+
+    def test_an_admin_sees_every_event_regardless_of_team(self):
+        own_event = Event.objects.create(club=self.club, title="My event", start=timezone.now() + datetime.timedelta(days=1))
+        own_event.teams.add(self.own_team)
+        other_event = Event.objects.create(club=self.club, title="Other event", start=timezone.now() + datetime.timedelta(days=2))
+        other_event.teams.add(self.other_team)
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("event_list")
+
+        self.assertContains(response, "My event")
+        self.assertContains(response, "Other event")
+
+    def test_a_manager_cannot_open_another_teams_event_by_url(self):
+        other_event = Event.objects.create(club=self.club, title="Other event", start=timezone.now() + datetime.timedelta(days=2))
+        other_event.teams.add(self.other_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_detail", other_event.pk)
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_the_dashboard_only_shows_upcoming_events_for_managed_teams(self):
+        own_event = Event.objects.create(club=self.club, title="My event", start=timezone.now() + datetime.timedelta(days=1))
+        own_event.teams.add(self.own_team)
+        other_event = Event.objects.create(club=self.club, title="Other event", start=timezone.now() + datetime.timedelta(days=2))
+        other_event.teams.add(self.other_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("home")
+
+        self.assertContains(response, "My event")
+        self.assertNotContains(response, "Other event")
+
+    def test_a_team_less_event_is_refused_for_a_non_admin(self):
+        self.client.force_login(self.make_coach(self.own_team))
+
+        self.club_post("event_create", self.event_data(teams=[]))
+
+        self.assertFalse(Event.objects.filter(title="Training").exists())
+
+    def test_an_admin_can_create_a_team_less_event(self):
+        self.client.force_login(self.admin_user)
+
+        self.club_post("event_create", self.event_data(teams=[]))
+
+        self.assertTrue(Event.objects.filter(title="Training").exists())
+
+    def test_a_manager_of_one_team_cannot_edit_an_event_for_another_team(self):
+        event = Event.objects.create(club=self.club, title="Other's event", start=timezone.now() + datetime.timedelta(days=1))
+        event.teams.add(self.other_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_update", event.pk)
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_a_manager_can_edit_their_own_teams_event(self):
+        event = Event.objects.create(club=self.club, title="My event", start=timezone.now() + datetime.timedelta(days=1))
+        event.teams.add(self.own_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        self.club_post("event_update", self.event_data(title="Renamed"), event.pk)
+
+        event.refresh_from_db()
+        self.assertEqual(event.title, "Renamed")
+
+    def test_deleting_a_one_off_event_deletes_it(self):
+        event = Event.objects.create(club=self.club, title="Gone", start=timezone.now() + datetime.timedelta(days=1))
+        event.teams.add(self.own_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        self.club_post("event_delete", {}, event.pk)
+
+        self.assertFalse(Event.objects.filter(pk=event.pk).exists())
+
+    def test_creating_a_game_records_competition_and_external_id_but_not_score(self):
+        # Score/live status don't exist yet for a game that's only just being
+        # scheduled -- the add form doesn't even offer those fields (see
+        # test_the_add_form_has_no_score_or_live_fields below), so posting them
+        # here has no effect.
+        Competition.objects.create(name="Regional Cup", module="events.competition.regional")
+        self.client.force_login(self.make_coach(self.own_team))
+
+        self.club_post("event_create", self.event_data(kind="game", competition="Regional Cup", external_game_id="ext-42", score_for="3", score_against="1", is_live="on"))
+
+        game = Event.objects.get(title="Training")
+        self.assertEqual(game.kind, Event.EventKind.GAME)
+        self.assertEqual(game.competition, "Regional Cup")
+        self.assertEqual(game.external_game_id, "ext-42")
+        self.assertIsNone(game.score_for)
+        self.assertFalse(game.is_live)
+
+    def test_the_add_form_has_no_score_or_live_fields(self):
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_create")
+
+        self.assertNotContains(response, 'name="score_for"')
+        self.assertNotContains(response, 'name="is_live"')
+        self.assertContains(response, 'name="competition"')
+
+    def test_editing_a_game_can_record_its_score_and_live_status(self):
+        Competition.objects.create(name="Regional Cup", module="events.competition.regional")
+        game = Event.objects.create(club=self.club, title="Cup game", kind=Event.EventKind.GAME, start=timezone.now() + datetime.timedelta(days=1))
+        game.teams.add(self.own_team)
+        self.client.force_login(self.make_coach(self.own_team))
+
+        response = self.club_get("event_update", game.pk)
+        self.assertContains(response, 'name="score_for"')
+        self.assertContains(response, 'name="is_live"')
+
+        self.club_post("event_update", self.event_data(kind="game", competition="Regional Cup", external_game_id="ext-42", score_for="3", score_against="1", is_live="on"), game.pk)
+
+        game.refresh_from_db()
+        self.assertEqual(game.score_for, 3)
+        self.assertEqual(game.score_against, 1)
+        self.assertTrue(game.is_live)
+
+    def test_the_game_kind_choice_is_no_longer_called_match(self):
+        self.assertNotIn("match", dict(Event.EventKind.choices))
+        self.assertEqual(dict(Event.EventKind.choices)["game"], "Game")
+
+
+class EventSeriesManagementTests(ManagementTestBase):
+    """EventSeries CRUD + occurrence lifecycle actions (cancel/detach/stop)."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.other_team = Team.objects.create(club=self.club, name="Second Team", short_name="2nd")
+        self.coach_position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+
+    def make_coach(self, team, email="coach-series@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        StaffAssignment.objects.create(team=team, member=coach_member, season=self.season, position=self.coach_position)
+        return coach_user
+
+    def series_data(self, **overrides):
+        data = {
+            "title": "Weekly training",
+            "kind": "training",
+            "dtstart": "2026-09-01T18:00",
+            "until": "",
+            "teams": [str(self.team.pk)],
+            "invited_members": [],
+            "excluded_members": [],
+            "location": "",
+            "opponent": "",
+            "frequency": "weekly",
+            "interval": "1",
+            "weekdays": ["MO", "WE"],
+            "duration_hours": "1",
+            "duration_minutes": "0",
+            "gathering_minutes_before": "",
+            "deadline_minutes_before": "",
+            "advanced_rrule": "",
+        }
+        data.update(overrides)
+        return data
+
+    def create_series(self):
+        self.club_post("event_series_create", self.series_data())
+        return EventSeries.objects.get(title="Weekly training")
+
+    def test_creating_a_series_with_a_same_club_location_does_not_raise_a_cross_club_error(self):
+        # Same regression as EventManagementTests' equivalent -- EventSeries.clean()
+        # has the same self.club_id-is-still-None-at-validation-time problem.
+        location = Location.objects.create(club=self.club, name="Home Ground", address="1 St", city="Town", zip_code="1000", country="BE")
+        self.client.force_login(self.make_coach(self.team))
+
+        response = self.club_post("event_series_create", self.series_data(location=str(location.pk)))
+
+        series = EventSeries.objects.get(title="Weekly training")
+        self.assertRedirects(response, reverse("management:event_series_detail", args=[series.pk]))
+        self.assertEqual(series.location, location)
+
+    def test_creating_a_series_generates_occurrences_immediately(self):
+        self.client.force_login(self.make_coach(self.team))
+
+        series = self.create_series()
+
+        self.assertTrue(series.occurrences.exists())
+
+    def test_editing_a_series_propagates_to_future_occurrences_but_not_a_detached_one(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        detached = series.occurrences.filter(start__gte=timezone.now()).order_by("start").first()
+        other = series.occurrences.exclude(pk=detached.pk).filter(start__gte=timezone.now()).first()
+        detach_occurrence(detached)
+
+        self.club_post("event_series_update", self.series_data(title="Renamed training"), series.pk)
+
+        detached.refresh_from_db()
+        other.refresh_from_db()
+        self.assertEqual(detached.title, "Weekly training")
+        self.assertEqual(other.title, "Renamed training")
+
+    def test_cancelling_an_occurrence_records_an_excluded_date_not_a_raw_delete(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        occurrence = series.occurrences.order_by("start").first()
+        start_iso = occurrence.start.isoformat()
+
+        self.club_post("event_delete", {}, occurrence.pk)
+
+        self.assertFalse(Event.objects.filter(pk=occurrence.pk).exists())
+        series.refresh_from_db()
+        self.assertIn(start_iso, series.excluded_dates)
+
+    def test_cancelling_with_keep_record_marks_it_cancelled_instead_of_deleting(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        occurrence = series.occurrences.order_by("start").first()
+
+        self.club_post("event_delete", {"keep_record": "on"}, occurrence.pk)
+
+        occurrence.refresh_from_db()
+        self.assertTrue(occurrence.cancelled)
+
+    def test_stop_repeating_prevents_new_occurrences_without_touching_existing_ones(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        count_before = series.occurrences.count()
+
+        self.club_post("event_series_stop", {}, series.pk)
+        series.refresh_from_db()
+        generate_occurrences(series)
+
+        self.assertEqual(series.occurrences.count(), count_before)
+
+    def test_a_manager_of_a_different_team_cannot_edit_the_series(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        self.client.force_login(self.make_coach(self.other_team, email="other-coach@example.com"))
+
+        response = self.club_get("event_series_update", series.pk)
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_a_manager_of_a_different_team_cannot_view_the_series_either(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        self.client.force_login(self.make_coach(self.other_team, email="other-coach2@example.com"))
+
+        response = self.club_get("event_series_detail", series.pk)
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_deleting_a_series_deletes_its_occurrences(self):
+        self.client.force_login(self.make_coach(self.team))
+        series = self.create_series()
+        occurrence_ids = list(series.occurrences.values_list("pk", flat=True))
+
+        self.club_post("event_series_delete", {}, series.pk)
+
+        self.assertFalse(EventSeries.objects.filter(pk=series.pk).exists())
+        self.assertFalse(Event.objects.filter(pk__in=occurrence_ids).exists())
+
+
+class EventDetailDisplayTests(ManagementTestBase):
+    """The event detail page's RSVP breakdown/modal and the game "fetch info"
+    stub -- see management.views.EventDetailView/EventFetchGameInfoView and
+    events.services.competitions.fetch_game_info."""
+
+    def setUp(self):
+        super().setUp()
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.position = Position.objects.create(club=self.club, name="Forward", short_name="FW")
+        self.player = Member.objects.create(first_name="Peter", last_name="Player")
+        ClubMembership.objects.create(club=self.club, member=self.player, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        TeamMembership.objects.create(team=self.team, season=self.season, member=self.player, position=self.position)
+        self.client.force_login(self.admin_user)
+
+    def make_event(self, **kwargs):
+        kwargs.setdefault("title", "Training")
+        kwargs.setdefault("kind", Event.EventKind.TRAINING)
+        kwargs.setdefault("start", timezone.now() + datetime.timedelta(days=1))
+        event = Event.objects.create(club=self.club, **kwargs)
+        event.teams.add(self.team)
+        return event
+
+    def test_the_rsvp_breakdown_shows_every_status_even_at_zero(self):
+        event = self.make_event()
+
+        response = self.club_get("event_detail", event.pk)
+
+        for label in ["Present", "Absent", "Excused", "Selected", "Not selected", "Maybe", "No response"]:
+            self.assertContains(response, label)
+
+    def test_the_rsvp_modal_shows_who_responded_and_their_note(self):
+        event = self.make_event()
+        Attendance.objects.filter(event=event, member=self.player).update(status=Attendance.AttendanceStatus.PRESENT, note="Bringing the kit bag")
+
+        response = self.club_get("event_detail", event.pk)
+
+        self.assertContains(response, "Peter Player")
+        self.assertContains(response, "Bringing the kit bag")
+
+    def test_the_rsvp_modal_groups_responses_into_collapsible_status_sections(self):
+        event = self.make_event()
+        Attendance.objects.filter(event=event, member=self.player).update(status=Attendance.AttendanceStatus.PRESENT)
+
+        response = self.club_get("event_detail", event.pk)
+
+        self.assertContains(response, "<details")
+        self.assertContains(response, "collapse-arrow")
+
+    def test_the_details_card_shows_gathering_and_deadline_even_when_unset(self):
+        event = self.make_event()
+
+        response = self.club_get("event_detail", event.pk)
+
+        self.assertContains(response, "Gathering")
+        self.assertContains(response, "Registration deadline")
+
+    def test_the_fetch_button_only_shows_for_a_game_with_a_competition_set(self):
+        game_with_competition = self.make_event(title="Cup game", kind=Event.EventKind.GAME, competition="Regional Cup")
+        game_without_competition = self.make_event(title="Friendly game", kind=Event.EventKind.GAME)
+        training = self.make_event(title="Training session")
+
+        self.assertContains(self.club_get("event_detail", game_with_competition.pk), "Fetch new game info")
+        self.assertNotContains(self.club_get("event_detail", game_without_competition.pk), "Fetch new game info")
+        self.assertNotContains(self.club_get("event_detail", training.pk), "Fetch new game info")
+
+    def test_fetching_game_info_reports_that_nothing_is_configured_yet(self):
+        # The competition's flag must be active for this club, or fetch_game_info
+        # gates before ever getting as far as "no data source configured" -- see
+        # test_fetching_game_info_is_a_silent_no_op_when_the_flag_is_not_active.
+        Flag = get_waffle_flag_model()
+        flag = Flag.objects.create(name="regional-cup")
+        flag.clubs.add(self.club)
+        Competition.objects.create(name="Regional Cup", module="events.competition.regional", flag=flag)
+        game = self.make_event(title="Cup game", kind=Event.EventKind.GAME, competition="Regional Cup")
+
+        redirect = self.club_post("event_fetch_game_info", {}, game.pk)
+        response = self.club_get("event_detail", game.pk)
+
+        self.assertRedirects(redirect, reverse("management:event_detail", args=[game.pk]))
+        self.assertContains(response, "No competition data source is configured yet")
+
+    def test_fetching_game_info_is_a_silent_no_op_when_the_flag_is_not_active(self):
+        # No matching Competition row at all -- same "nothing to gate on" outcome
+        # as one that exists but whose flag isn't active for this club.
+        game = self.make_event(title="Cup game", kind=Event.EventKind.GAME, competition="Regional Cup")
+
+        redirect = self.club_post("event_fetch_game_info", {}, game.pk)
+        response = self.club_get("event_detail", game.pk)
+
+        self.assertRedirects(redirect, reverse("management:event_detail", args=[game.pk]))
+        self.assertNotContains(response, "No competition data source is configured yet")
+        self.assertContains(response, "is not enabled for this club")
+
+
+class FeatureGatedSectionsTests(ManagementTestBase):
+    """The Shop and Forms sections are still stubs (StubListMixin) and, on top
+    of being admin-only, only exist for a club at all once their own waffle
+    Flag ("shop" / "formbuilder") is active for it -- see
+    club.mixins.FeatureRequiredMixin and management.context_processors.feature_sections."""
+
+    def setUp(self):
+        super().setUp()
+        # waffle caches Flag lookups outside the DB transaction each test rolls
+        # back, so a flag created in one test can otherwise leak a stale/invalid
+        # pk into the next -- see FeatureViewTests in controlpanel/tests.py.
+        cache.clear()
+        self.addCleanup(cache.clear)
+
+    def activate(self, flag_name):
+        flag = get_waffle_flag_model().objects.create(name=flag_name)
+        flag.clubs.add(self.club)
+
+    def make_plain_staff(self, email="physio-features@example.com"):
+        staff_user = User.objects.create_user(email=email, password="pw-secret-123")
+        staff_member = Member.objects.create(user=staff_user, first_name="Pat", last_name="Physio")
+        ClubMembership.objects.create(club=self.club, member=staff_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        team = Team.objects.create(club=self.club, name="Physio Team", short_name="PHY")
+        position = Position.objects.create(club=self.club, name="Physio", short_name="PH", staff_position=True, management_position=False)
+        StaffAssignment.objects.create(team=team, member=staff_member, season=self.season, position=position)
+        return staff_user
+
+    def test_shop_views_404_when_the_flag_is_not_active(self):
+        self.client.force_login(self.admin_user)
+
+        for name in ["product_list", "order_list", "discount_list", "invoice_list"]:
+            with self.subTest(name=name):
+                self.assertEqual(self.club_get(name).status_code, 404)
+
+    def test_forms_view_404_when_the_flag_is_not_active(self):
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("form_list").status_code, 404)
+
+    def test_shop_views_are_reachable_once_the_flag_is_active(self):
+        self.activate("shop")
+        self.client.force_login(self.admin_user)
+
+        for name in ["product_list", "order_list", "discount_list", "invoice_list"]:
+            with self.subTest(name=name):
+                self.assertEqual(self.club_get(name).status_code, 200)
+
+    def test_forms_view_is_reachable_once_its_own_flag_is_active(self):
+        self.activate("formbuilder")
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("form_list").status_code, 200)
+
+    def test_the_shop_flag_does_not_also_enable_forms(self):
+        # Different flags -- see the "(but different feature)" ask.
+        self.activate("shop")
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("form_list").status_code, 404)
+
+    def test_a_non_admin_still_gets_404_not_403_when_the_flag_is_off(self):
+        # The section doesn't exist for this club at all -- not a permissions
+        # question, so even someone who'd otherwise be refused (403) for lack
+        # of admin rights sees the same 404 an admin would.
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("product_list").status_code, 404)
+
+    def test_a_non_admin_gets_403_once_the_flag_is_active(self):
+        self.activate("shop")
+        self.client.force_login(self.make_plain_staff())
+
+        self.assertEqual(self.club_get("product_list").status_code, 403)
+
+    def test_nav_hides_shop_and_forms_when_their_flags_are_off(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertNotContains(response, "Products")
+        self.assertNotContains(response, "Forms")
+
+    def test_nav_shows_shop_once_its_flag_is_active(self):
+        self.activate("shop")
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("home")
+
+        self.assertContains(response, "Products")
+        self.assertNotContains(response, "Forms")
+
+
+RBIHF_SAMPLE_HTML = """<html><body>
+<div class="block"><div class="block-header"><h2>Sportoase Antwerp Phantoms</h2></div></div>
+<div class="block"><div class="block-header"><h2 id="games-upcoming">Upcoming games</h2></div>
+<div class="block-content"><table>
+<tr><th class="game-nr">#</th><th class="date">Date</th><th class="hour">Hour</th><th>Location</th><th>Home</th><th>Visit</th></tr>
+<tr>
+<td class="game-nr"><a href="/game/5002" title="Game 5002">5002</a></td>
+<td class="date">2026-09-12</td>
+<td class="hour">12:15</td>
+<td>Deurne</td>
+<td><a href="/league/team/4460" title="Sportoase Antwerp Phantoms">Sportoase Antwerp Phantoms</a></td>
+<td><a href="/league/team/4464" title="Amsterdam Tigers">Amsterdam Tigers</a></td>
+</tr>
+</table></div></div>
+</body></html>"""
+
+
+class RBIHFImportViewTests(ManagementTestBase):
+    """The Events page's "Import from RBIHF" button/flow -- admin-only, and
+    only when the "RBIHF" waffle Flag is active for the club, same gating
+    machinery as FeatureGatedSectionsTests above. The scrape/diff/apply logic
+    itself (events.services.rbihf_import) has its own offline tests in
+    events/tests.py; these exercise the views end to end via a mocked
+    fetch_html, never touching the network."""
+
+    def setUp(self):
+        super().setUp()
+        cache.clear()
+        self.addCleanup(cache.clear)
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+
+    def activate_flag(self):
+        # "RBIHF" is already seeded (migration 0018 links it to the Competition
+        # row of the same name) -- get_or_create, not create.
+        flag, _created = get_waffle_flag_model().objects.get_or_create(name="RBIHF")
+        flag.clubs.add(self.club)
+
+    def make_coach(self, email="coach-rbihf@example.com"):
+        coach_user = User.objects.create_user(email=email, password="pw-secret-123")
+        coach_member = Member.objects.create(user=coach_user, first_name="Cara", last_name="Coach")
+        ClubMembership.objects.create(club=self.club, member=coach_member, season=self.season, status=ClubMembership.StatusChoices.ACTIVE)
+        position = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True, management_position=True)
+        StaffAssignment.objects.create(team=self.team, member=coach_member, season=self.season, position=position)
+        return coach_user
+
+    def test_button_only_shows_for_admin_with_the_flag_active(self):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("event_list")
+
+        self.assertContains(response, "Import from RBIHF")
+
+    def test_button_hidden_when_the_flag_is_not_active(self):
+        self.client.force_login(self.admin_user)
+
+        response = self.club_get("event_list")
+
+        self.assertNotContains(response, "Import from RBIHF")
+
+    def test_button_hidden_from_a_non_admin_even_with_the_flag_active(self):
+        self.activate_flag()
+        self.client.force_login(self.make_coach())
+
+        response = self.club_get("event_list")
+
+        self.assertNotContains(response, "Import from RBIHF")
+
+    def test_the_import_views_404_when_the_flag_is_not_active(self):
+        self.client.force_login(self.admin_user)
+
+        self.assertEqual(self.club_get("rbihf_import").status_code, 404)
+        self.assertEqual(self.club_post("rbihf_import_confirm", {}).status_code, 404)
+
+    def test_a_non_admin_gets_403_when_the_flag_is_active(self):
+        self.activate_flag()
+        self.client.force_login(self.make_coach())
+
+        self.assertEqual(self.club_get("rbihf_import").status_code, 403)
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_submitting_the_form_shows_a_preview(self, mock_fetch):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Sportoase Antwerp Phantoms")
+        self.assertContains(response, "5002")
+        self.assertContains(response, 'name="opponent_5002"')
+        self.assertContains(response, 'name="location_5002"')
+        mock_fetch.assert_called_once_with("https://www.rbihf.be/league/team/4460")
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_confirming_creates_the_event(self, mock_fetch):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+        self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        response = self.club_post("rbihf_import_confirm", {})
+
+        self.assertRedirects(response, reverse("management:event_list"))
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.opponent.name, "Amsterdam Tigers")
+        self.assertIn(self.team, event.teams.all())
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_confirming_respects_the_chosen_location(self, mock_fetch):
+        self.activate_flag()
+        location = Location.objects.create(club=self.club, name="Deurne Ice Hall", address="1 St", city="Deurne", zip_code="2100", country="BE")
+        self.client.force_login(self.admin_user)
+        self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.club_post("rbihf_import_confirm", {"location_5002": str(location.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.location, location)
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_confirming_respects_the_chosen_opponent(self, mock_fetch):
+        self.activate_flag()
+        renamed = Opponent.objects.create(club=self.club, name="Amsterdam Tigers HC")
+        self.client.force_login(self.admin_user)
+        self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.club_post("rbihf_import_confirm", {"opponent_5002": str(renamed.pk)})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.opponent, renamed)
+        self.assertFalse(Opponent.objects.filter(club=self.club, name="Amsterdam Tigers").exists())
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_a_blank_opponent_choice_falls_back_to_the_scraped_name(self, mock_fetch):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+        self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.club_post("rbihf_import_confirm", {})
+
+        event = Event.objects.get(club=self.club, external_game_id="5002")
+        self.assertEqual(event.opponent.name, "Amsterdam Tigers")
+
+    def test_confirming_with_nothing_stashed_redirects_with_a_notice(self):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("rbihf_import_confirm", {})
+
+        self.assertRedirects(response, reverse("management:rbihf_import"))
+
+    def test_a_non_rbihf_url_is_a_form_error_not_a_500(self):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("rbihf_import", {"url": "https://evil.example.com/x", "team": str(self.team.pk)})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "RBIHF team page")
+
+    @mock.patch("management.views.fetch_html", side_effect=RBIHFImportError("Could not reach the page."))
+    def test_a_fetch_failure_is_a_form_error_not_a_500(self, mock_fetch):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+
+        response = self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Could not reach the page.")
+
+    @mock.patch("management.views.fetch_html", return_value=RBIHF_SAMPLE_HTML)
+    def test_re_running_the_same_import_shows_it_as_unchanged(self, mock_fetch):
+        self.activate_flag()
+        self.client.force_login(self.admin_user)
+        self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+        self.club_post("rbihf_import_confirm", {})
+
+        response = self.club_post("rbihf_import", {"url": "https://www.rbihf.be/league/team/4460", "team": str(self.team.pk)})
+
+        self.assertContains(response, "already up to date")
+        self.assertEqual(Event.objects.filter(club=self.club, external_game_id="5002").count(), 1)
diff --git a/management/urls.py b/management/urls.py
new file mode 100644
index 0000000..208c95f
--- /dev/null
+++ b/management/urls.py
@@ -0,0 +1,100 @@
+from django.urls import path
+
+from . import views
+
+app_name = "management"
+
+urlpatterns = [
+    path("", views.HomeView.as_view(), name="home"),
+    # People
+    path("members/", views.MemberListView.as_view(), name="member_list"),
+    path("memberships/", views.MembershipListView.as_view(), name="membership_list"),
+    path("memberships/mark-paid/", views.MembershipMarkPaidView.as_view(), name="membership_mark_paid"),
+    path("memberships/export/", views.MembershipExportPdfView.as_view(), name="membership_export_pdf"),
+    path("memberships/<uuid:pk>/mark-fully-paid/", views.MembershipMarkFullyPaidView.as_view(), name="membership_mark_fully_paid"),
+    path("memberships/<uuid:pk>/record-payment/", views.MembershipRecordPaymentView.as_view(), name="membership_record_payment"),
+    path("members/new/", views.MemberCreateView.as_view(), name="member_create"),
+    path("members/import/template/", views.MemberImportTemplateView.as_view(), name="member_import_template"),
+    path("members/import/", views.MemberImportView.as_view(), name="member_import"),
+    path("members/import/confirm/", views.MemberImportConfirmView.as_view(), name="member_import_confirm"),
+    path("members/<uuid:pk>/", views.MemberDetailView.as_view(), name="member_detail"),
+    path("members/<uuid:pk>/edit/", views.MemberUpdateView.as_view(), name="member_update"),
+    path("members/<uuid:pk>/delete/", views.MemberDeleteView.as_view(), name="member_delete"),
+    path("members/<uuid:pk>/attach-family/", views.MemberAttachToFamilyView.as_view(), name="member_attach_family"),
+    path("members/<uuid:pk>/grant-login/", views.MemberGrantLoginView.as_view(), name="member_grant_login"),
+    path("members/<uuid:pk>/detach-family/<uuid:family_pk>/", views.MemberDetachFromFamilyView.as_view(), name="member_detach_family"),
+    path("families/new/", views.FamilyCreateView.as_view(), name="family_create"),
+    path("families/<uuid:pk>/", views.FamilyDetailView.as_view(), name="family_detail"),
+    path("families/<uuid:pk>/add-child/", views.FamilyAddChildView.as_view(), name="family_add_child"),
+    path("families/<uuid:pk>/add-parent/", views.FamilyAddParentView.as_view(), name="family_add_parent"),
+    path("families/<uuid:family_pk>/members/<uuid:member_pk>/role/", views.FamilyMembershipRoleUpdateView.as_view(), name="family_membership_role_update"),
+    # Club setup (admin only)
+    path("positions/", views.PositionListView.as_view(), name="position_list"),
+    path("positions/new/", views.PositionCreateView.as_view(), name="position_create"),
+    path("positions/<uuid:pk>/edit/", views.PositionUpdateView.as_view(), name="position_update"),
+    path("roles/", views.ClubRoleListView.as_view(), name="role_list"),
+    path("roles/new/", views.ClubRoleCreateView.as_view(), name="role_create"),
+    path("roles/<uuid:pk>/revoke/", views.ClubRoleRevokeView.as_view(), name="role_revoke"),
+    # Teams
+    path("teams/", views.TeamListView.as_view(), name="team_list"),
+    path("teams/new/", views.TeamCreateView.as_view(), name="team_create"),
+    path("teams/<uuid:pk>/", views.TeamDetailView.as_view(), name="team_detail"),
+    path("teams/<uuid:pk>/edit/", views.TeamUpdateView.as_view(), name="team_update"),
+    path("teams/<uuid:pk>/delete/", views.TeamDeleteView.as_view(), name="team_delete"),
+    path("teams/<uuid:pk>/roster/<uuid:season_pk>/add/", views.TeamRosterAddView.as_view(), name="team_roster_add"),
+    path("teams/<uuid:pk>/roster/<uuid:membership_pk>/edit/", views.TeamRosterUpdateView.as_view(), name="team_roster_update"),
+    path("teams/<uuid:pk>/roster/<uuid:membership_pk>/remove/", views.TeamRosterRemoveView.as_view(), name="team_roster_remove"),
+    path("teams/<uuid:pk>/staff/<uuid:season_pk>/add/", views.TeamStaffAddView.as_view(), name="team_staff_add"),
+    path("teams/<uuid:pk>/staff/<uuid:assignment_pk>/edit/", views.TeamStaffUpdateView.as_view(), name="team_staff_update"),
+    path("teams/<uuid:pk>/staff/<uuid:assignment_pk>/remove/", views.TeamStaffRemoveView.as_view(), name="team_staff_remove"),
+    path("teams/<uuid:pk>/photo/<uuid:season_pk>/set/", views.TeamPhotoSetView.as_view(), name="team_photo_set"),
+    path("teams/<uuid:pk>/photo/<uuid:season_pk>/delete/", views.TeamPhotoDeleteView.as_view(), name="team_photo_delete"),
+    # News
+    path("news/", views.NewsListView.as_view(), name="news_list"),
+    path("news/new/", views.NewsCreateView.as_view(), name="news_create"),
+    path("news/<uuid:pk>/", views.NewsDetailView.as_view(), name="news_detail"),
+    path("news/<uuid:pk>/edit/", views.NewsUpdateView.as_view(), name="news_update"),
+    path("news/<uuid:pk>/delete/", views.NewsDeleteView.as_view(), name="news_delete"),
+    path("news/<uuid:pk>/publish/", views.NewsPublishView.as_view(), name="news_publish"),
+    path("news/<uuid:pk>/unpublish/", views.NewsUnpublishView.as_view(), name="news_unpublish"),
+    path("news/<uuid:pk>/photos/", views.NewsPhotoUploadView.as_view(), name="news_photo_upload"),
+    path("news/<uuid:pk>/photos/<uuid:photo_pk>/set-main/", views.NewsPhotoSetMainView.as_view(), name="news_photo_set_main"),
+    path("news/<uuid:pk>/photos/<uuid:photo_pk>/delete/", views.NewsPhotoDeleteView.as_view(), name="news_photo_delete"),
+    # Calendar
+    path("events/", views.EventListView.as_view(), name="event_list"),
+    path("events/new/", views.EventCreateView.as_view(), name="event_create"),
+    path("events/<uuid:pk>/", views.EventDetailView.as_view(), name="event_detail"),
+    path("events/<uuid:pk>/edit/", views.EventUpdateView.as_view(), name="event_update"),
+    path("events/<uuid:pk>/delete/", views.EventDeleteView.as_view(), name="event_delete"),
+    path("events/<uuid:pk>/detach/", views.EventDetachView.as_view(), name="event_detach"),
+    path("events/<uuid:pk>/fetch-game-info/", views.EventFetchGameInfoView.as_view(), name="event_fetch_game_info"),
+    path("events/rbihf-import/", views.RBIHFImportView.as_view(), name="rbihf_import"),
+    path("events/rbihf-import/confirm/", views.RBIHFImportConfirmView.as_view(), name="rbihf_import_confirm"),
+    path("event-series/new/", views.EventSeriesCreateView.as_view(), name="event_series_create"),
+    path("event-series/<uuid:pk>/", views.EventSeriesDetailView.as_view(), name="event_series_detail"),
+    path("event-series/<uuid:pk>/edit/", views.EventSeriesUpdateView.as_view(), name="event_series_update"),
+    path("event-series/<uuid:pk>/delete/", views.EventSeriesDeleteView.as_view(), name="event_series_delete"),
+    path("event-series/<uuid:pk>/stop/", views.EventSeriesStopView.as_view(), name="event_series_stop"),
+    path("event-series/<uuid:pk>/generate/", views.EventSeriesGenerateView.as_view(), name="event_series_generate"),
+    path("locations/", views.LocationListView.as_view(), name="location_list"),
+    path("locations/new/", views.LocationCreateView.as_view(), name="location_create"),
+    path("locations/<uuid:pk>/edit/", views.LocationUpdateView.as_view(), name="location_update"),
+    path("locations/<uuid:pk>/delete/", views.LocationDeleteView.as_view(), name="location_delete"),
+    path("opponents/", views.OpponentListView.as_view(), name="opponent_list"),
+    path("opponents/new/", views.OpponentCreateView.as_view(), name="opponent_create"),
+    path("opponents/<uuid:pk>/edit/", views.OpponentUpdateView.as_view(), name="opponent_update"),
+    path("opponents/<uuid:pk>/delete/", views.OpponentDeleteView.as_view(), name="opponent_delete"),
+    # Sponsors (admin only)
+    path("sponsors/", views.SponsorListView.as_view(), name="sponsor_list"),
+    path("sponsors/new/", views.SponsorCreateView.as_view(), name="sponsor_create"),
+    path("sponsors/<uuid:pk>/edit/", views.SponsorUpdateView.as_view(), name="sponsor_update"),
+    path("sponsors/<uuid:pk>/delete/", views.SponsorDeleteView.as_view(), name="sponsor_delete"),
+    # Shop (admin only)
+    path("shop/products/", views.ProductListView.as_view(), name="product_list"),
+    path("shop/orders/", views.OrderListView.as_view(), name="order_list"),
+    path("shop/discounts/", views.DiscountListView.as_view(), name="discount_list"),
+    path("shop/invoices/", views.InvoiceListView.as_view(), name="invoice_list"),
+    # Forms
+    path("forms/", views.FormListView.as_view(), name="form_list"),
+    path("forms/<uuid:pk>/submissions/", views.SubmissionListView.as_view(), name="submission_list"),
+]
diff --git a/management/views.py b/management/views.py
new file mode 100644
index 0000000..6da6707
--- /dev/null
+++ b/management/views.py
@@ -0,0 +1,2152 @@
+from django.db import IntegrityError, transaction
+from django.db.models import Count, ProtectedError, Q
+from django.http import HttpResponse
+from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
+from django.utils import timezone
+from django.utils.http import url_has_allowed_host_and_scheme
+from django.utils.translation import gettext_lazy as _
+from django.utils.translation import ngettext
+from django.views.generic import CreateView, DetailView, FormView, ListView, TemplateView, UpdateView, View
+
+from billing.models import RENEWAL_LEAD_DAYS, Due
+from club.mixins import (
+    ClubAdminRequiredMixin,
+    ClubStaffRequiredMixin,
+    EventManagerRequiredMixin,
+    FeatureRequiredMixin,
+    ManagementPositionRequiredMixin,
+    NewsAuthorRequiredMixin,
+    NewsEditRequiredMixin,
+    NewsPublisherRequiredMixin,
+    TeamManagerRequiredMixin,
+)
+from club.models import ClubMembership, ClubRole, Season, Sponsor
+from club.services.access import can_edit_news, can_publish_news, current_season, is_club_admin, members_visible_to, teams_managed_by, teams_staffed_by
+from club.services.fees import mark_as_paid, record_payment, remaining_balance
+from controlpanel.messages import notify
+from controlpanel.mixins import RedirectOnInvalidMixin
+from controlpanel.services.statistics import club_attention, club_charts, club_statistics
+from events.models import Attendance, Event, EventSeries, Location, Opponent
+from events.services.attendance import player_attendance_rankings, players_who_missed_recent_practices, team_attendance_rate, team_no_shows
+from events.services.competitions import CompetitionFetchError, fetch_game_info
+from events.services.rbihf_import import RBIHFImportError, apply_plan, build_plan, extract_team_id, fetch_html
+from events.services.recurrence import cancel_occurrence, detach_occurrence, generate_occurrences, propagate_series
+from formbuilder.models import Form as FormBuilderForm
+from formbuilder.models import Submission
+from members.models import Family, FamilyMembership, Member
+from members.services.family import add_child_to_family, add_parent_to_family, attach_to_family, detach_from_family, grant_login, register_family
+from news.models import News, NewsPhoto
+from shop.models import Discount, Invoice, Order, Product
+from teams.models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+from .bulk_import import build_member_import_template, parse_member_import_rows, read_member_import_workbook
+from .forms import (
+    AddChildForm,
+    AddParentForm,
+    AttachToFamilyForm,
+    ClubMembershipForm,
+    ClubRoleAssignForm,
+    EventForm,
+    EventSeriesForm,
+    FamilyCreateForm,
+    GrantLoginForm,
+    LocationForm,
+    MemberForm,
+    MemberImportUploadForm,
+    NewsForm,
+    NewsPhotoUploadForm,
+    NewsPublishForm,
+    OpponentForm,
+    PositionForm,
+    RBIHFImportForm,
+    RecordFeePaymentForm,
+    SponsorForm,
+    StaffAssignmentForm,
+    TeamForm,
+    TeamMembershipForm,
+    TeamPhotoForm,
+)
+from .pdf import PDFExportError, membership_list_pdf
+from .recurrence_ui import describe_rrule
+
+
+class HomeView(ClubStaffRequiredMixin, TemplateView):
+    """The at-a-glance numbers a club admin/team manager/coach would actually want:
+    club_attention/club_charts/club_statistics are the exact functions
+    controlpanel/club_detail.html uses for the platform admin's per-club drill-down --
+    already club-scoped, so directly reusable for this club's own staff. Published
+    news is open to everyone; upcoming events are scoped the same way the events
+    list is (see scoped_to_managed_teams) -- a manager shouldn't see another
+    team's practice show up here either."""
+
+    template_name = "management/home.html"
+
+    def get_context_data(self, **kwargs):
+        club, user = self.request.club, self.request.user
+        subscription = getattr(club, "subscription", None)
+
+        billing_ends_at = None
+        if subscription is not None:
+            latest_due = club.dues.exclude(status=Due.Status.CANCELLED).order_by("-period_end").first()
+            if latest_due is not None and 0 <= (latest_due.period_end - timezone.localdate()).days <= RENEWAL_LEAD_DAYS:
+                billing_ends_at = latest_due.period_end
+
+        upcoming_events = scoped_to_managed_teams(Event.objects.filter(club=club, start__gte=timezone.now()), user, club).order_by("start").prefetch_related("teams")[:5]
+
+        return super().get_context_data(
+            attention=club_attention(club),
+            charts=club_charts(club),
+            groups=club_statistics(club),
+            upcoming_events=upcoming_events,
+            published_news=News.objects.filter(club=club, status=News.Status.PUBLISHED, published_at__lte=timezone.now()).order_by("-published_at")[:5],
+            billing_ends_at=billing_ends_at,
+            billing_auto_renews=subscription.auto_renew if subscription else False,
+            today=timezone.localdate(),
+            **kwargs,
+        )
+
+
+# --- Members (full tier) -----------------------------------------------------------
+
+
+def group_by_family(members):
+    """Bucket an already-scoped Member iterable by family: {family, guardians,
+    children, others}, plus whatever's left un-grouped.
+
+    Deliberately built from ``members`` rather than ``Family.guardians``/``.children``
+    (members/models.py) -- those query a family's *entire* membership unconditionally,
+    which would leak people outside whatever visibility scope ``members`` already
+    represents (e.g. a coach who only sees their own rostered players).
+    """
+    memberships = FamilyMembership.objects.filter(member__in=members).select_related("family", "member")
+
+    groups = {}
+    for fm in memberships:
+        bucket = groups.setdefault(fm.family, {"family": fm.family, "guardians": [], "children": [], "others": []})
+        # Attached here, not read later from person.family_memberships.first() --
+        # a member can belong to more than one family, so "their role" only means
+        # anything once it's scoped to *this* family's membership row.
+        fm.member.role_in_family = fm.role
+        fm.member.role_in_family_display = fm.get_role_display()
+        # A login-less child can be granted one right from the table -- parents/
+        # guardians already get one when added (add_parent_to_family/register_family
+        # both call get_or_create_login_member), so in practice this is only ever
+        # None for a child, but the check is on the actual state, not the role alone.
+        if fm.role == FamilyMembership.FamilyRole.CHILD and fm.member.user_id is None:
+            fm.member.grant_login_form = GrantLoginForm(initial={"email": fm.member.email})
+        else:
+            fm.member.grant_login_form = None
+        if fm.role in (FamilyMembership.FamilyRole.PARENT, FamilyMembership.FamilyRole.GUARDIAN):
+            bucket["guardians"].append(fm.member)
+        elif fm.role == FamilyMembership.FamilyRole.CHILD:
+            bucket["children"].append(fm.member)
+        else:
+            bucket["others"].append(fm.member)
+
+    grouped_ids = {fm.member_id for fm in memberships}
+    ungrouped = [member for member in members if member.pk not in grouped_ids]
+
+    groups = list(groups.values())
+    for group in groups:
+        # One flat list for anything that just wants "everyone in this family",
+        # regardless of role (e.g. rendering one delete-confirm modal per member).
+        group["all"] = group["guardians"] + group["children"] + group["others"]
+
+    return groups, ungrouped
+
+
+class MemberListView(ClubStaffRequiredMixin, ListView):
+    """One flat list, everybody -- family is a column, not a grouping. Each
+    member's family/role is attached in Python below (from a single query over
+    the already-scoped ``members``), same reasoning as group_by_family: never
+    resolve it per-row from the template via Family.guardians/.children, which
+    would ignore visibility scoping entirely."""
+
+    template_name = "management/member_list.html"
+    context_object_name = "members"
+
+    def get_queryset(self):
+        members = members_visible_to(self.request.user, self.request.club)
+        search = self.request.GET.get("q", "").strip()
+        if search:
+            members = members.filter(first_name__icontains=search) | members.filter(last_name__icontains=search) | members.filter(email__icontains=search) | members.filter(user__email__icontains=search)
+        return members.distinct()
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(search=self.request.GET.get("q", ""), **kwargs)
+        members = list(context["members"])
+
+        memberships = FamilyMembership.objects.filter(member__in=members).select_related("family")
+        memberships_by_member_id = {}
+        for fm in memberships:
+            memberships_by_member_id.setdefault(fm.member_id, []).append(fm)
+        for member in members:
+            member.family_memberships_display = memberships_by_member_id.get(member.pk, [])
+
+        season = current_season(self.request.club)
+        club_memberships_by_member_id = {}
+        if season is not None:
+            club_memberships = ClubMembership.objects.filter(club=self.request.club, season=season, member__in=members)
+            club_memberships_by_member_id = {cm.member_id: cm for cm in club_memberships}
+        for member in members:
+            member.current_membership = club_memberships_by_member_id.get(member.pk)
+
+        return context | {"members": members}
+
+
+def selected_season_from_request(request, club):
+    """Which season a page showing season-scoped data should use: ``?season=<pk>``
+    if given (and it's actually one of this club's own seasons), else whichever
+    season covers today. Shared by every page with a season switcher."""
+    season_id = request.GET.get("season")
+    if season_id:
+        season = Season.objects.filter(club=club, pk=season_id).first()
+        if season is not None:
+            return season
+    return current_season(club)
+
+
+class MembershipListView(ClubAdminRequiredMixin, ListView):
+    """Who's paid for the current season, and who hasn't -- MemberListView's Status
+    column can only show this one row at a time. Financial data, so admin-only
+    throughout (same line already drawn around the Shop nav section)."""
+
+    template_name = "management/membership_list.html"
+    context_object_name = "memberships"
+
+    def get_selected_season(self):
+        return selected_season_from_request(self.request, self.request.club)
+
+    def get_queryset(self):
+        season = self.get_selected_season()
+        if season is None:
+            return ClubMembership.objects.none()
+
+        memberships = ClubMembership.objects.filter(club=self.request.club, season=season).select_related("member").order_by("member__last_name", "member__first_name")
+
+        fee_status = self.request.GET.get("fee_status", "not_paid")
+        if fee_status == "not_paid":
+            # Literally "does not have a paid status" -- unpaid, partially paid, and
+            # waived all qualify; the dropdown can narrow to any single one of those.
+            memberships = memberships.exclude(fee_status__in=[ClubMembership.FeeStatus.PAID, ClubMembership.FeeStatus.PARTIALLY_PAID])
+        elif fee_status and fee_status != "all":
+            memberships = memberships.filter(fee_status=fee_status)
+
+        status = self.request.GET.get("status", "all")
+        if status and status != "all":
+            memberships = memberships.filter(status=status)
+
+        team_id = self.request.GET.get("team")
+        if team_id:
+            memberships = memberships.filter(member__team_memberships__team_id=team_id, member__team_memberships__season=season)
+
+        search = self.request.GET.get("q", "").strip()
+        if search:
+            # Also matches by family -- searching "Smith" finds every member of a
+            # family that has an explicit name of "Smith" or that includes anyone
+            # surnamed Smith, not just a member literally named Smith themself.
+            memberships = (
+                    memberships.filter(member__first_name__icontains=search)
+                    | memberships.filter(member__last_name__icontains=search)
+                    | memberships.filter(member__email__icontains=search)
+                    | memberships.filter(member__user__email__icontains=search)
+                    | memberships.filter(member__family_memberships__family__name__icontains=search)
+                    | memberships.filter(member__family_memberships__family__memberships__member__last_name__icontains=search)
+            )
+
+        return memberships.distinct()
+
+    def get_context_data(self, **kwargs):
+        club = self.request.club
+        current = current_season(club)
+
+        counts = {}
+        if current is not None:
+            counts = {row["fee_status"]: row["count"] for row in ClubMembership.objects.filter(club=club, season=current).values("fee_status").annotate(count=Count("id"))}
+        paid = counts.get(ClubMembership.FeeStatus.PAID, 0)
+        partial = counts.get(ClubMembership.FeeStatus.PARTIALLY_PAID, 0)
+        unpaid = counts.get(ClubMembership.FeeStatus.UNPAID, 0)
+        waived = counts.get(ClubMembership.FeeStatus.WAIVED, 0)
+        total = paid + partial + unpaid + waived
+
+        context = super().get_context_data(
+            current_season=current,
+            selected_season=self.get_selected_season(),
+            seasons=Season.objects.filter(club=club).order_by("-start_date"),
+            teams=Team.objects.filter(club=club).order_by("name"),
+            fee_status_choices=ClubMembership.FeeStatus.choices,
+            status_choices=ClubMembership.StatusChoices.choices,
+            search=self.request.GET.get("q", ""),
+            selected_fee_status=self.request.GET.get("fee_status", "not_paid"),
+            selected_status=self.request.GET.get("status", "all"),
+            selected_team=self.request.GET.get("team", ""),
+            kpi_total=total,
+            kpi_paid=paid,
+            kpi_partial=partial,
+            kpi_unpaid=unpaid,
+            kpi_waived=waived,
+            kpi_paid_rate=round(100 * paid / total) if total else None,
+            **kwargs,
+        )
+
+        # Same reasoning as MemberListView: attached in Python from a single query,
+        # never resolved per-row via Family.guardians/.children (which would ignore
+        # this page's own club/season/filter scoping entirely).
+        memberships = list(context["memberships"])
+        members = [membership.member for membership in memberships]
+        family_memberships = FamilyMembership.objects.filter(member__in=members).select_related("family")
+        family_memberships_by_member_id = {}
+        for fm in family_memberships:
+            family_memberships_by_member_id.setdefault(fm.member_id, []).append(fm)
+        for membership in memberships:
+            membership.member.family_memberships_display = family_memberships_by_member_id.get(membership.member_id, [])
+            membership.remaining_balance_display = remaining_balance(membership)
+            # Nothing to collect on an already-settled or deliberately-exempted row.
+            if membership.fee_status in (ClubMembership.FeeStatus.PAID, ClubMembership.FeeStatus.WAIVED):
+                membership.record_payment_form = None
+            else:
+                membership.record_payment_form = RecordFeePaymentForm()
+
+        return context | {"memberships": memberships}
+
+
+class MembershipMarkPaidView(ClubAdminRequiredMixin, View):
+    """Flag a batch of memberships as settled: active + paid, in one go. There's no
+    bank integration, so this is always a manual admin action -- the point of this
+    view is to make the manual action fast, not to replace it with automation.
+
+    Uses club.services.fees.mark_as_paid per row (a .save() loop under the hood,
+    never a bulk .update()): club/signals.py grants the MEMBER ClubRole via a
+    post_save signal on ClubMembership, which .update() would bypass entirely,
+    silently leaving a marked-paid member without their role. Same function backs
+    the per-row "Mark fully paid" button (MembershipMarkFullyPaidView) -- one place
+    decides how a membership becomes paid.
+    """
+
+    def post(self, request):
+        ids = request.POST.getlist("membership_ids")
+        memberships = ClubMembership.objects.filter(pk__in=ids, club=request.club)
+
+        count = 0
+        with transaction.atomic():
+            for membership in memberships:
+                mark_as_paid(membership, recorded_by=request.user)
+                count += 1
+
+        notify(request, f"s|{_('Marked as paid')}|{_('%(count)d membership(s) updated.') % {'count': count} }")
+
+        next_url = request.POST.get("next")
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
+            return redirect(next_url)
+        return redirect("management:membership_list")
+
+
+class MembershipMarkFullyPaidView(ClubAdminRequiredMixin, View):
+    """The per-row, one-click version of MembershipMarkPaidView's bulk action --
+    no confirm modal, matching this app's convention of reserving those for
+    destructive deletes, not state changes."""
+
+    def post(self, request, pk):
+        membership = get_object_or_404(ClubMembership, pk=pk, club=request.club)
+        mark_as_paid(membership, recorded_by=request.user)
+        notify(request, f"s|{_('Marked as paid')}|{_('“%(member)s” is now active and paid.') % {'member': membership.member}}")
+
+        next_url = request.POST.get("next")
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
+            return redirect(next_url)
+        return redirect("management:membership_list")
+
+
+class MembershipRecordPaymentView(ClubAdminRequiredMixin, View):
+    """The per-row "Record payment" modal on the Memberships page -- any amount,
+    partial or in full, via club.services.fees.record_payment."""
+
+    def post(self, request, pk):
+        membership = get_object_or_404(ClubMembership, pk=pk, club=request.club)
+        form = RecordFeePaymentForm(request.POST)
+
+        next_url = request.POST.get("next")
+        redirect_url = next_url if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}, require_https=request.is_secure()) else reverse("management:membership_list")
+
+        if not form.is_valid():
+            for error in form.errors.values():
+                notify(request, f"e|{_('Could not record payment')}|{' '.join(error)}")
+            return redirect(redirect_url)
+
+        record_payment(
+            membership,
+            amount=form.cleaned_data["amount"],
+            method=form.cleaned_data["method"],
+            reference=form.cleaned_data["reference"],
+            note=form.cleaned_data["note"],
+            recorded_by=request.user,
+        )
+        notify(request, f"s|{_('Payment recorded')}|{_('%(amount)s recorded for “%(member)s”.') % {'amount': form.cleaned_data['amount'], 'member': membership.member}}")
+        return redirect(redirect_url)
+
+
+class MembershipExportPdfView(MembershipListView):
+    """The exact same filtered queryset and KPI numbers as MembershipListView --
+    "export this page" means exactly that, never a differently-filtered list.
+    Reachable with whatever query string the on-screen list currently has."""
+
+    def get(self, request, *args, **kwargs):
+        self.object_list = self.get_queryset()
+        context = self.get_context_data(club=request.club, generated_at=timezone.now())
+
+        try:
+            pdf = membership_list_pdf(context)
+        except PDFExportError as error:
+            # The native PDF libraries are missing: say so rather than 500, and
+            # land back on the same filtered list rather than a blank one.
+            notify(request, f"e|{_('PDF unavailable')}|{error}")
+            return redirect(f"{reverse('management:membership_list')}?{request.GET.urlencode()}")
+
+        season = context["selected_season"]
+        filename = f"memberships-{season}.pdf" if season else "memberships.pdf"
+        response = HttpResponse(pdf, content_type="application/pdf")
+        response["Content-Disposition"] = f'attachment; filename="{filename}"'
+        return response
+
+
+class MemberImportTemplateView(ClubStaffRequiredMixin, View):
+    """Anyone with management access can download the template -- filling it in
+    doesn't grant any authority, only the upload step (admin-only) does."""
+
+    def get(self, request):
+        workbook = build_member_import_template()
+        response = HttpResponse(content_type="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
+        response["Content-Disposition"] = 'attachment; filename="member_import_template.xlsx"'
+        workbook.save(response)
+        return response
+
+
+class MemberImportView(ClubAdminRequiredMixin, View):
+    """Step 1 of the mass-upload: upload a filled-in template, see exactly what
+    will be created before anything actually is. Row data -- already extracted to
+    plain values, see bulk_import.read_member_import_workbook -- rides in the
+    session to MemberImportConfirmView, which re-validates it rather than trusting
+    anything a client could tamper with."""
+
+    def get(self, request):
+        return render(request, "management/member_import.html", {"form": MemberImportUploadForm()})
+
+    def post(self, request):
+        form = MemberImportUploadForm(request.POST, request.FILES)
+        if not form.is_valid():
+            return render(request, "management/member_import.html", {"form": form})
+
+        try:
+            rows = read_member_import_workbook(form.cleaned_data["file"])
+        except ValueError as exc:
+            form.add_error("file", str(exc))
+            return render(request, "management/member_import.html", {"form": form})
+
+        request.session["member_import_rows"] = rows
+        results = parse_member_import_rows(rows, request.club)
+        return render(
+            request,
+            "management/member_import_preview.html",
+            {
+                "results": results,
+                "valid_count": sum(1 for result in results if result["member"] is not None),
+                "skipped_count": sum(1 for result in results if result["member"] is None),
+                "season": current_season(request.club),
+            },
+        )
+
+
+class MemberImportConfirmView(ClubAdminRequiredMixin, View):
+    """Step 2: no row data in the request at all, just a submit button -- there's
+    nothing here for a client to tamper with. Re-parses the rows stashed in the
+    session by MemberImportView, so what gets created is guaranteed to match what
+    the preview showed."""
+
+    def post(self, request):
+        rows = request.session.pop("member_import_rows", None)
+        if not rows:
+            notify(request, f"w|{_('Nothing to import')}|{_('Upload a file first.')}")
+            return redirect("management:member_import")
+
+        results = parse_member_import_rows(rows, request.club)
+        season = current_season(request.club)
+
+        created = 0
+        with transaction.atomic():
+            for result in results:
+                member = result["member"]
+                if member is None:
+                    continue
+                member.save()
+                if season is not None:
+                    ClubMembership.objects.create(club=request.club, member=member, season=season, signed_up_at=timezone.localdate(), **result["membership_kwargs"])
+                created += 1
+
+        skipped = len(results) - created
+        if season is None and created:
+            title = _("%(count)s member(s) created, but not rostered") % {"count": created}
+            body = _("There's no active season to sign them up for yet.")
+            notify(request, f"w|{title}|{body}")
+        else:
+            body = _("%(created)s created, %(skipped)s skipped.") % {"created": created, "skipped": skipped}
+            notify(request, f"s|{_('Members imported')}|{body}")
+        return redirect("management:member_list")
+
+
+class MemberCreateView(ClubAdminRequiredMixin, CreateView):
+    model = Member
+    form_class = MemberForm
+    template_name = "management/member_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+
+        # Adding a member here means adding them to *this* club -- without a
+        # ClubMembership they'd never show up in members_visible_to() again.
+        season = current_season(self.request.club)
+        if season is not None:
+            ClubMembership.objects.create(
+                club=self.request.club,
+                member=self.object,
+                season=season,
+                status=ClubMembership.StatusChoices.ACTIVE,
+                signed_up_at=timezone.localdate(),
+            )
+            body = _("“%(member)s” added to the club for %(season)s.") % {"member": self.object, "season": season}
+            notify(self.request, f"s|{_('Member added')}|{body}")
+        else:
+            body = _("“%(member)s” was created, but there's no active season to sign them up for yet.") % {"member": self.object}
+            notify(self.request, f"w|{_('Member added, but not rostered')}|{body}")
+
+        return response
+
+    def get_success_url(self):
+        return reverse("management:member_detail", args=[self.object.pk])
+
+
+class MemberUpdateView(ClubAdminRequiredMixin, View):
+    """Not a generic UpdateView: this page owns two forms on one submit -- the
+    member's own fields, and (when they're actually rostered this season) their
+    ClubMembership's license/status/fee status. A Member has no club of its own
+    without one, so this is the only place to see or change it."""
+
+    template_name = "management/member_form.html"
+
+    def get_member(self):
+        return get_object_or_404(members_visible_to(self.request.user, self.request.club), pk=self.kwargs["pk"])
+
+    def get_membership(self, member):
+        season = current_season(self.request.club)
+        if season is None:
+            return None
+        return ClubMembership.objects.filter(club=self.request.club, member=member, season=season).first() or ClubMembership(
+            club=self.request.club, member=member, season=season, signed_up_at=timezone.localdate()
+        )
+
+    def render_form(self, member, form, membership_form):
+        return render(self.request, self.template_name, {"object": member, "update_view": True, "form": form, "membership_form": membership_form})
+
+    def get(self, request, pk):
+        member = self.get_member()
+        membership = self.get_membership(member)
+        membership_form = ClubMembershipForm(instance=membership) if membership else None
+        return self.render_form(member, MemberForm(instance=member), membership_form)
+
+    def post(self, request, pk):
+        member = self.get_member()
+        membership = self.get_membership(member)
+        form = MemberForm(request.POST, instance=member)
+        membership_form = ClubMembershipForm(request.POST, instance=membership) if membership else None
+
+        if form.is_valid() and (membership_form is None or membership_form.is_valid()):
+            form.save()
+            if membership_form is not None:
+                membership_form.save()
+            notify(request, f"s|{_('Member updated')}|{_('“%(member)s” updated.') % {'member': member} }")
+            return redirect("management:member_detail", pk=member.pk)
+
+        return self.render_form(member, form, membership_form)
+
+
+class MemberDetailView(ClubStaffRequiredMixin, DetailView):
+    template_name = "management/member_detail.html"
+    context_object_name = "member"
+
+    def get_queryset(self):
+        return members_visible_to(self.request.user, self.request.club)
+
+    def get_context_data(self, **kwargs):
+        visible = members_visible_to(self.request.user, self.request.club)
+        my_family_ids = FamilyMembership.objects.filter(member=self.object).values_list("family_id", flat=True)
+        family_scoped_members = visible.filter(family_memberships__family_id__in=my_family_ids).distinct()
+        family_groups, _ = group_by_family(family_scoped_members)
+
+        return super().get_context_data(
+            family_groups=family_groups,
+            family_role_choices=FamilyMembership.FamilyRole.choices,
+            add_child_form=AddChildForm(),
+            add_parent_form=AddParentForm(),
+            attach_to_family_form=AttachToFamilyForm(club=self.request.club, member=self.object),
+            current_membership=ClubMembership.objects.filter(club=self.request.club, member=self.object, season=current_season(self.request.club)).first(),
+            membership_history=ClubMembership.objects.filter(club=self.request.club, member=self.object).select_related("season").order_by("-season__start_date"),
+            **kwargs,
+        )
+
+
+class MemberAttachToFamilyView(ClubAdminRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Add to family" modal on a standalone member's page."""
+
+    form_class = AttachToFamilyForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:member_detail"
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def get_form_kwargs(self):
+        member = get_object_or_404(members_visible_to(self.request.user, self.request.club), pk=self.kwargs["pk"])
+        return super().get_form_kwargs() | {"club": self.request.club, "member": member}
+
+    def form_valid(self, form):
+        member = get_object_or_404(members_visible_to(self.request.user, self.request.club), pk=self.kwargs["pk"])
+        family = attach_to_family(member, role=form.cleaned_data["role"], family=form.cleaned_data["family"])
+        body = _("“%(member)s” is now part of %(family)s.") % {"member": member, "family": family}
+        notify(self.request, f"s|{_('Added to family')}|{body}")
+        return redirect("management:member_detail", pk=member.pk)
+
+
+class MemberGrantLoginView(ClubAdminRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Grant login" modal on a login-less child's row in
+    _family_members_table.html. The form itself (management.forms.GrantLoginForm)
+    already rejects an email already in use, so form_valid only ever runs with a
+    genuinely free one."""
+
+    form_class = GrantLoginForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:member_detail"
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        member = get_object_or_404(members_visible_to(self.request.user, self.request.club), pk=self.kwargs["pk"])
+        if member.user_id is not None:
+            # Already has one -- the row's button shouldn't have been there at all;
+            # a direct POST replay (e.g. a resubmitted form) is the only way here.
+            notify(self.request, f"w|{_('Already has a login')}|{_('“%(member)s” can already sign in.') % {'member': member} }")
+        else:
+            grant_login(member, form.cleaned_data["email"])
+            notify(self.request, f"s|{_('Login granted')}|{_('“%(member)s” can now sign in.') % {'member': member} }")
+        return redirect("management:member_detail", pk=member.pk)
+
+
+class MemberDetachFromFamilyView(ClubAdminRequiredMixin, View):
+    def post(self, request, pk, family_pk):
+        member = get_object_or_404(members_visible_to(request.user, request.club), pk=pk)
+        family = get_object_or_404(Family, pk=family_pk, memberships__member=member)
+        # detach_from_family may delete `family` itself (left empty) -- str() it first,
+        # since Family.__str__ queries self.memberships, which needs a pk to still exist.
+        family_name = str(family)
+        detach_from_family(member, family)
+        body = _("“%(member)s” is no longer part of %(family)s.") % {"member": member, "family": family_name}
+        notify(request, f"w|{_('Removed from family')}|{body}")
+        return redirect("management:member_detail", pk=member.pk)
+
+
+class FamilyMembershipRoleUpdateView(ClubAdminRequiredMixin, View):
+    """Reclassify one person's role within one specific family -- from the inline
+    dropdown in _family_members_table.html, reachable from both the member and
+    family detail pages since that partial is shared between them. Lands back on
+    whichever of those two pages the change came from: member_detail.html sends its
+    own URL as `next` so the admin doesn't get bounced off the member they were
+    looking at; family_detail.html sends nothing, since staying there is already
+    correct."""
+
+    def post(self, request, family_pk, member_pk):
+        family = get_object_or_404(families_of_club(request.club), pk=family_pk)
+        membership = get_object_or_404(FamilyMembership, family=family, member_id=member_pk)
+
+        role = request.POST.get("role")
+        if role not in FamilyMembership.FamilyRole.values:
+            title = _("Couldn't update role")
+            notify(request, f"e|{title}|{_('Not a valid role.')}")
+        else:
+            membership.role = role
+            membership.save(update_fields=["role"])
+            body = _("“%(member)s” is now %(role)s in %(family)s.") % {"member": membership.member, "role": membership.get_role_display(), "family": family}
+            notify(request, f"s|{_('Role updated')}|{body}")
+
+        next_url = request.POST.get("next")
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
+            return redirect(next_url)
+        return redirect("management:family_detail", pk=family.pk)
+
+
+class MemberDeleteView(ClubAdminRequiredMixin, View):
+    def post(self, request, pk):
+        member = get_object_or_404(members_visible_to(request.user, request.club), pk=pk)
+        name = str(member)
+        # FamilyMembership cascades away with the member -- note which families
+        # they were in before that happens, so an emptied one can be cleaned up
+        # after, same as detach_from_family does.
+        family_ids = list(Family.objects.filter(memberships__member=member).values_list("pk", flat=True))
+
+        try:
+            member.delete()
+        except ProtectedError:
+            title = _("Can't delete")
+            body = _("“%(member)s” is still referenced by orders or invoices, and can't be deleted.") % {"member": name}
+            notify(request, f"e|{title}|{body}")
+            return redirect("management:member_detail", pk=pk)
+
+        Family.objects.filter(pk__in=family_ids, memberships__isnull=True).delete()
+
+        body = _("“%(member)s” has been deleted.") % {"member": name}
+        notify(request, f"w|{_('Member deleted')}|{body}")
+        return redirect("management:member_list")
+
+
+# --- Teams (full tier) --------------------------------------------------------------
+
+
+class TeamListView(ClubStaffRequiredMixin, ListView):
+    """ADMIN sees every team; everyone else (coach, manager, other staff) only
+    the teams they're staffed on this season -- same visibility rule as
+    ``members_visible_to``, not the narrower management-only ``teams_managed_by``."""
+
+    template_name = "management/team_list.html"
+    context_object_name = "teams"
+
+    def get_queryset(self):
+        club = self.request.club
+        teams = Team.objects.filter(club=club) if is_club_admin(self.request.user, club) else teams_staffed_by(self.request.user, club)
+        search = self.request.GET.get("q", "").strip()
+        if search:
+            teams = teams.filter(name__icontains=search)
+
+        season = current_season(club)
+        return teams.annotate(
+            player_count=Count("roster", filter=Q(roster__season=season), distinct=True),
+            staff_count=Count("staff_assignments", filter=Q(staff_assignments__season=season), distinct=True),
+        )
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(search=self.request.GET.get("q", ""), **kwargs)
+
+
+class TeamCreateView(ClubAdminRequiredMixin, CreateView):
+    model = Team
+    form_class = TeamForm
+    template_name = "management/team_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(team)s” created.") % {"team": self.object}
+        notify(self.request, f"s|{_('Team created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:team_detail", args=[self.object.pk])
+
+
+class TeamUpdateView(ClubAdminRequiredMixin, UpdateView):
+    model = Team
+    form_class = TeamForm
+    template_name = "management/team_form.html"
+
+    def get_queryset(self):
+        return Team.objects.filter(club=self.request.club)
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(team)s” updated.") % {"team": self.object}
+        notify(self.request, f"s|{_('Team updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:team_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class TeamDeleteView(ClubAdminRequiredMixin, View):
+    def post(self, request, pk):
+        team = get_object_or_404(Team.objects.filter(club=request.club), pk=pk)
+        name = str(team)
+        # TeamMembership/StaffAssignment cascade away with the team -- no ProtectedError
+        # to catch, unlike a Member (which orders/invoices can still reference).
+        team.delete()
+
+        body = _("“%(team)s” has been deleted.") % {"team": name}
+        notify(request, f"w|{_('Team deleted')}|{body}")
+        return redirect("management:team_list")
+
+
+class TeamDetailView(ClubStaffRequiredMixin, DetailView):
+    """Team, roster and staff for one season, all in one place -- viewing is open
+    to any staff (visibility, not authority); managing the roster/staff of *this*
+    team is gated by can_manage (TeamManagerRequiredMixin's own rule, computed
+    here too since the template needs it to show/hide the add/edit/remove UI)."""
+
+    template_name = "management/team_detail.html"
+    context_object_name = "team"
+
+    def get_queryset(self):
+        return Team.objects.filter(club=self.request.club)
+
+    def get_context_data(self, **kwargs):
+        club = self.request.club
+        team = self.object
+        season = selected_season_from_request(self.request, club)
+        can_manage = is_club_admin(self.request.user, club) or teams_managed_by(self.request.user, club).filter(pk=team.pk).exists()
+
+        roster = TeamMembership.objects.none()
+        staff = StaffAssignment.objects.none()
+        attendance_rate = None
+        top_attenders, bottom_attenders = [], []
+        missed_practices = Member.objects.none()
+        no_shows = []
+        team_photo = TeamPhoto.objects.filter(team=team, season=season).first() if season is not None else None
+        if season is not None:
+            roster = list(TeamMembership.objects.filter(team=team, season=season).select_related("member", "position").order_by("position__ordering", "member__last_name"))
+            staff = list(StaffAssignment.objects.filter(team=team, season=season).select_related("member", "position").order_by("position__ordering", "member__last_name"))
+            if can_manage:
+                for membership in roster:
+                    membership.edit_form = TeamMembershipForm(instance=membership, club=club, team=team, season=season)
+                for assignment in staff:
+                    assignment.edit_form = StaffAssignmentForm(instance=assignment, club=club, team=team, season=season)
+
+            attendance_rate = team_attendance_rate(team, season)
+            rankings = player_attendance_rankings(team, season)
+            top_attenders = rankings[:5]
+            bottom_attenders = list(reversed(rankings))[:5]
+            missed_practices = players_who_missed_recent_practices(team, season)
+            no_shows = team_no_shows(team, season)[:10]
+
+        return super().get_context_data(
+            seasons=Season.objects.filter(club=club).order_by("-start_date"),
+            selected_season=season,
+            roster=roster,
+            staff=staff,
+            can_manage=can_manage,
+            roster_form=TeamMembershipForm(club=club, team=team, season=season) if can_manage and season else None,
+            staff_form=StaffAssignmentForm(club=club, team=team, season=season) if can_manage and season else None,
+            team_photo=team_photo,
+            team_photo_form=TeamPhotoForm(instance=team_photo) if can_manage and season else None,
+            attendance_rate=attendance_rate,
+            top_attenders=top_attenders,
+            bottom_attenders=bottom_attenders,
+            missed_practices=missed_practices,
+            no_shows=no_shows,
+            **kwargs,
+        )
+
+
+class TeamRosterAddView(TeamManagerRequiredMixin, FormView):
+    """Reachable only via the "Add player" modal on the team page. Not
+    RedirectOnInvalidMixin: that can't carry ?season= through a plain
+    redirect(view_name, **kwargs), and losing the season on a failed add would
+    land the admin back looking at a different one than they were editing."""
+
+    form_class = TeamMembershipForm
+    http_method_names = ["post"]
+
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_season(self):
+        return get_object_or_404(Season.objects.filter(club=self.request.club), pk=self.kwargs["season_pk"])
+
+    def get_form_kwargs(self):
+        # instance carries team/season *before* validation runs -- TeamMembership.clean()
+        # (validate_club_scope) needs self.team_id set to check season/position are the
+        # same club's, and form_valid() runs only after that validation already passed.
+        return super().get_form_kwargs() | {"club": self.request.club, "team": self.get_team(), "season": self.get_season(), "instance": TeamMembership(team=self.get_team(), season=self.get_season())}
+
+    def team_detail_url(self):
+        return f"{reverse('management:team_detail', args=[self.kwargs['pk']])}?season={self.kwargs['season_pk']}"
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|{_('Could not add player')}|{' '.join(error)}")
+        return redirect(self.team_detail_url())
+
+    def form_valid(self, form):
+        try:
+            form.save()
+        except IntegrityError:
+            # Belt and braces: form.clean() already checks jersey-number and
+            # member uniqueness by hand (team/season aren't form fields, so
+            # Django's own validate_unique() can't see those constraints) --
+            # this is the backstop for whatever that doesn't catch.
+            notify(self.request, f"e|{_('Could not add player')}|{_('That player could not be added -- please check the details and try again.')}")
+            return redirect(self.team_detail_url())
+
+        body = _("“%(member)s” added to the roster.") % {"member": form.instance.member}
+        notify(self.request, f"s|{_('Player added')}|{body}")
+        return redirect(self.team_detail_url())
+
+
+class TeamRosterUpdateView(TeamManagerRequiredMixin, FormView):
+    form_class = TeamMembershipForm
+    http_method_names = ["post"]
+
+    def get_object(self):
+        return get_object_or_404(TeamMembership.objects.filter(team__club=self.request.club, team__pk=self.kwargs["pk"]), pk=self.kwargs["membership_pk"])
+
+    def get_team(self):
+        return self.get_object().team
+
+    def get_form_kwargs(self):
+        membership = self.get_object()
+        return super().get_form_kwargs() | {"instance": membership, "club": self.request.club, "team": membership.team, "season": membership.season}
+
+    def team_detail_url(self):
+        return f"{reverse('management:team_detail', args=[self.kwargs['pk']])}?season={self.get_object().season_id}"
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|{_('Could not update player')}|{' '.join(error)}")
+        return redirect(self.team_detail_url())
+
+    def form_valid(self, form):
+        try:
+            form.save()
+        except IntegrityError:
+            notify(self.request, f"e|{_('Could not update player')}|{_('That change could not be saved -- please check the details and try again.')}")
+            return redirect(self.team_detail_url())
+
+        body = _("“%(member)s” updated.") % {"member": form.instance.member}
+        notify(self.request, f"s|{_('Player updated')}|{body}")
+        return redirect(self.team_detail_url())
+
+
+class TeamRosterRemoveView(TeamManagerRequiredMixin, View):
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk, membership_pk):
+        membership = get_object_or_404(TeamMembership.objects.filter(team__club=request.club, team__pk=pk), pk=membership_pk)
+        season_id, member = membership.season_id, membership.member
+        membership.delete()
+
+        body = _("“%(member)s” removed from the roster.") % {"member": member}
+        notify(request, f"w|{_('Player removed')}|{body}")
+        return redirect(f"{reverse('management:team_detail', args=[pk])}?season={season_id}")
+
+
+class TeamStaffAddView(TeamManagerRequiredMixin, FormView):
+    form_class = StaffAssignmentForm
+    http_method_names = ["post"]
+
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_season(self):
+        return get_object_or_404(Season.objects.filter(club=self.request.club), pk=self.kwargs["season_pk"])
+
+    def get_form_kwargs(self):
+        # See TeamRosterAddView -- StaffAssignment.clean() needs team_id set before
+        # validation runs, not after (form_valid() only runs once already valid).
+        return super().get_form_kwargs() | {"club": self.request.club, "team": self.get_team(), "season": self.get_season(), "instance": StaffAssignment(team=self.get_team(), season=self.get_season())}
+
+    def team_detail_url(self):
+        return f"{reverse('management:team_detail', args=[self.kwargs['pk']])}?season={self.kwargs['season_pk']}"
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|{_('Could not assign staff')}|{' '.join(error)}")
+        return redirect(self.team_detail_url())
+
+    def form_valid(self, form):
+        try:
+            form.save()
+        except IntegrityError:
+            notify(self.request, f"e|{_('Could not assign staff')}|{_('That assignment could not be saved -- please check the details and try again.')}")
+            return redirect(self.team_detail_url())
+
+        body = _("“%(member)s” assigned as staff.") % {"member": form.instance.member}
+        notify(self.request, f"s|{_('Staff assigned')}|{body}")
+        return redirect(self.team_detail_url())
+
+
+class TeamStaffUpdateView(TeamManagerRequiredMixin, FormView):
+    form_class = StaffAssignmentForm
+    http_method_names = ["post"]
+
+    def get_object(self):
+        return get_object_or_404(StaffAssignment.objects.filter(team__club=self.request.club, team__pk=self.kwargs["pk"]), pk=self.kwargs["assignment_pk"])
+
+    def get_team(self):
+        return self.get_object().team
+
+    def get_form_kwargs(self):
+        assignment = self.get_object()
+        return super().get_form_kwargs() | {"instance": assignment, "club": self.request.club, "team": assignment.team, "season": assignment.season}
+
+    def team_detail_url(self):
+        return f"{reverse('management:team_detail', args=[self.kwargs['pk']])}?season={self.get_object().season_id}"
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|{_('Could not update staff assignment')}|{' '.join(error)}")
+        return redirect(self.team_detail_url())
+
+    def form_valid(self, form):
+        try:
+            form.save()
+        except IntegrityError:
+            notify(self.request, f"e|{_('Could not update staff assignment')}|{_('That change could not be saved -- please check the details and try again.')}")
+            return redirect(self.team_detail_url())
+
+        body = _("“%(member)s” updated.") % {"member": form.instance.member}
+        notify(self.request, f"s|{_('Staff assignment updated')}|{body}")
+        return redirect(self.team_detail_url())
+
+
+class TeamStaffRemoveView(TeamManagerRequiredMixin, View):
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk, assignment_pk):
+        assignment = get_object_or_404(StaffAssignment.objects.filter(team__club=request.club, team__pk=pk), pk=assignment_pk)
+        season_id, member = assignment.season_id, assignment.member
+        assignment.delete()
+
+        body = _("“%(member)s” removed from staff.") % {"member": member}
+        notify(request, f"w|{_('Staff removed')}|{body}")
+        return redirect(f"{reverse('management:team_detail', args=[pk])}?season={season_id}")
+
+
+class TeamPhotoSetView(TeamManagerRequiredMixin, FormView):
+    """Reachable only via the "Upload"/"Replace" modal on the team page. Binds
+    to the existing TeamPhoto for this team+season (if any) so re-uploading
+    replaces it in place -- same "create or update the one row for this
+    scope" pattern as controlpanel.views.ClubHomeLocationSetView. Not
+    RedirectOnInvalidMixin, same reasoning as TeamRosterAddView: that can't
+    carry ?season= through a plain redirect(view_name, **kwargs)."""
+
+    form_class = TeamPhotoForm
+    http_method_names = ["post"]
+
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_season(self):
+        return get_object_or_404(Season.objects.filter(club=self.request.club), pk=self.kwargs["season_pk"])
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"instance": TeamPhoto.objects.filter(team=self.get_team(), season=self.get_season()).first()}
+
+    def team_detail_url(self):
+        return f"{reverse('management:team_detail', args=[self.kwargs['pk']])}?season={self.kwargs['season_pk']}"
+
+    def form_invalid(self, form):
+        for error in form.errors.values():
+            notify(self.request, f"e|{_('Could not upload photo')}|{' '.join(error)}")
+        return redirect(self.team_detail_url())
+
+    def form_valid(self, form):
+        photo = form.save(commit=False)
+        photo.team = self.get_team()
+        photo.season = self.get_season()
+        photo.save()
+
+        notify(self.request, f"s|{_('Photo uploaded')}|{_('Team photo updated.')}")
+        return redirect(self.team_detail_url())
+
+
+class TeamPhotoDeleteView(TeamManagerRequiredMixin, View):
+    def get_team(self):
+        return get_object_or_404(Team.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk, season_pk):
+        team = self.get_team()
+        TeamPhoto.objects.filter(team=team, season_id=season_pk).delete()
+
+        notify(request, f"w|{_('Photo removed')}|{_('Team photo removed.')}")
+        return redirect(f"{reverse('management:team_detail', args=[pk])}?season={season_pk}")
+
+
+# --- Club roles (full tier: assign / revoke, no update -- a role isn't edited, just
+# granted or taken away) -------------------------------------------------------------
+
+
+#: What each non-default role actually grants -- shown on the roles overview so an
+#: admin granting one knows what they're handing out. See club/services/access.py.
+ROLE_DESCRIPTIONS = {
+    ClubRole.Roles.ADMIN: _("Full control over the club: memberships, positions, roles, teams, shop, every event, and news."),
+    ClubRole.Roles.EDITOR: _("Can create and edit events, and publish news items, but not memberships, positions, roles, or shop settings."),
+}
+
+
+class ClubRoleListView(ClubAdminRequiredMixin, ListView):
+    """Every non-default role holder, grouped by role. The plain MEMBER role is
+    excluded entirely -- every active club member holds it automatically
+    (club/signals.py), so listing it here would just be noise; this page is for
+    the roles someone was actually *granted*. ClubRole.Roles has few enough
+    values that a section per role reads better than one flat table."""
+
+    template_name = "management/role_list.html"
+    context_object_name = "roles"
+
+    def get_queryset(self):
+        return ClubRole.objects.filter(club=self.request.club).exclude(role=ClubRole.Roles.MEMBER).select_related("member")
+
+    def get_context_data(self, **kwargs):
+        sections = [(value, label, ROLE_DESCRIPTIONS.get(value, ""), [role for role in self.object_list if role.role == value]) for value, label in ClubRole.Roles.choices if value != ClubRole.Roles.MEMBER]
+        return super().get_context_data(sections=sections, role_form=ClubRoleAssignForm(club=self.request.club), **kwargs)
+
+
+class ClubRoleCreateView(ClubAdminRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Grant role" modal on the roles overview."""
+
+    form_class = ClubRoleAssignForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:role_list"
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"club": self.request.club}
+
+    def form_valid(self, form):
+        # A member holds at most one ClubRole per club (the membership-status sync in
+        # club/signals.py already gave any active member an implicit MEMBER role) --
+        # so granting ADMIN/EDITOR promotes that existing row rather than inserting a
+        # second one, exactly like controlpanel.services.admins.grant_club_admin.
+        member, role = form.cleaned_data["member"], form.cleaned_data["role"]
+        role_obj, created = ClubRole.objects.get_or_create(club=self.request.club, member=member, defaults={"role": role})
+        if not created and role_obj.role != role:
+            role_obj.role = role
+            role_obj.save(update_fields=["role"])
+
+        body = _("“%(member)s” is now %(role)s.") % {"member": member, "role": role_obj.get_role_display()}
+        notify(self.request, f"s|{_('Role granted')}|{body}")
+        return redirect("management:role_list")
+
+
+class ClubRoleRevokeView(ClubAdminRequiredMixin, View):
+    def post(self, request, pk):
+        role = get_object_or_404(ClubRole, pk=pk, club=request.club)
+        member, role_label = role.member, role.get_role_display()
+        role.delete()
+        body = _("“%(member)s” is no longer %(role)s.") % {"member": member, "role": role_label}
+        notify(request, f"w|{_('Role revoked')}|{body}")
+        return redirect("management:role_list")
+
+
+# --- Everything else: correctly scoped and gated, but list-only for now ------------
+
+
+class StubListMixin:
+    """Shared shape for a placeholder list: proves out the query scoping and the
+    permission gate for an entity that doesn't have full CRUD yet -- the actual
+    create/edit UI is a follow-up, not part of this scaffold."""
+
+    template_name = "management/_generic_list.html"
+    page_title = ""
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(page_title=self.page_title, **kwargs)
+
+
+def families_of_club(club):
+    return Family.objects.filter(memberships__member__member_of__club=club).distinct()
+
+
+class FamilyCreateView(ClubAdminRequiredMixin, FormView):
+    """One new family in one go: a parent (who gets a login) and a child (who
+    doesn't) -- see members.services.family.register_family."""
+
+    form_class = FamilyCreateForm
+    template_name = "management/family_form.html"
+
+    def form_valid(self, form):
+        cd = form.cleaned_data
+        season = current_season(self.request.club)
+        self.family = register_family(
+            self.request.club,
+            season,
+            parent_email=cd["parent_email"],
+            parent_first_name=cd["parent_first_name"],
+            parent_last_name=cd["parent_last_name"],
+            child_first_name=cd["child_first_name"],
+            child_last_name=cd["child_last_name"],
+            child_date_of_birth=cd["child_date_of_birth"],
+        )
+
+        if season is not None:
+            body = _("%(family)s added to the club for %(season)s.") % {"family": self.family, "season": season}
+            notify(self.request, f"s|{_('Family added')}|{body}")
+        else:
+            body = _("%(family)s was created, but there's no active season to sign them up for yet.") % {"family": self.family}
+            notify(self.request, f"w|{_('Family added, but not rostered')}|{body}")
+
+        return super().form_valid(form)
+
+    def get_success_url(self):
+        return reverse("management:family_detail", args=[self.family.pk])
+
+
+class FamilyDetailView(ClubStaffRequiredMixin, DetailView):
+    """The family overview: everyone in it, plus the add-parent/add-child actions.
+    Reached by clicking a family's name wherever one is shown (the member list's
+    Family column, another member's own Family panel) -- there's no standalone
+    "Families" nav entry; family is something you see through Members."""
+
+    template_name = "management/family_detail.html"
+    context_object_name = "family"
+
+    def get_queryset(self):
+        return families_of_club(self.request.club)
+
+    def get_context_data(self, **kwargs):
+        visible = members_visible_to(self.request.user, self.request.club)
+        members = visible.filter(family_memberships__family=self.object).distinct()
+        # group_by_family scopes by member, not family -- a member visible here
+        # because they're in *this* family can also belong to another one, in
+        # which case groups has more than one entry. groups[0] would then pick
+        # whichever family happened to sort first, not necessarily this page's own.
+        groups, _ = group_by_family(members)
+        group = next((g for g in groups if g["family"] == self.object), None) or {"family": self.object, "guardians": [], "children": [], "others": [], "all": []}
+
+        return super().get_context_data(
+            group=group,
+            family_role_choices=FamilyMembership.FamilyRole.choices,
+            add_child_form=AddChildForm(),
+            add_parent_form=AddParentForm(),
+            **kwargs,
+        )
+
+
+class FamilyAddChildView(ClubAdminRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Add child" modal on the family overview / member
+    detail pages -- a family that needs one more child registered, most often a
+    sibling joining."""
+
+    form_class = AddChildForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:family_detail"
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        family = get_object_or_404(families_of_club(self.request.club), pk=self.kwargs["pk"])
+        child = add_child_to_family(self.request.club, current_season(self.request.club), family, **form.cleaned_data)
+        body = _("“%(child)s” added to %(family)s.") % {"child": child, "family": family}
+        notify(self.request, f"s|{_('Child registered')}|{body}")
+        return redirect("management:family_detail", pk=family.pk)
+
+
+class FamilyAddParentView(ClubAdminRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """Reachable only via the "Add parent" modal on the family overview / member
+    detail pages -- a family that needs one more parent/guardian registered."""
+
+    form_class = AddParentForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:family_detail"
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        family = get_object_or_404(families_of_club(self.request.club), pk=self.kwargs["pk"])
+        parent = add_parent_to_family(self.request.club, current_season(self.request.club), family, **form.cleaned_data)
+        body = _("“%(parent)s” added to %(family)s.") % {"parent": parent, "family": family}
+        notify(self.request, f"s|{_('Parent registered')}|{body}")
+        return redirect("management:family_detail", pk=family.pk)
+
+
+class PositionListView(ClubStaffRequiredMixin, ListView):
+    """Visible to any staff (coaches need to see positions to make sense of a
+    roster); creating/editing positions is still ADMIN-only, gated in the
+    template and on PositionCreateView/PositionUpdateView themselves."""
+
+    template_name = "management/position_list.html"
+    context_object_name = "positions"
+
+    def get_queryset(self):
+        return Position.objects.filter(club=self.request.club)
+
+
+class PositionCreateView(ClubAdminRequiredMixin, CreateView):
+    model = Position
+    form_class = PositionForm
+    template_name = "management/position_form.html"
+
+    def form_valid(self, form):
+        form.instance.club = self.request.club
+        response = super().form_valid(form)
+        body = _("“%(position)s” created.") % {"position": self.object}
+        notify(self.request, f"s|{_('Position created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:position_list")
+
+
+class PositionUpdateView(ClubAdminRequiredMixin, UpdateView):
+    model = Position
+    form_class = PositionForm
+    template_name = "management/position_form.html"
+
+    def get_queryset(self):
+        return Position.objects.filter(club=self.request.club)
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(position)s” updated.") % {"position": self.object}
+        notify(self.request, f"s|{_('Position updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:position_list")
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+# --- News: draft/edit is broad (any coach_manager/editor/admin), but only EDITOR/ADMIN
+# may publish -- the release flow the news app exists for ---------------------------
+
+
+class NewsListView(ClubStaffRequiredMixin, ListView):
+    template_name = "management/news_list.html"
+    context_object_name = "news_items"
+
+    def get_queryset(self):
+        return News.objects.filter(club=self.request.club).prefetch_related("teams")
+
+    def get_context_data(self, **kwargs):
+        for news_item in self.object_list:
+            news_item.can_edit = can_edit_news(self.request.user, news_item)
+        return super().get_context_data(**kwargs)
+
+
+class NewsCreateView(NewsAuthorRequiredMixin, CreateView):
+    model = News
+    form_class = NewsForm
+    template_name = "management/news_form.html"
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"club": self.request.club}
+
+    def form_valid(self, form):
+        form.instance.club = self.request.club
+        form.instance.created_by = Member.objects.filter(user=self.request.user).first()
+        response = super().form_valid(form)
+        body = _("“%(news)s” created.") % {"news": self.object}
+        notify(self.request, f"s|{_('News item created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:news_detail", args=[self.object.pk])
+
+
+class NewsDetailView(ClubStaffRequiredMixin, DetailView):
+    template_name = "management/news_detail.html"
+    context_object_name = "news_item"
+
+    def get_queryset(self):
+        return News.objects.filter(club=self.request.club).prefetch_related("teams", "photos")
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(
+            can_edit=can_edit_news(self.request.user, self.object),
+            can_publish=can_publish_news(self.request.user, self.request.club),
+            publish_form=NewsPublishForm(),
+            photo_upload_form=NewsPhotoUploadForm(),
+            **kwargs,
+        )
+
+
+class NewsUpdateView(NewsEditRequiredMixin, UpdateView):
+    model = News
+    form_class = NewsForm
+    template_name = "management/news_form.html"
+
+    def get_news_item(self):
+        return get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_queryset(self):
+        return News.objects.filter(club=self.request.club)
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"club": self.request.club}
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(news)s” updated.") % {"news": self.object}
+        notify(self.request, f"s|{_('News item updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:news_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class NewsDeleteView(NewsEditRequiredMixin, View):
+    def get_news_item(self):
+        return get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk):
+        news_item = self.get_news_item()
+        title = str(news_item)
+        news_item.delete()
+
+        body = _("“%(news)s” has been deleted.") % {"news": title}
+        notify(request, f"w|{_('News item deleted')}|{body}")
+        return redirect("management:news_list")
+
+
+class NewsPublishView(NewsPublisherRequiredMixin, RedirectOnInvalidMixin, FormView):
+    form_class = NewsPublishForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:news_detail"
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        news_item = get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+        news_item.publish(at=form.cleaned_data["published_at"])
+
+        if news_item.is_scheduled:
+            body = _("“%(news)s” is scheduled to go live on %(date)s.") % {"news": news_item, "date": news_item.published_at}
+        else:
+            body = _("“%(news)s” is now live.") % {"news": news_item}
+        notify(self.request, f"s|{_('News item published')}|{body}")
+        return redirect("management:news_detail", pk=news_item.pk)
+
+
+class NewsUnpublishView(NewsPublisherRequiredMixin, View):
+    def post(self, request, pk):
+        news_item = get_object_or_404(News.objects.filter(club=request.club), pk=pk)
+        news_item.unpublish()
+        body = _("“%(news)s” is back to a draft.") % {"news": news_item}
+        notify(request, f"w|{_('News item unpublished')}|{body}")
+        return redirect("management:news_detail", pk=news_item.pk)
+
+
+class NewsPhotoUploadView(NewsEditRequiredMixin, RedirectOnInvalidMixin, FormView):
+    """One NewsPhoto per uploaded file; if the item had none yet, the first one
+    in this batch is auto-flagged main so there's always one once any photo exists."""
+
+    form_class = NewsPhotoUploadForm
+    http_method_names = ["post"]
+    invalid_redirect_url_name = "management:news_detail"
+
+    def get_news_item(self):
+        return get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_invalid_redirect_kwargs(self):
+        return {"pk": self.kwargs["pk"]}
+
+    def form_valid(self, form):
+        news_item = self.get_news_item()
+        has_main = news_item.photos.filter(is_main=True).exists()
+
+        count = 0
+        for image in form.cleaned_data["images"]:
+            NewsPhoto.objects.create(news_item=news_item, image=image, is_main=not has_main)
+            has_main = True
+            count += 1
+
+        body = ngettext("%(count)d photo added.", "%(count)d photos added.", count) % {"count": count}
+        notify(self.request, f"s|{_('Photos added')}|{body}")
+        return redirect("management:news_detail", pk=news_item.pk)
+
+
+class NewsPhotoSetMainView(NewsEditRequiredMixin, View):
+    def get_news_item(self):
+        return get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk, photo_pk):
+        news_item = self.get_news_item()
+        photo = get_object_or_404(NewsPhoto, pk=photo_pk, news_item=news_item)
+
+        with transaction.atomic():
+            NewsPhoto.objects.filter(news_item=news_item).update(is_main=False)
+            photo.is_main = True
+            photo.save(update_fields=["is_main"])
+
+        return redirect("management:news_detail", pk=news_item.pk)
+
+
+class NewsPhotoDeleteView(NewsEditRequiredMixin, View):
+    def get_news_item(self):
+        return get_object_or_404(News.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def post(self, request, pk, photo_pk):
+        news_item = self.get_news_item()
+        photo = get_object_or_404(NewsPhoto, pk=photo_pk, news_item=news_item)
+        was_main = photo.is_main
+
+        with transaction.atomic():
+            photo.delete()
+            if was_main:
+                replacement = news_item.photos.first()
+                if replacement is not None:
+                    replacement.is_main = True
+                    replacement.save(update_fields=["is_main"])
+
+        notify(request, f"w|{_('Photo removed')}|{_('The photo was removed.')}")
+        return redirect("management:news_detail", pk=news_item.pk)
+
+
+def scoped_to_managed_teams(queryset, user, club):
+    """Non-admin: only rows for a team they manage, plus team-less/club-wide
+    ones (a social, an AGM) -- there's no team to scope those to, so they stay
+    visible to everyone. Same "manages" rule as who can edit (teams_managed_by),
+    not the broader "staffed on any role" one. Works for any queryset whose
+    model has a `teams` M2M -- Event and EventSeries both do -- so it backs the
+    events list, the dashboard's upcoming-events widget, and both detail views
+    (an out-of-scope one 404s if opened directly, same as any other
+    queryset-scoped detail view here, not just unlisted)."""
+    if is_club_admin(user, club):
+        return queryset
+    managed_team_ids = teams_managed_by(user, club).values_list("pk", flat=True)
+    return queryset.filter(Q(teams__in=managed_team_ids) | Q(teams__isnull=True)).distinct()
+
+
+class EventListView(ClubStaffRequiredMixin, ListView):
+    """Upcoming by default (what a coach actually opens this page to check);
+    ``?show_past=1`` flips to the most recent past events instead. Season
+    filtering mirrors Event.season's own "explicit, else derived from start
+    date" rule (events/models.py) rather than requiring a stored season on
+    every row."""
+
+    template_name = "management/event_list.html"
+    context_object_name = "events"
+
+    def get_queryset(self):
+        club = self.request.club
+        user = self.request.user
+        events = Event.objects.filter(club=club).select_related("location", "opponent").prefetch_related("teams")
+
+        season = selected_season_from_request(self.request, club)
+        if season is not None:
+            events = events.filter(Q(season=season) | Q(season__isnull=True, start__date__gte=season.start_date, start__date__lte=season.end_date))
+
+        kind = self.request.GET.get("kind", "")
+        if kind:
+            events = events.filter(kind=kind)
+
+        events = scoped_to_managed_teams(events, user, club)
+
+        is_admin = is_club_admin(user, club)
+        managed_team_ids = set() if is_admin else set(teams_managed_by(user, club).values_list("pk", flat=True))
+
+        now = timezone.now()
+        if self.request.GET.get("show_past") == "1":
+            events = list(events.filter(start__lt=now).order_by("-start"))
+        else:
+            events = list(events.filter(start__gte=now).order_by("start"))
+
+        # Attached per row so the template can show/hide Edit/Delete per event --
+        # computed once here rather than a query per row (teams is already
+        # prefetched above).
+        for event in events:
+            event.can_manage = is_admin or any(team.pk in managed_team_ids for team in event.teams.all())
+        return events
+
+    def get_context_data(self, **kwargs):
+        club, user = self.request.club, self.request.user
+        return super().get_context_data(
+            seasons=Season.objects.filter(club=club).order_by("-start_date"),
+            selected_season=selected_season_from_request(self.request, club),
+            selected_kind=self.request.GET.get("kind", ""),
+            show_past=self.request.GET.get("show_past") == "1",
+            event_kinds=Event.EventKind.choices,
+            can_create=is_club_admin(user, club) or teams_managed_by(user, club).exists(),
+            **kwargs,
+        )
+
+
+class EventDetailView(ClubStaffRequiredMixin, DetailView):
+    template_name = "management/event_detail.html"
+    context_object_name = "event"
+
+    def get_queryset(self):
+        events = Event.objects.filter(club=self.request.club).select_related("series", "location", "opponent", "season").prefetch_related("teams", "invited_members", "excluded_members")
+        return scoped_to_managed_teams(events, self.request.user, self.request.club)
+
+    def get_context_data(self, **kwargs):
+        club, user, event = self.request.club, self.request.user, self.object
+        can_manage = is_club_admin(user, club) or teams_managed_by(user, club).filter(pk__in=event.teams.values_list("pk", flat=True)).exists()
+
+        rows_by_status = {}
+        for row in event.attendances.select_related("member").order_by("member__last_name", "member__first_name"):
+            rows_by_status.setdefault(row.status, []).append(row)
+
+        # Every status, in its declared order -- not just the ones that happen to have
+        # a response yet, or "0 people excused" silently disappears instead of reading
+        # as good news. Same grouping backs both the breakdown counts and the modal's
+        # per-status sections, so there's exactly one query, not two.
+        attendance_groups = [{"value": value, "label": label, "rows": rows_by_status.get(value, [])} for value, label in Attendance.AttendanceStatus.choices]
+
+        return super().get_context_data(
+            can_manage=can_manage,
+            attendance_groups=attendance_groups,
+            has_attendance_rows=any(group["rows"] for group in attendance_groups),
+            **kwargs,
+        )
+
+
+class EventCreateView(ClubStaffRequiredMixin, CreateView):
+    """Broader than EventManagerRequiredMixin's own gate (no object yet to check
+    teams against): anyone managing at least one team, or an admin. EventForm
+    itself then restricts *which* teams a non-admin can pick and requires at
+    least one, so a team-less/club-wide event stays admin-only."""
+
+    model = Event
+    form_class = EventForm
+    template_name = "management/event_form.html"
+
+    def test_func(self):
+        user, club = self.request.user, self.request.club
+        return is_club_admin(user, club) or teams_managed_by(user, club).exists()
+
+    def get_form_kwargs(self):
+        # Event.clean() rejects a location/opponent from another club by comparing
+        # against self.club_id -- on a brand-new instance that's still None until
+        # ClubScopedModel.save() auto-assigns it, which only happens *after*
+        # validation. Set it here so full_clean() sees the real club, not None.
+        return super().get_form_kwargs() | {"club": self.request.club, "user": self.request.user, "instance": Event(club=self.request.club)}
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(event)s” created.") % {"event": self.object}
+        notify(self.request, f"s|{_('Event created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:event_detail", args=[self.object.pk])
+
+
+class EventUpdateView(EventManagerRequiredMixin, UpdateView):
+    model = Event
+    form_class = EventForm
+    template_name = "management/event_form.html"
+
+    def get_queryset(self):
+        return Event.objects.filter(club=self.request.club)
+
+    def get_teams(self):
+        return get_object_or_404(Event.objects.filter(club=self.request.club), pk=self.kwargs["pk"]).teams.all()
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"club": self.request.club, "user": self.request.user, "editing": True}
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(event)s” updated.") % {"event": self.object}
+        notify(self.request, f"s|{_('Event updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:event_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class EventDeleteView(EventManagerRequiredMixin, View):
+    """A series occurrence is cancelled (keeps the series' excluded_dates in
+    sync -- see cancel_occurrence), never just deleted outright; a one-off
+    event is deleted outright. One button, the branch is internal."""
+
+    def get_event(self):
+        return get_object_or_404(Event.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_event().teams.all()
+
+    def post(self, request, pk):
+        event = self.get_event()
+        title = str(event)
+        if event.series_id:
+            cancel_occurrence(event, hard_delete=request.POST.get("keep_record") != "on")
+            notify(request, f"w|{_('Occurrence cancelled')}|{_('“%(event)s” was cancelled.') % {'event': title}}")
+        else:
+            event.delete()
+            notify(request, f"w|{_('Event deleted')}|{_('“%(event)s” has been deleted.') % {'event': title}}")
+        return redirect("management:event_list")
+
+
+class EventDetachView(EventManagerRequiredMixin, View):
+    """Stop this occurrence from being touched by future series-wide edits --
+    see detach_occurrence. Editing a still-attached occurrence directly would
+    otherwise be silently overwritten by the next propagate_series() call."""
+
+    def get_event(self):
+        return get_object_or_404(Event.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_event().teams.all()
+
+    def post(self, request, pk):
+        event = self.get_event()
+        detach_occurrence(event)
+        notify(request, f"s|{_('Detached from series')}|{_('“%(event)s” is now edited independently and will not be touched by future series-wide changes.') % {'event': event}}")
+        return redirect("management:event_detail", pk=event.pk)
+
+
+class EventFetchGameInfoView(EventManagerRequiredMixin, View):
+    """Refresh a game's score/status from its competition -- see
+    events.services.competitions.fetch_game_info, which gates on the
+    competition's feature flag being active for this club and otherwise
+    no-ops. No data source is wired up yet either way, so an actual fetch
+    attempt always reports the same honest "not configured" error; the
+    button/view exist so a real integration only has to replace that function."""
+
+    def get_event(self):
+        return get_object_or_404(Event.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_event().teams.all()
+
+    def post(self, request, pk):
+        event = self.get_event()
+        try:
+            if fetch_game_info(event):
+                notify(request, f"s|{_('Game info updated')}|{_('“%(event)s” was refreshed from its competition.') % {'event': event}}")
+            else:
+                notify(request, f"i|{_('Nothing to fetch')}|{_('“%(competition)s” is not enabled for this club.') % {'competition': event.competition}}")
+        except CompetitionFetchError as error:
+            notify(request, f"e|{_('Could not fetch game info')}|{error}")
+        return redirect("management:event_detail", pk=event.pk)
+
+
+class RBIHFImportView(FeatureRequiredMixin, View):
+    """Step 1: paste an RBIHF team page URL, pick which of the club's teams it's
+    for. Fetches and parses the page server-side, stashes the raw HTML (not
+    client-trusted parsed data) in the session, and renders a create/update/
+    delete preview -- see events.services.rbihf_import and
+    RBIHFImportConfirmView, which mirrors MemberImportView/
+    MemberImportConfirmView's session-stash-and-reparse shape."""
+
+    feature_flag = "RBIHF"
+
+    def get(self, request):
+        return render(request, "management/rbihf_import_form.html", {"form": RBIHFImportForm(club=request.club)})
+
+    def post(self, request):
+        form = RBIHFImportForm(request.POST, club=request.club)
+        if not form.is_valid():
+            return render(request, "management/rbihf_import_form.html", {"form": form})
+
+        url = form.cleaned_data["url"]
+        team = form.cleaned_data["team"]
+
+        rbihf_team_id = extract_team_id(url)
+        try:
+            html = fetch_html(url)
+            plan = build_plan(request.club, team, rbihf_team_id, html)
+        except RBIHFImportError as error:
+            form.add_error("url", str(error))
+            return render(request, "management/rbihf_import_form.html", {"form": form})
+
+        request.session["rbihf_import_html"] = html
+        request.session["rbihf_import_team_id"] = str(team.pk)
+        request.session["rbihf_import_rbihf_team_id"] = rbihf_team_id
+        return render(request, "management/rbihf_import_preview.html", {"plan": plan})
+
+
+class RBIHFImportConfirmView(FeatureRequiredMixin, View):
+    """Step 2: re-parses and re-diffs the HTML stashed by RBIHFImportView
+    against the *current* DB state (catching anything that changed since the
+    preview was shown), reads each row's chosen location/opponent back from
+    the preview form, and applies the result in one transaction."""
+
+    feature_flag = "RBIHF"
+
+    def post(self, request):
+        html = request.session.pop("rbihf_import_html", None)
+        team_id = request.session.pop("rbihf_import_team_id", None)
+        rbihf_team_id = request.session.pop("rbihf_import_rbihf_team_id", None)
+        if not html or not team_id or not rbihf_team_id:
+            notify(request, f"w|{_('Nothing to import')}|{_('Start over by pasting the RBIHF team URL again.')}")
+            return redirect("management:rbihf_import")
+
+        team = get_object_or_404(Team.objects.filter(club=request.club), pk=team_id)
+
+        try:
+            plan = build_plan(request.club, team, rbihf_team_id, html)
+        except RBIHFImportError:
+            notify(request, f"e|{_('Could not import')}|{_('Something went wrong re-reading the fetched page. Try again.')}")
+            return redirect("management:rbihf_import")
+
+        locations_by_game_id = {}
+        opponents_by_game_id = {}
+        for planned in [*plan.to_create, *plan.to_update]:
+            game_id = planned.fixture.external_game_id
+            locations_by_game_id[game_id] = request.POST.get(f"location_{game_id}", "")
+            opponents_by_game_id[game_id] = request.POST.get(f"opponent_{game_id}", "")
+
+        result = apply_plan(plan, locations_by_game_id, opponents_by_game_id)
+
+        body = _("%(created)s created, %(updated)s updated, %(deleted)s deleted.") % result
+        notify(request, f"s|{_('Fixtures imported')}|{body}")
+        return redirect("management:event_list")
+
+
+class EventSeriesDetailView(ClubStaffRequiredMixin, DetailView):
+    template_name = "management/event_series_detail.html"
+    context_object_name = "series"
+
+    def get_queryset(self):
+        series = EventSeries.objects.filter(club=self.request.club).select_related("location", "opponent").prefetch_related("teams", "invited_members", "excluded_members")
+        return scoped_to_managed_teams(series, self.request.user, self.request.club)
+
+    def get_context_data(self, **kwargs):
+        club, user, series = self.request.club, self.request.user, self.object
+        can_manage = is_club_admin(user, club) or teams_managed_by(user, club).filter(pk__in=series.teams.values_list("pk", flat=True)).exists()
+        now = timezone.now()
+        occurrences = list(series.occurrences.order_by("start"))
+        for occurrence in occurrences:
+            occurrence.is_past = occurrence.start < now
+        return super().get_context_data(
+            can_manage=can_manage,
+            recurrence_summary=describe_rrule(series.rrule),
+            occurrences=occurrences,
+            **kwargs,
+        )
+
+
+class EventSeriesCreateView(ClubStaffRequiredMixin, CreateView):
+    model = EventSeries
+    form_class = EventSeriesForm
+    template_name = "management/event_series_form.html"
+
+    def test_func(self):
+        user, club = self.request.user, self.request.club
+        return is_club_admin(user, club) or teams_managed_by(user, club).exists()
+
+    def get_form_kwargs(self):
+        # Same reasoning as EventCreateView: EventSeries.clean() needs a real
+        # club_id on the instance before full_clean() runs, not the None a
+        # brand-new instance starts with.
+        return super().get_form_kwargs() | {"club": self.request.club, "user": self.request.user, "instance": EventSeries(club=self.request.club)}
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        # Not automatic on save -- without this the series would exist with zero
+        # occurrences until the extend_event_series cron command next runs.
+        created = generate_occurrences(self.object)
+        body = ngettext("“%(series)s” created, with %(count)d occurrence scheduled.", "“%(series)s” created, with %(count)d occurrences scheduled.", len(created)) % {"series": self.object, "count": len(created)}
+        notify(self.request, f"s|{_('Series created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:event_series_detail", args=[self.object.pk])
+
+
+class EventSeriesUpdateView(EventManagerRequiredMixin, UpdateView):
+    model = EventSeries
+    form_class = EventSeriesForm
+    template_name = "management/event_series_form.html"
+
+    def get_queryset(self):
+        return EventSeries.objects.filter(club=self.request.club)
+
+    def get_teams(self):
+        return get_object_or_404(EventSeries.objects.filter(club=self.request.club), pk=self.kwargs["pk"]).teams.all()
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"club": self.request.club, "user": self.request.user}
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        # Push the template change to future, non-detached occurrences, then fill
+        # in any further-out dates the (possibly changed) pattern now implies.
+        # Occurrences that no longer match a changed pattern are NOT auto-removed
+        # -- reconciling that is ambiguous (which to drop vs. keep attendance
+        # history for) and is left as a manual "Cancel" per stale occurrence.
+        propagate_series(self.object)
+        generate_occurrences(self.object)
+        body = _("“%(series)s” updated.") % {"series": self.object}
+        notify(self.request, f"s|{_('Series updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:event_series_detail", args=[self.object.pk])
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class EventSeriesDeleteView(EventManagerRequiredMixin, View):
+    """series is on_delete=CASCADE -- this also deletes every occurrence and its
+    attendance history. The confirm modal must say so; "Stop repeating"
+    (EventSeriesStopView) is the non-destructive alternative."""
+
+    def get_series(self):
+        return get_object_or_404(EventSeries.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_series().teams.all()
+
+    def post(self, request, pk):
+        series = self.get_series()
+        title = str(series)
+        series.delete()
+        notify(request, f"w|{_('Series deleted')}|{_('“%(series)s” and all of its occurrences have been deleted.') % {'series': title}}")
+        return redirect("management:event_list")
+
+
+class EventSeriesStopView(EventManagerRequiredMixin, View):
+    """Stop future generation without touching any existing occurrence or its
+    attendance history -- the non-destructive alternative to deleting the
+    series outright."""
+
+    def get_series(self):
+        return get_object_or_404(EventSeries.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_series().teams.all()
+
+    def post(self, request, pk):
+        series = self.get_series()
+        series.until = timezone.now()
+        series.save(update_fields=["until"])
+        notify(request, f"s|{_('Series stopped')}|{_('“%(series)s” will no longer generate new occurrences. Existing ones are untouched.') % {'series': series}}")
+        return redirect("management:event_series_detail", pk=series.pk)
+
+
+class EventSeriesGenerateView(EventManagerRequiredMixin, View):
+    def get_series(self):
+        return get_object_or_404(EventSeries.objects.filter(club=self.request.club), pk=self.kwargs["pk"])
+
+    def get_teams(self):
+        return self.get_series().teams.all()
+
+    def post(self, request, pk):
+        series = self.get_series()
+        created = generate_occurrences(series)
+        body = ngettext("%(count)d new occurrence generated.", "%(count)d new occurrences generated.", len(created)) % {"count": len(created)}
+        notify(request, f"s|{_('Occurrences generated')}|{body}")
+        return redirect("management:event_series_detail", pk=series.pk)
+
+
+class LocationListView(ManagementPositionRequiredMixin, ListView):
+    template_name = "management/location_list.html"
+    context_object_name = "locations"
+
+    def get_queryset(self):
+        return Location.objects.filter(club=self.request.club)
+
+
+class LocationCreateView(ManagementPositionRequiredMixin, CreateView):
+    model = Location
+    form_class = LocationForm
+    template_name = "management/location_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(location)s” created.") % {"location": self.object}
+        notify(self.request, f"s|{_('Location created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:location_list")
+
+
+class LocationUpdateView(ManagementPositionRequiredMixin, UpdateView):
+    model = Location
+    form_class = LocationForm
+    template_name = "management/location_form.html"
+
+    def get_queryset(self):
+        return Location.objects.filter(club=self.request.club)
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(location)s” updated.") % {"location": self.object}
+        notify(self.request, f"s|{_('Location updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:location_list")
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class LocationDeleteView(ManagementPositionRequiredMixin, View):
+    def post(self, request, pk):
+        location = get_object_or_404(Location.objects.filter(club=request.club), pk=pk)
+        name = str(location)
+        # Event/EventSeries.location is SET_NULL -- no ProtectedError to catch.
+        location.delete()
+
+        body = _("“%(location)s” has been deleted.") % {"location": name}
+        notify(request, f"w|{_('Location deleted')}|{body}")
+        return redirect("management:location_list")
+
+
+class OpponentListView(ManagementPositionRequiredMixin, ListView):
+    template_name = "management/opponent_list.html"
+    context_object_name = "opponents"
+
+    def get_queryset(self):
+        return Opponent.objects.filter(club=self.request.club)
+
+
+class OpponentCreateView(ManagementPositionRequiredMixin, CreateView):
+    model = Opponent
+    form_class = OpponentForm
+    template_name = "management/opponent_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(opponent)s” created.") % {"opponent": self.object}
+        notify(self.request, f"s|{_('Opponent created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:opponent_list")
+
+
+class OpponentUpdateView(ManagementPositionRequiredMixin, UpdateView):
+    model = Opponent
+    form_class = OpponentForm
+    template_name = "management/opponent_form.html"
+
+    def get_queryset(self):
+        return Opponent.objects.filter(club=self.request.club)
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(opponent)s” updated.") % {"opponent": self.object}
+        notify(self.request, f"s|{_('Opponent updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:opponent_list")
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class OpponentDeleteView(ManagementPositionRequiredMixin, View):
+    def post(self, request, pk):
+        opponent = get_object_or_404(Opponent.objects.filter(club=request.club), pk=pk)
+        name = str(opponent)
+        # Event/EventSeries.opponent is SET_NULL -- no ProtectedError to catch.
+        opponent.delete()
+
+        body = _("“%(opponent)s” has been deleted.") % {"opponent": name}
+        notify(request, f"w|{_('Opponent deleted')}|{body}")
+        return redirect("management:opponent_list")
+
+
+class SponsorListView(ClubAdminRequiredMixin, ListView):
+    """Sponsors are a business/revenue relationship, same bucket as
+    memberships/roles/shop -- admin-only, unlike Location/Opponent which any
+    management position can maintain."""
+
+    template_name = "management/sponsor_list.html"
+    context_object_name = "sponsors"
+
+    def get_queryset(self):
+        return Sponsor.objects.filter(club=self.request.club)
+
+
+class SponsorCreateView(ClubAdminRequiredMixin, CreateView):
+    model = Sponsor
+    form_class = SponsorForm
+    template_name = "management/sponsor_form.html"
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(sponsor)s” created.") % {"sponsor": self.object}
+        notify(self.request, f"s|{_('Sponsor created')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:sponsor_list")
+
+
+class SponsorUpdateView(ClubAdminRequiredMixin, UpdateView):
+    model = Sponsor
+    form_class = SponsorForm
+    template_name = "management/sponsor_form.html"
+
+    def get_queryset(self):
+        return Sponsor.objects.filter(club=self.request.club)
+
+    def form_valid(self, form):
+        response = super().form_valid(form)
+        body = _("“%(sponsor)s” updated.") % {"sponsor": self.object}
+        notify(self.request, f"s|{_('Sponsor updated')}|{body}")
+        return response
+
+    def get_success_url(self):
+        return reverse("management:sponsor_list")
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(update_view=True, **kwargs)
+
+
+class SponsorDeleteView(ClubAdminRequiredMixin, View):
+    def post(self, request, pk):
+        sponsor = get_object_or_404(Sponsor.objects.filter(club=request.club), pk=pk)
+        name = str(sponsor)
+        sponsor.delete()
+
+        body = _("“%(sponsor)s” has been deleted.") % {"sponsor": name}
+        notify(request, f"w|{_('Sponsor deleted')}|{body}")
+        return redirect("management:sponsor_list")
+
+
+class ProductListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "shop"
+    page_title = _("Products")
+
+    def get_queryset(self):
+        return Product.objects.filter(club=self.request.club)
+
+
+class OrderListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "shop"
+    page_title = _("Orders")
+
+    def get_queryset(self):
+        return Order.objects.filter(club=self.request.club)
+
+
+class DiscountListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "shop"
+    page_title = _("Discounts")
+
+    def get_queryset(self):
+        return Discount.objects.filter(club=self.request.club)
+
+
+class InvoiceListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "shop"
+    page_title = _("Invoices")
+
+    def get_queryset(self):
+        return Invoice.objects.filter(club=self.request.club)
+
+
+class FormListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "formbuilder"
+    page_title = _("Forms")
+
+    def get_queryset(self):
+        return FormBuilderForm.objects.filter(club=self.request.club)
+
+
+class SubmissionListView(FeatureRequiredMixin, StubListMixin, ListView):
+    feature_flag = "formbuilder"
+    page_title = _("Submissions")
+
+    def get_queryset(self):
+        return Submission.objects.filter(form__club=self.request.club, form_id=self.kwargs["pk"])
diff --git a/members/__init__.py b/members/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/members/admin.py b/members/admin.py
new file mode 100644
index 0000000..f76e698
--- /dev/null
+++ b/members/admin.py
@@ -0,0 +1,62 @@
+from django.contrib import admin
+from django.utils.translation import gettext_lazy as _
+
+from .models import Family, FamilyMembership, Member
+
+
+# Register your models here.
+class MemberFamilyInline(admin.TabularInline):
+    """Family memberships shown on the Member page."""
+
+    model = FamilyMembership
+    extra = 1
+    autocomplete_fields = ("family",)
+
+
+@admin.register(Member)
+class MemberAdmin(admin.ModelAdmin):
+    list_display = ("last_name", "first_name", "contact_email", "phone_display", "emergency_phone_display", "user")
+    list_select_related = ("user",)
+    search_fields = ("first_name", "last_name", "email")
+    autocomplete_fields = ("user",)
+    inlines = [MemberFamilyInline]
+    fields = ("user", "first_name", "last_name", "date_of_birth", "email", "phone", "emergency_phone")
+
+    @admin.display(description=_("email"), ordering="email")
+    def contact_email(self, obj):
+        return obj.contact_email
+
+    @admin.display(description=_("phone"), ordering="phone")
+    def phone_display(self, obj):
+        return obj.phone.as_international if obj.phone else ""
+
+    @admin.display(description=_("emergency phone"), ordering="emergency_phone")
+    def emergency_phone_display(self, obj):
+        return obj.emergency_phone.as_international if obj.emergency_phone else ""
+
+
+class FamilyMemberInline(admin.TabularInline):
+    """Members shown on the Family page."""
+
+    model = FamilyMembership
+    extra = 1
+    autocomplete_fields = ("member",)
+
+
+@admin.register(Family)
+class FamilyAdmin(admin.ModelAdmin):
+    list_display = ("__str__", "member_count")
+    search_fields = ("name", "memberships__member__first_name", "memberships__member__last_name")
+    inlines = [FamilyMemberInline]
+
+    @admin.display(description=_("members"))
+    def member_count(self, obj):
+        return obj.memberships.count()
+
+
+@admin.register(FamilyMembership)
+class FamilyMembershipAdmin(admin.ModelAdmin):
+    list_display = ("family", "member", "role")
+    list_filter = ("role",)
+    autocomplete_fields = ("family", "member")
+    search_fields = ("family__name", "member__first_name", "member__last_name")
diff --git a/members/apps.py b/members/apps.py
new file mode 100644
index 0000000..85a1306
--- /dev/null
+++ b/members/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class MembersConfig(AppConfig):
+    name = "members"
diff --git a/members/management/__init__.py b/members/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/members/management/commands/__init__.py b/members/management/commands/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/members/management/commands/import_members_csv.py b/members/management/commands/import_members_csv.py
new file mode 100644
index 0000000..2c092f1
--- /dev/null
+++ b/members/management/commands/import_members_csv.py
@@ -0,0 +1,41 @@
+from features.commands import CommandError, MaintenanceAwareCommand
+from members.services import MemberCsvImporter
+
+
+class Command(MaintenanceAwareCommand):
+    help = "Import club members from a CSV file."
+
+    def add_arguments(self, parser) -> None:
+        parser.add_argument(
+            "csv_file",
+            type=str,
+            help="Path to the CSV file to import.",
+        )
+        parser.add_argument(
+            "--date-format",
+            default="%Y-%m-%d",
+            help="Date format for date_of_birth. Default: %%Y-%%m-%%d",
+        )
+
+    def handle(self, *args, **options) -> str | None:
+        importer = MemberCsvImporter(date_format=options["date_format"])
+
+        try:
+            result = importer.import_path(options["csv_file"])
+        except Exception as exc:
+            raise CommandError(str(exc)) from exc
+
+        for error in result.errors:
+            self.stderr.write(self.style.ERROR(f"Row {error.row_number} skipped: {error.message}"))
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                "Import complete. "
+                f"Members created: {result.created_members}. "
+                f"Members updated: {result.updated_members}. "
+                f"Users created: {result.created_users}. "
+                f"Memberships created: {result.created_memberships}. "
+                f"Memberships updated: {result.updated_memberships}. "
+                f"Rows skipped: {result.skipped_rows}."
+            )
+        )
diff --git a/members/migrations/0001_initial.py b/members/migrations/0001_initial.py
new file mode 100644
index 0000000..316c63d
--- /dev/null
+++ b/members/migrations/0001_initial.py
@@ -0,0 +1,71 @@
+# Generated by Django 6.0.6 on 2026-07-11 22:09
+
+import django.db.models.deletion
+import phonenumber_field.modelfields
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Family',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(blank=True, max_length=255, verbose_name='name')),
+            ],
+            options={
+                'verbose_name': 'family',
+                'verbose_name_plural': 'families',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Member',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('first_name', models.CharField(max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(max_length=150, verbose_name='last name')),
+                ('date_of_birth', models.DateField(blank=True, null=True, verbose_name='date of birth')),
+                ('email', models.EmailField(blank=True, max_length=254, verbose_name='email')),
+                ('phone', phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None, verbose_name='phone number')),
+                ('emergency_phone', phonenumber_field.modelfields.PhoneNumberField(blank=True, max_length=128, null=True, region=None, verbose_name='emergency phone number')),
+                ('user', models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='member', to=settings.AUTH_USER_MODEL, verbose_name='user')),
+            ],
+            options={
+                'verbose_name': 'member',
+                'verbose_name_plural': 'members',
+                'ordering': ['last_name', 'first_name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='FamilyMembership',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('role', models.CharField(choices=[('parent', 'parent'), ('child', 'child'), ('guardian', 'guardian'), ('other', 'other')], default='parent', max_length=255, verbose_name='role')),
+                ('family', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='memberships', to='members.family', verbose_name='family')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='family_memberships', to='members.member', verbose_name='member')),
+            ],
+            options={
+                'verbose_name': 'family membership',
+                'verbose_name_plural': 'family memberships',
+                'ordering': ['family', 'role', 'member__last_name', 'member__first_name'],
+            },
+        ),
+        migrations.AddIndex(
+            model_name='member',
+            index=models.Index(fields=['last_name', 'first_name'], name='members_mem_last_na_92a910_idx'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='familymembership',
+            unique_together={('family', 'member')},
+        ),
+    ]
diff --git a/members/migrations/0002_alter_familymembership_unique_together_and_more.py b/members/migrations/0002_alter_familymembership_unique_together_and_more.py
new file mode 100644
index 0000000..4b555e9
--- /dev/null
+++ b/members/migrations/0002_alter_familymembership_unique_together_and_more.py
@@ -0,0 +1,21 @@
+# Generated by Django 6.0.6 on 2026-07-12 14:12
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('members', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='familymembership',
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name='familymembership',
+            constraint=models.UniqueConstraint(fields=('family', 'member'), name='unique_member_per_family'),
+        ),
+    ]
diff --git a/members/migrations/0003_family_created_family_modified_member_created_and_more.py b/members/migrations/0003_family_created_family_modified_member_created_and_more.py
new file mode 100644
index 0000000..e878d25
--- /dev/null
+++ b/members/migrations/0003_family_created_family_modified_member_created_and_more.py
@@ -0,0 +1,36 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='family',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566131, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='family',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='member',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566186, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='member',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+    ]
diff --git a/members/migrations/__init__.py b/members/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/members/models.py b/members/models.py
new file mode 100644
index 0000000..27bcd37
--- /dev/null
+++ b/members/models.py
@@ -0,0 +1,101 @@
+from django.conf import settings
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+from phonenumber_field.modelfields import PhoneNumberField
+
+from rosterchief.base import UUIDModel
+
+
+class Family(UUIDModel):
+    name = models.CharField(_("name"), max_length=255, blank=True)
+
+    class Meta:
+        verbose_name = _("family")
+        verbose_name_plural = _("families")
+        ordering = ["name"]
+
+    def __str__(self):
+        if self.name:
+            return self.name
+        surnames = sorted({last_name for last_name in self.memberships.values_list("member__last_name", flat=True) if last_name})
+        if surnames:
+            return _("%(surnames)s") % {"surnames": " / ".join(surnames)}
+        return _("Family %(id)s") % {"id": str(self.pk)[:8]}
+
+    @property
+    def guardians(self):
+        return Member.objects.filter(
+            family_memberships__family=self,
+            family_memberships__role__in=[FamilyMembership.FamilyRole.PARENT, FamilyMembership.FamilyRole.GUARDIAN],
+        )
+
+    @property
+    def children(self):
+        return Member.objects.filter(
+            family_memberships__family=self,
+            family_memberships__role=FamilyMembership.FamilyRole.CHILD,
+        )
+
+
+class Member(UUIDModel):
+    user = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, related_name="member", null=True, blank=True, verbose_name=_("user"))
+
+    first_name = models.CharField(_("first name"), max_length=150)
+    last_name = models.CharField(_("last name"), max_length=150)
+
+    date_of_birth = models.DateField(_("date of birth"), null=True, blank=True)
+
+    email = models.EmailField(_("email"), blank=True)
+    phone = PhoneNumberField(_("phone number"), null=True, blank=True)
+    emergency_phone = PhoneNumberField(_("emergency phone number"), null=True, blank=True)
+
+    class Meta:
+        verbose_name = _("member")
+        verbose_name_plural = _("members")
+        ordering = ["last_name", "first_name"]
+        indexes = [models.Index(fields=["last_name", "first_name"])]
+
+    def __str__(self):
+        return self.get_full_name()
+
+    def get_full_name(self):
+        return f"{self.first_name} {self.last_name}".strip()
+
+    def get_short_name(self):
+        return self.first_name
+
+    @property
+    def contact_email(self):
+        """Best email to reach this member: own contact email, else login email."""
+        return self.email or (self.user.email if self.user_id else "")
+
+    @property
+    def guardians(self):
+        return Member.objects.filter(
+            family_memberships__role__in=[FamilyMembership.FamilyRole.PARENT, FamilyMembership.FamilyRole.GUARDIAN],
+            family_memberships__family__memberships__member=self,
+            family_memberships__family__memberships__role=FamilyMembership.FamilyRole.CHILD,
+        ).distinct()
+
+
+class FamilyMembership(models.Model):
+    class FamilyRole(models.TextChoices):
+        PARENT = "parent", _("parent")
+        CHILD = "child", _("child")
+        GUARDIAN = "guardian", _("guardian")
+        OTHER = "other", _("other")
+
+    family = models.ForeignKey(Family, on_delete=models.CASCADE, related_name="memberships", verbose_name=_("family"))
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="family_memberships", verbose_name=_("member"))
+    role = models.CharField(_("role"), max_length=255, choices=FamilyRole.choices, default=FamilyRole.PARENT)
+
+    class Meta:
+        verbose_name = _("family membership")
+        verbose_name_plural = _("family memberships")
+        ordering = ["family", "role", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["family", "member"], name="unique_member_per_family"),
+        ]
+
+    def __str__(self):
+        return f"{self.family} - {self.member} ({self.get_role_display()})"
diff --git a/members/services/__init__.py b/members/services/__init__.py
new file mode 100644
index 0000000..c8abceb
--- /dev/null
+++ b/members/services/__init__.py
@@ -0,0 +1,13 @@
+from members.services.member_csv_importer import (
+    ImportedMemberRowResult,
+    MemberCsvImporter,
+    MemberImportResult,
+    MemberImportRowError,
+)
+
+__all__ = [
+    "ImportedMemberRowResult",
+    "MemberCsvImporter",
+    "MemberImportResult",
+    "MemberImportRowError",
+]
diff --git a/members/services/family.py b/members/services/family.py
new file mode 100644
index 0000000..8dc4916
--- /dev/null
+++ b/members/services/family.py
@@ -0,0 +1,122 @@
+"""Registering families: a parent (who needs a login) and a child (who doesn't),
+linked to each other -- either together as a new family, or one at a time onto an
+existing one.
+"""
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django.utils import timezone
+
+from club.models import ClubMembership
+from members.models import Family, FamilyMembership, Member
+
+User = get_user_model()
+
+
+def find_member_by_email(email):
+    """The Member behind a login email, if that account exists at all."""
+    return Member.objects.filter(user__email__iexact=email).first()
+
+
+def get_or_create_login_member(email, first_name="", last_name=""):
+    """Find or create the Member behind ``email``, creating a User (no usable
+    password -- they set one via the reset-link flow) the first time we see them.
+    Mirrors controlpanel.services.admins.grant_club_admin.
+    """
+    email = email.lower()
+    user, user_created = User.objects.get_or_create(email=email, defaults={"is_active": True})
+    if user_created:
+        user.set_unusable_password()
+        user.save(update_fields=["password"])
+
+    member, _ = Member.objects.get_or_create(user=user, defaults={"first_name": first_name, "last_name": last_name})
+    return member
+
+
+def grant_login(member, email):
+    """Give a login-less member (a child old enough to need their own account, most
+    often) the ability to sign in -- a new User with no usable password, same as
+    get_or_create_login_member; they set one via the reset-link flow. Unlike that
+    function, this attaches the login to a specific, already-existing Member rather
+    than finding-or-creating one -- the caller's form has already checked the email
+    isn't already in use."""
+    user = User.objects.create(email=email.lower(), is_active=True)
+    user.set_unusable_password()
+    user.save(update_fields=["password"])
+
+    member.user = user
+    member.save(update_fields=["user"])
+    return user
+
+
+def _enrol(club, season, member):
+    """Sign a member up for the club's current season, if there is one. The
+    implicit MEMBER role follows automatically (club/signals.py)."""
+    if season is None:
+        return None
+
+    membership, _ = ClubMembership.objects.get_or_create(
+        club=club,
+        member=member,
+        season=season,
+        defaults={"status": ClubMembership.StatusChoices.ACTIVE, "signed_up_at": timezone.localdate()},
+    )
+    return membership
+
+
+@transaction.atomic
+def register_family(club, season, *, parent_email, parent_first_name, parent_last_name, child_first_name, child_last_name, child_date_of_birth=None):
+    """Create a new family in one go: a parent (with a login) and a child
+    (without one), linked to each other and signed up for ``season``."""
+    parent = get_or_create_login_member(parent_email, parent_first_name, parent_last_name)
+    child = Member.objects.create(first_name=child_first_name, last_name=child_last_name, date_of_birth=child_date_of_birth)
+
+    family = Family.objects.create()
+    FamilyMembership.objects.create(family=family, member=parent, role=FamilyMembership.FamilyRole.PARENT)
+    FamilyMembership.objects.create(family=family, member=child, role=FamilyMembership.FamilyRole.CHILD)
+
+    _enrol(club, season, parent)
+    _enrol(club, season, child)
+
+    return family
+
+
+@transaction.atomic
+def add_child_to_family(club, season, family, *, first_name, last_name, date_of_birth=None):
+    """A family that needs one more child registered -- a sibling joining, most often."""
+    child = Member.objects.create(first_name=first_name, last_name=last_name, date_of_birth=date_of_birth)
+    FamilyMembership.objects.create(family=family, member=child, role=FamilyMembership.FamilyRole.CHILD)
+    _enrol(club, season, child)
+
+    return child
+
+
+@transaction.atomic
+def add_parent_to_family(club, season, family, *, email, first_name="", last_name=""):
+    """A family that needs one more parent/guardian registered."""
+    parent = get_or_create_login_member(email, first_name, last_name)
+    # get_or_create, not create: re-adding an email already on this family (a typo'd
+    # re-submit, say) must not trip unique_member_per_family.
+    FamilyMembership.objects.get_or_create(family=family, member=parent, defaults={"role": FamilyMembership.FamilyRole.PARENT})
+    _enrol(club, season, parent)
+
+    return parent
+
+
+def attach_to_family(member, *, role, family=None):
+    """Link a standalone member into a family -- a new one, or an existing one they
+    turn out to belong to (e.g. a second parent already registered separately)."""
+    if family is None:
+        family = Family.objects.create()
+
+    FamilyMembership.objects.get_or_create(family=family, member=member, defaults={"role": role})
+    return family
+
+
+@transaction.atomic
+def detach_from_family(member, family):
+    """Remove member from one specific family -- they may still belong to others.
+    An empty family (this was its last member) is cleaned up same as before."""
+    FamilyMembership.objects.filter(member=member, family=family).delete()
+    if not family.memberships.exists():
+        family.delete()
diff --git a/members/services/member_csv_importer.py b/members/services/member_csv_importer.py
new file mode 100644
index 0000000..fdadee3
--- /dev/null
+++ b/members/services/member_csv_importer.py
@@ -0,0 +1,200 @@
+import csv
+from dataclasses import dataclass, field
+from datetime import date, datetime
+from pathlib import Path
+from typing import IO, Any
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+
+from club.models import Club, ClubMembership, Season
+from club.tenancy import reset_current_club, set_current_club
+from members.models import Member
+
+REQUIRED_COLUMNS = {"first_name", "last_name", "email", "date_of_birth", "create_account", "club_name", "license_number"}
+TRUE_VALUES = {"1", "true", "yes", "y", "on"}
+
+User = get_user_model()
+
+
+@dataclass
+class MemberImportRowError:
+    row_number: int
+    message: str
+
+
+@dataclass
+class MemberImportResult:
+    created_members: int = 0
+    updated_members: int = 0
+    created_users: int = 0
+    created_memberships: int = 0
+    updated_memberships: int = 0
+    skipped_rows: int = 0
+    errors: list[MemberImportRowError] = field(default_factory=list)
+
+    @property
+    def successful_rows(self):
+        return self.created_members + self.updated_members
+
+
+@dataclass
+class ImportedMemberRowResult:
+    member_created: bool
+    user_created: bool
+    membership_created: bool
+
+
+class MemberCsvImporter:
+    def __init__(self, *, date_format="%Y-%m-%d") -> None:
+        self.date_format = date_format
+
+    def import_path(self, csv_path) -> MemberImportResult:
+        path = Path(csv_path)
+
+        if not path.exists():
+            raise FileNotFoundError(f"CSV file does not exist: {path}")
+
+        with path.open(newline="", encoding="utf-8-sig") as csv_file:
+            return self.import_file(csv_file)
+
+    def import_file(self, csv_file: IO[str]) -> MemberImportResult:
+        result = MemberImportResult()
+        reader = csv.DictReader(csv_file)
+
+        if reader.fieldnames is None:
+            raise ValueError("CSV file is empty or missing a header row.")
+
+        missing_columns = REQUIRED_COLUMNS - set(reader.fieldnames)
+        if missing_columns:
+            raise ValueError("CSV file is missing required columns: " + ", ".join(sorted(missing_columns)))
+
+        for row_number, row in enumerate(reader, start=2):
+            try:
+                row_result = self.import_row(row)
+            except Exception as exc:
+                result.skipped_rows += 1
+                result.errors.append(
+                    MemberImportRowError(
+                        row_number=row_number,
+                        message=str(exc),
+                    )
+                )
+                continue
+
+            if row_result.member_created:
+                result.created_members += 1
+            else:
+                result.updated_members += 1
+
+            if row_result.user_created:
+                result.created_users += 1
+
+            if row_result.membership_created:
+                result.created_memberships += 1
+            else:
+                result.updated_memberships += 1
+
+        return result
+
+    @transaction.atomic
+    def import_row(self, row) -> ImportedMemberRowResult:
+        first_name = self.clean_required(row, "first_name")
+        last_name = self.clean_required(row, "last_name")
+        email = self.clean_required(row, "email").lower()
+        date_of_birth = self.parse_date(self.clean_required(row, "date_of_birth"))
+        create_account = self.as_bool(row.get("create_account", ""))
+        club_name = self.clean_required(row, "club_name")
+        license_number = row.get("license_number", "").strip()
+
+        user = None
+        user_created = False
+
+        if create_account:
+            user, user_created = self.get_or_create_user(email)
+
+        member, member_created = Member.objects.update_or_create(
+            email=email,
+            defaults={
+                "first_name": first_name,
+                "last_name": last_name,
+                "date_of_birth": date_of_birth,
+                "user": user,
+            },
+        )
+
+        club = self.get_club(club_name)
+        season = self.get_current_season(club)
+
+        _, membership_created = ClubMembership.objects.update_or_create(
+            club=club,
+            member=member,
+            season=season,
+            defaults={
+                "license": license_number,
+            },
+        )
+
+        return ImportedMemberRowResult(
+            member_created=member_created,
+            user_created=user_created,
+            membership_created=membership_created,
+        )
+
+    def get_club(self, club_name) -> Club:
+        # Never get_or_create: Club.name isn't unique, so a typo'd or differently-cased
+        # value would otherwise either spin up a duplicate club or raise
+        # MultipleObjectsReturned against one that already exists. Matching
+        # case-insensitively absorbs the harmless variety (a CSV export's casing rarely
+        # matches the platform's own); an unknown club is a data problem the importer
+        # must not paper over by inventing one.
+        club = Club.objects.filter(name__iexact=club_name).first()
+        if club is None:
+            raise ValueError(f"Unknown club '{club_name}'.")
+
+        return club
+
+    def get_current_season(self, club) -> Season:
+        # Season.get_current() is tenant-scoped, so bind the row's club as the
+        # active tenant for the lookup.
+        token = set_current_club(club)
+        try:
+            season = Season.get_current()
+        finally:
+            reset_current_club(token)
+
+        if season is None:
+            raise ValueError(f"No current season for club '{club.name}'.")
+
+        return season
+
+    def get_or_create_user(self, email) -> tuple[User, bool]:
+        user, created = User.objects.get_or_create(
+            email=email,
+            defaults={
+                "is_active": True,
+            },
+        )
+
+        if created:
+            user.set_unusable_password()
+            user.save(update_fields=["password"])
+
+        return user, created
+
+    def clean_required(self, row, field_name) -> Any:
+        value = row.get(field_name, "").strip()
+
+        if not value:
+            raise ValueError(f"{field_name} is required.")
+
+        return value
+
+    def parse_date(self, value) -> date:
+        try:
+            return datetime.strptime(value, self.date_format).date()
+        except ValueError as exc:
+            raise ValueError(f"Invalid date_of_birth '{value}'. Expected format: {self.date_format}.") from exc
+
+    def as_bool(self, value) -> bool:
+        return value.strip().lower() in TRUE_VALUES
diff --git a/members/tests.py b/members/tests.py
new file mode 100644
index 0000000..aaa77fd
--- /dev/null
+++ b/members/tests.py
@@ -0,0 +1,619 @@
+import tempfile
+from datetime import date, timedelta
+from io import StringIO
+from pathlib import Path
+
+from allauth.mfa.models import Authenticator
+from django.contrib.admin.sites import AdminSite
+from django.core.management import call_command
+from django.core.management.base import CommandError
+from django.db import IntegrityError
+from django.db.models import SET_NULL
+from django.test import TestCase
+from django.utils import timezone
+
+from authentication.models import User
+from club.models import Club, ClubMembership, Season
+from members.admin import FamilyAdmin
+from members.models import Family, FamilyMembership, Member
+from members.services import MemberImportResult
+
+
+# Create your tests here.
+class MemberModelTests(TestCase):
+    def test_str_and_name_helpers(self):
+        member = Member.objects.create(first_name="John", last_name="Smith")
+
+        self.assertEqual(str(member), "John Smith")
+        self.assertEqual(member.get_full_name(), "John Smith")
+        self.assertEqual(member.get_short_name(), "John")
+
+    def test_get_full_name_strips_when_partial(self):
+        member = Member.objects.create(first_name="Cher", last_name="")
+        self.assertEqual(member.get_full_name(), "Cher")
+
+    def test_contact_email_prefers_own_email(self):
+        user = User.objects.create_user(email="login@example.com", password="x")
+        member = Member.objects.create(user=user, first_name="Own", last_name="Email", email="own@example.com")
+        self.assertEqual(member.contact_email, "own@example.com")
+
+    def test_contact_email_falls_back_to_login_email(self):
+        user = User.objects.create_user(email="login@example.com", password="x")
+        member = Member.objects.create(user=user, first_name="No", last_name="Email")
+        self.assertEqual(member.contact_email, "login@example.com")
+
+    def test_contact_email_empty_without_email_or_user(self):
+        member = Member.objects.create(first_name="Zero", last_name="Contact")
+        self.assertEqual(member.contact_email, "")
+
+    def test_member_can_exist_without_user(self):
+        member = Member.objects.create(first_name="No", last_name="Login")
+        self.assertIsNone(member.user)
+
+    def test_deleting_user_nulls_member_but_keeps_it(self):
+        user = User.objects.create_user(email="temp@example.com", password="x")
+        member = Member.objects.create(user=user, first_name="Keep", last_name="Me")
+
+        # OneToOneField uses on_delete=SET_NULL.
+        field = Member._meta.get_field("user")
+        self.assertIs(field.remote_field.on_delete, SET_NULL)
+
+        user.delete()
+        member.refresh_from_db()
+        self.assertIsNone(member.user)
+        self.assertTrue(Member.objects.filter(pk=member.pk).exists())
+
+    def test_user_member_is_one_to_one(self):
+        user = User.objects.create_user(email="once@example.com", password="x")
+        Member.objects.create(user=user, first_name="First", last_name="Member")
+
+        with self.assertRaises(IntegrityError):
+            Member.objects.create(user=user, first_name="Second", last_name="Member")
+
+
+class FamilyNameOptionalTests(TestCase):
+    def test_family_can_be_created_without_a_name(self):
+        family = Family.objects.create()
+        self.assertEqual(family.name, "")
+
+    def test_str_uses_name_when_present(self):
+        self.assertEqual(str(Family.objects.create(name="The Smiths")), "The Smiths")
+
+    def test_str_falls_back_to_member_surnames(self):
+        family = Family.objects.create()
+        smith = Member.objects.create(first_name="Pat", last_name="Smith")
+        jones = Member.objects.create(first_name="Kim", last_name="Jones")
+        FamilyMembership.objects.create(family=family, member=smith, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family, member=jones, role=FamilyMembership.FamilyRole.CHILD)
+
+        # Distinct surnames, alphabetically ordered.
+        self.assertEqual(str(family), "Jones / Smith")
+
+    def test_str_falls_back_to_short_id_when_empty(self):
+        family = Family.objects.create()
+        self.assertEqual(str(family), f"Family {str(family.pk)[:8]}")
+
+
+class FamilyModelTests(TestCase):
+    def setUp(self):
+        self.family = Family.objects.create(name="The Smiths")
+        self.parent = Member.objects.create(first_name="Pat", last_name="Smith")
+        self.guardian = Member.objects.create(first_name="Gale", last_name="Smith")
+        self.child = Member.objects.create(first_name="Kim", last_name="Smith")
+        self.other = Member.objects.create(first_name="Ola", last_name="Smith")
+
+        FamilyMembership.objects.create(family=self.family, member=self.parent, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=self.family, member=self.guardian, role=FamilyMembership.FamilyRole.GUARDIAN)
+        FamilyMembership.objects.create(family=self.family, member=self.child, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=self.family, member=self.other, role=FamilyMembership.FamilyRole.OTHER)
+
+    def test_str(self):
+        self.assertEqual(str(self.family), "The Smiths")
+
+    def test_guardians_include_parents_and_guardians_only(self):
+        guardians = set(self.family.guardians)
+        self.assertEqual(guardians, {self.parent, self.guardian})
+
+    def test_children_include_children_only(self):
+        children = list(self.family.children)
+        self.assertEqual(children, [self.child])
+
+    def test_guardians_are_scoped_to_the_family(self):
+        other_family = Family.objects.create(name="The Joneses")
+        outsider = Member.objects.create(first_name="Out", last_name="Sider")
+        FamilyMembership.objects.create(family=other_family, member=outsider, role=FamilyMembership.FamilyRole.PARENT)
+
+        self.assertNotIn(outsider, set(self.family.guardians))
+
+
+class MemberGuardiansTests(TestCase):
+    def test_guardians_of_a_child_are_family_parents_and_guardians(self):
+        family = Family.objects.create(name="The Does")
+        mum = Member.objects.create(first_name="Mary", last_name="Doe")
+        legal = Member.objects.create(first_name="Lee", last_name="Doe")
+        kid = Member.objects.create(first_name="Kit", last_name="Doe")
+
+        FamilyMembership.objects.create(family=family, member=mum, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family, member=legal, role=FamilyMembership.FamilyRole.GUARDIAN)
+        FamilyMembership.objects.create(family=family, member=kid, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.assertEqual(set(kid.guardians), {mum, legal})
+
+    def test_guardians_empty_for_a_parent(self):
+        family = Family.objects.create(name="The Roes")
+        parent = Member.objects.create(first_name="Ray", last_name="Roe")
+        kid = Member.objects.create(first_name="Ren", last_name="Roe")
+
+        FamilyMembership.objects.create(family=family, member=parent, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family, member=kid, role=FamilyMembership.FamilyRole.CHILD)
+
+        self.assertEqual(list(parent.guardians), [])
+
+    def test_guardians_do_not_leak_across_families(self):
+        family_a = Family.objects.create(name="Family A")
+        family_b = Family.objects.create(name="Family B")
+        parent_a = Member.objects.create(first_name="Ann", last_name="A")
+        parent_b = Member.objects.create(first_name="Ben", last_name="B")
+        kid = Member.objects.create(first_name="Cody", last_name="A")
+
+        FamilyMembership.objects.create(family=family_a, member=parent_a, role=FamilyMembership.FamilyRole.PARENT)
+        FamilyMembership.objects.create(family=family_a, member=kid, role=FamilyMembership.FamilyRole.CHILD)
+        # parent_b belongs to a different family and must not appear as kid's guardian.
+        FamilyMembership.objects.create(family=family_b, member=parent_b, role=FamilyMembership.FamilyRole.PARENT)
+
+        self.assertEqual(set(kid.guardians), {parent_a})
+
+
+class FamilyMembershipModelTests(TestCase):
+    def test_default_role_is_parent(self):
+        family = Family.objects.create(name="Fam")
+        member = Member.objects.create(first_name="D", last_name="Efault")
+        membership = FamilyMembership.objects.create(family=family, member=member)
+
+        self.assertEqual(membership.role, FamilyMembership.FamilyRole.PARENT)
+
+    def test_str_includes_family_member_and_role(self):
+        family = Family.objects.create(name="The Smiths")
+        member = Member.objects.create(first_name="Pat", last_name="Smith")
+        membership = FamilyMembership.objects.create(family=family, member=member, role=FamilyMembership.FamilyRole.GUARDIAN)
+
+        self.assertEqual(str(membership), "The Smiths - Pat Smith (guardian)")
+
+    def test_member_unique_per_family(self):
+        family = Family.objects.create(name="Fam")
+        member = Member.objects.create(first_name="Solo", last_name="Once")
+        FamilyMembership.objects.create(family=family, member=member, role=FamilyMembership.FamilyRole.PARENT)
+
+        with self.assertRaises(IntegrityError):
+            FamilyMembership.objects.create(family=family, member=member, role=FamilyMembership.FamilyRole.CHILD)
+
+    def test_same_member_can_join_multiple_families(self):
+        member = Member.objects.create(first_name="Multi", last_name="Fam")
+        family_a = Family.objects.create(name="A")
+        family_b = Family.objects.create(name="B")
+
+        FamilyMembership.objects.create(family=family_a, member=member, role=FamilyMembership.FamilyRole.CHILD)
+        FamilyMembership.objects.create(family=family_b, member=member, role=FamilyMembership.FamilyRole.PARENT)
+
+        self.assertEqual(member.family_memberships.count(), 2)
+
+    def test_deleting_family_cascades_to_memberships(self):
+        family = Family.objects.create(name="Doomed")
+        member = Member.objects.create(first_name="Cas", last_name="Cade")
+        FamilyMembership.objects.create(family=family, member=member)
+
+        family.delete()
+
+        self.assertFalse(FamilyMembership.objects.exists())
+        # The member itself survives; only the membership is removed.
+        self.assertTrue(Member.objects.filter(pk=member.pk).exists())
+
+
+class FamilyAdminTests(TestCase):
+    def test_member_count_reflects_memberships(self):
+        family = Family.objects.create(name="The Smiths")
+        for i in range(3):
+            member = Member.objects.create(first_name=f"Kid{i}", last_name="Smith")
+            FamilyMembership.objects.create(family=family, member=member, role=FamilyMembership.FamilyRole.CHILD)
+
+        admin_instance = FamilyAdmin(Family, AdminSite())
+        self.assertEqual(admin_instance.member_count(family), 3)
+
+    def test_member_count_is_zero_without_members(self):
+        family = Family.objects.create(name="Empty")
+        admin_instance = FamilyAdmin(Family, AdminSite())
+        self.assertEqual(admin_instance.member_count(family), 0)
+
+
+class AdminSmokeTests(TestCase):
+    """Exercise the admin config end-to-end to catch misregistration
+    (bad search_fields, autocomplete targets, fieldsets, custom forms)."""
+
+    def setUp(self):
+        self.admin = User.objects.create_superuser(email="root@example.com", password="pw-secret-123")
+        # Staff must hold a second factor (RequireMFAMiddleware).
+        Authenticator.objects.create(user=self.admin, type=Authenticator.Type.TOTP, data={"secret": "JBSWY3DPEHPK3PXP"})
+        self.client.force_login(self.admin)
+
+    def test_changelists_load(self):
+        for app_label, model in (
+            ("authentication", "user"),
+            ("members", "member"),
+            ("members", "family"),
+            ("members", "familymembership"),
+        ):
+            with self.subTest(model=model):
+                response = self.client.get(f"/admin/{app_label}/{model}/")
+                self.assertEqual(response.status_code, 200)
+
+    def test_user_add_page_loads(self):
+        response = self.client.get("/admin/authentication/user/add/")
+        self.assertEqual(response.status_code, 200)
+
+    def test_member_changelist_shows_grouped_numbers_and_fallback_email(self):
+        user = User.objects.create_user(email="fallback@example.com", password="pw")
+        Member.objects.create(
+            user=user,
+            first_name="Grouped",
+            last_name="Numbers",
+            phone="+32470123456",
+            emergency_phone="+3221234567",
+        )
+        response = self.client.get("/admin/members/member/")
+        content = response.content.decode()
+
+        # Numbers rendered in grouped international format, not raw E.164.
+        self.assertIn("+32 470 12 34 56", content)
+        self.assertIn("+32 2 123 45 67", content)
+        # Email column falls back to the linked login email.
+        self.assertIn("fallback@example.com", content)
+
+    def test_create_user_through_admin_hashes_password(self):
+        response = self.client.post(
+            "/admin/authentication/user/add/",
+            {
+                "email": "new@example.com",
+                "password1": "a-good-password-42",
+                "password2": "a-good-password-42",
+                # Empty MemberInline management form — no profile created.
+                "member-TOTAL_FORMS": "0",
+                "member-INITIAL_FORMS": "0",
+                "member-MIN_NUM_FORMS": "0",
+                "member-MAX_NUM_FORMS": "1",
+            },
+        )
+        self.assertEqual(response.status_code, 302)
+        created = User.objects.get(email="new@example.com")
+        self.assertTrue(created.check_password("a-good-password-42"))
+
+    def test_autocomplete_endpoints_respond(self):
+        # Member.user autocomplete resolves against UserAdmin.search_fields.
+        response = self.client.get(
+            "/admin/autocomplete/",
+            {"app_label": "members", "model_name": "member", "field_name": "user", "term": "root"},
+        )
+        self.assertEqual(response.status_code, 200)
+
+
+class ImportMembersCsvCommandTests(TestCase):
+    def setUp(self):
+        # Memberships are season-scoped: the importer attaches each one to the
+        # club's current season, so the target club needs one covering today.
+        self.club = Club.objects.create(name="City Swim Club")
+        today = timezone.localdate()
+        self.season = Season.objects.create(
+            club=self.club,
+            start_date=today - timedelta(days=90),
+            end_date=today + timedelta(days=275),
+        )
+
+    def write_csv(self, content):
+        temp_file = tempfile.NamedTemporaryFile(mode="w", suffix=".csv", delete=False, encoding="utf-8")
+        temp_file.write(content)
+        temp_file.close()
+        self.addCleanup(lambda: Path(temp_file.name).unlink(missing_ok=True))
+        return temp_file.name
+
+    def call_import_command(self, csv_path, **options):
+        stdout = StringIO()
+        stderr = StringIO()
+
+        call_command(
+            "import_members_csv",
+            csv_path,
+            stdout=stdout,
+            stderr=stderr,
+            **options,
+        )
+
+        return stdout.getvalue(), stderr.getvalue()
+
+    def test_import_creates_member_club_membership_and_user_when_requested(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,true,City Swim Club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Import complete.", stdout)
+        self.assertIn("Members created: 1.", stdout)
+        self.assertIn("Users created: 1.", stdout)
+        self.assertIn("Memberships created: 1.", stdout)
+        self.assertIn("Rows skipped: 0.", stdout)
+
+        member = Member.objects.get(email="jane@example.com")
+        self.assertEqual(member.first_name, "Jane")
+        self.assertEqual(member.last_name, "Doe")
+        self.assertEqual(member.date_of_birth, date(2010, 4, 12))
+        self.assertIsNotNone(member.user)
+        self.assertEqual(member.user.email, "jane@example.com")
+        self.assertFalse(member.user.has_usable_password())
+
+        membership = ClubMembership.objects.get(club=self.club, member=member)
+        self.assertEqual(membership.license, "LIC-001")
+        self.assertEqual(membership.season, self.season)
+
+    def test_import_creates_member_without_user_when_create_account_is_false(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "John,Smith,john@example.com,2009-11-03,false,City Swim Club,LIC-002",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Members created: 1.", stdout)
+        self.assertIn("Users created: 0.", stdout)
+
+        member = Member.objects.get(email="john@example.com")
+        self.assertIsNone(member.user)
+        self.assertFalse(User.objects.filter(email="john@example.com").exists())
+
+    def test_import_updates_existing_member_and_membership(self):
+        member = Member.objects.create(
+            first_name="Old",
+            last_name="Name",
+            email="jane@example.com",
+            date_of_birth=date(2010, 1, 1),
+        )
+        ClubMembership.objects.create(
+            club=self.club,
+            season=self.season,
+            member=member,
+            license="OLD-LIC",
+        )
+
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,City Swim Club,LIC-NEW",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Members created: 0.", stdout)
+        self.assertIn("Members updated: 1.", stdout)
+        self.assertIn("Memberships created: 0.", stdout)
+        self.assertIn("Memberships updated: 1.", stdout)
+
+        member.refresh_from_db()
+        self.assertEqual(member.first_name, "Jane")
+        self.assertEqual(member.last_name, "Doe")
+        self.assertEqual(member.date_of_birth, date(2010, 4, 12))
+
+        membership = ClubMembership.objects.get(club=self.club, member=member)
+        self.assertEqual(membership.license, "LIC-NEW")
+
+    def test_import_links_existing_user_when_create_account_is_true(self):
+        user = User.objects.create_user(email="jane@example.com", password="secret123")
+
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,true,City Swim Club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Users created: 0.", stdout)
+
+        member = Member.objects.get(email="jane@example.com")
+        self.assertEqual(member.user, user)
+        self.assertTrue(user.check_password("secret123"))
+
+    def test_import_supports_custom_date_format(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,12/04/2010,false,City Swim Club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path, date_format="%d/%m/%Y")
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Members created: 1.", stdout)
+
+        member = Member.objects.get(email="jane@example.com")
+        self.assertEqual(member.date_of_birth, date(2010, 4, 12))
+
+    def test_import_skips_invalid_row_and_imports_valid_rows(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,City Swim Club,LIC-001",
+                    "Broken,Date,broken@example.com,not-a-date,false,City Swim Club,LIC-002",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertIn("Row 3 skipped:", stderr)
+        self.assertIn("Invalid date_of_birth 'not-a-date'.", stderr)
+        self.assertIn("Members created: 1.", stdout)
+        self.assertIn("Rows skipped: 1.", stdout)
+
+        self.assertTrue(Member.objects.filter(email="jane@example.com").exists())
+        self.assertFalse(Member.objects.filter(email="broken@example.com").exists())
+
+    def test_import_fails_for_missing_file(self):
+        stdout = StringIO()
+        stderr = StringIO()
+
+        with self.assertRaises(CommandError) as context:
+            call_command(
+                "import_members_csv",
+                "does-not-exist.csv",
+                stdout=stdout,
+                stderr=stderr,
+            )
+
+        self.assertIn("CSV file does not exist", str(context.exception))
+
+    def test_import_fails_for_missing_required_columns(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email",
+                    "Jane,Doe,jane@example.com",
+                ]
+            )
+        )
+
+        stdout = StringIO()
+        stderr = StringIO()
+
+        with self.assertRaises(CommandError) as context:
+            call_command(
+                "import_members_csv",
+                csv_path,
+                stdout=stdout,
+                stderr=stderr,
+            )
+
+        self.assertIn("CSV file is missing required columns:", str(context.exception))
+        self.assertIn("club_name", str(context.exception))
+        self.assertIn("date_of_birth", str(context.exception))
+        self.assertIn("license_number", str(context.exception))
+
+    def test_import_fails_for_empty_csv_file(self):
+        csv_path = self.write_csv("")
+
+        stdout = StringIO()
+        stderr = StringIO()
+
+        with self.assertRaises(CommandError) as context:
+            call_command(
+                "import_members_csv",
+                csv_path,
+                stdout=stdout,
+                stderr=stderr,
+            )
+
+        self.assertIn("CSV file is empty or missing a header row.", str(context.exception))
+
+    def test_import_skips_row_with_empty_required_field(self):
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,City Swim Club,LIC-001",
+                    ",Missing,nofirst@example.com,2011-05-13,false,City Swim Club,LIC-002",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertIn("Row 3 skipped:", stderr)
+        self.assertIn("first_name is required.", stderr)
+        self.assertIn("Members created: 1.", stdout)
+        self.assertIn("Rows skipped: 1.", stdout)
+        self.assertFalse(Member.objects.filter(email="nofirst@example.com").exists())
+
+    def test_import_skips_row_when_club_has_no_current_season(self):
+        # The club exists but has no season, so the row is skipped and — because
+        # the row is atomic — the member creation rolls back too.
+        Club.objects.create(name="New Club")
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,New Club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertIn("Row 2 skipped:", stderr)
+        self.assertIn("No current season for club 'New Club'.", stderr)
+        self.assertIn("Rows skipped: 1.", stdout)
+        self.assertFalse(Member.objects.filter(email="jane@example.com").exists())
+
+    def test_import_skips_row_for_an_unknown_club(self):
+        # The importer must not silently spin up a club for a typo'd or unknown
+        # name — that is a data problem, not something to paper over.
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,Nonexistent Club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertIn("Row 2 skipped:", stderr)
+        self.assertIn("Unknown club 'Nonexistent Club'.", stderr)
+        self.assertIn("Rows skipped: 1.", stdout)
+        self.assertFalse(Member.objects.filter(email="jane@example.com").exists())
+        self.assertFalse(Club.objects.filter(name="Nonexistent Club").exists())
+
+    def test_import_matches_a_club_name_case_insensitively(self):
+        # A CSV export's casing rarely matches the platform's own; that is
+        # harmless variation, not a different club.
+        csv_path = self.write_csv(
+            "\n".join(
+                [
+                    "first_name,last_name,email,date_of_birth,create_account,club_name,license_number",
+                    "Jane,Doe,jane@example.com,2010-04-12,false,city swim club,LIC-001",
+                ]
+            )
+        )
+
+        stdout, stderr = self.call_import_command(csv_path)
+
+        self.assertEqual(stderr, "")
+        self.assertIn("Rows skipped: 0.", stdout)
+        membership = ClubMembership.objects.get(club=self.club, member__email="jane@example.com")
+        self.assertEqual(membership.season, self.season)
+
+
+class MemberImportResultTests(TestCase):
+    def test_successful_rows_sums_created_and_updated(self):
+        result = MemberImportResult(created_members=2, updated_members=3)
+        self.assertEqual(result.successful_rows, 5)
diff --git a/members/views.py b/members/views.py
new file mode 100644
index 0000000..60f00ef
--- /dev/null
+++ b/members/views.py
@@ -0,0 +1 @@
+# Create your views here.
diff --git a/news/__init__.py b/news/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/news/admin.py b/news/admin.py
new file mode 100644
index 0000000..59c6c48
--- /dev/null
+++ b/news/admin.py
@@ -0,0 +1,23 @@
+from django.contrib import admin
+
+from .models import News, NewsPhoto
+
+
+class NewsPhotoInline(admin.TabularInline):
+    model = NewsPhoto
+    extra = 0
+
+
+@admin.register(News)
+class NewsAdmin(admin.ModelAdmin):
+    list_display = ["title", "club", "status", "visibility", "created_by"]
+    list_filter = ["club", "status", "visibility"]
+    search_fields = ["title"]
+    raw_id_fields = ["created_by"]
+    inlines = [NewsPhotoInline]
+
+
+@admin.register(NewsPhoto)
+class NewsPhotoAdmin(admin.ModelAdmin):
+    list_display = ["news_item", "is_main", "ordering"]
+    list_filter = ["is_main"]
diff --git a/news/api.py b/news/api.py
new file mode 100644
index 0000000..b4e84b5
--- /dev/null
+++ b/news/api.py
@@ -0,0 +1,83 @@
+"""Public read-only news endpoint -- see api/urls.py for how this is mounted.
+
+Pagination is hand-rolled (limit/offset params) rather than Ninja's built-in
+@paginate: a photo's URL has to be made absolute against `request`
+(api/urls.py's docstring explains why), and Ninja's response-schema resolvers
+don't have request access, so building the page manually here is simpler than
+fighting that.
+"""
+
+import uuid
+from datetime import datetime
+
+from django.utils import timezone
+from ninja import Router, Schema
+
+from api.errors import require_club
+
+from .models import News
+
+router = Router(tags=["news"])
+
+DEFAULT_LIMIT = 20
+MAX_LIMIT = 100
+
+
+class NewsPhotoOut(Schema):
+    url: str
+    is_main: bool
+    ordering: int
+
+
+class NewsItemOut(Schema):
+    id: uuid.UUID
+    title: str
+    slug: str
+    body: str
+    published_at: datetime
+    teams: list[str]
+    photos: list[NewsPhotoOut]
+
+
+class NewsListOut(Schema):
+    count: int
+    limit: int
+    offset: int
+    results: list[NewsItemOut]
+
+
+def _to_news_item_out(item, request) -> NewsItemOut:
+    return NewsItemOut(
+        id=item.pk,
+        title=item.title,
+        slug=item.slug,
+        body=item.body,
+        published_at=item.published_at,
+        teams=[team.name for team in item.teams.all()],
+        photos=[NewsPhotoOut(url=request.build_absolute_uri(photo.image.url), is_main=photo.is_main, ordering=photo.ordering) for photo in item.photos.all()],
+    )
+
+
+@router.get("/", response=NewsListOut, summary="Published news")
+def list_news(request, limit: int = DEFAULT_LIMIT, offset: int = 0):
+    """Published news items whose release date has passed and that are marked
+    visible outside the club (`external` or `both`) -- newest first."""
+    club = require_club(request)
+    limit = max(1, min(limit, MAX_LIMIT))
+    offset = max(0, offset)
+
+    queryset = (
+        News.objects.filter(
+            club=club,
+            status=News.Status.PUBLISHED,
+            published_at__lte=timezone.now(),
+            visibility__in=[News.Visibility.EXTERNAL, News.Visibility.BOTH],
+        )
+        .prefetch_related("photos", "teams")
+        .order_by("-published_at")
+    )
+
+    count = queryset.count()
+    page = queryset[offset : offset + limit]
+
+    return NewsListOut(count=count, limit=limit, offset=offset, results=[_to_news_item_out(item, request) for item in page])
diff --git a/news/apps.py b/news/apps.py
new file mode 100644
index 0000000..2c5b670
--- /dev/null
+++ b/news/apps.py
@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class NewsConfig(AppConfig):
+    name = "news"
+
+    def ready(self):
+        from . import signals  # noqa: F401
diff --git a/news/migrations/0001_initial.py b/news/migrations/0001_initial.py
new file mode 100644
index 0000000..6fc79e0
--- /dev/null
+++ b/news/migrations/0001_initial.py
@@ -0,0 +1,67 @@
+# Generated by Django 6.0.6 on 2026-08-03 16:22
+
+import django.db.models.deletion
+import news.models
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0017_club_season_duration_months_club_season_start'),
+        ('members', '0003_family_created_family_modified_member_created_and_more'),
+        ('teams', '0006_alter_position_ordering'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='News',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('title', models.CharField(max_length=255, verbose_name='title')),
+                ('slug', models.SlugField(blank=True, max_length=255, verbose_name='slug')),
+                ('body', models.TextField(verbose_name='body')),
+                ('visibility', models.CharField(choices=[('internal', 'internal'), ('external', 'external'), ('both', 'both')], default='internal', max_length=10, verbose_name='visibility')),
+                ('status', models.CharField(choices=[('draft', 'draft'), ('published', 'published')], default='draft', max_length=10, verbose_name='status')),
+                ('published_at', models.DateTimeField(blank=True, help_text='When this goes live. In the future to schedule it ahead of time.', null=True, verbose_name='publish date')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('created_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='news_items', to='members.member', verbose_name='created by')),
+                ('teams', models.ManyToManyField(blank=True, help_text='Leave empty for club-wide news.', related_name='news_items', to='teams.team', verbose_name='teams')),
+            ],
+            options={
+                'verbose_name': 'news item',
+                'verbose_name_plural': 'news items',
+                'ordering': ['-created'],
+            },
+        ),
+        migrations.CreateModel(
+            name='NewsPhoto',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('image', models.ImageField(upload_to=news.models.news_photo_path, verbose_name='image')),
+                ('is_main', models.BooleanField(default=False, verbose_name='main picture')),
+                ('ordering', models.PositiveSmallIntegerField(default=0, verbose_name='ordering')),
+                ('news_item', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='photos', to='news.news', verbose_name='news item')),
+            ],
+            options={
+                'verbose_name': 'news photo',
+                'verbose_name_plural': 'news photos',
+                'ordering': ['ordering', 'created'],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='news',
+            constraint=models.UniqueConstraint(fields=('club', 'slug'), name='unique_news_slug_per_club'),
+        ),
+        migrations.AddConstraint(
+            model_name='newsphoto',
+            constraint=models.UniqueConstraint(condition=models.Q(('is_main', True)), fields=('news_item',), name='unique_main_photo_per_news_item'),
+        ),
+    ]
diff --git a/news/migrations/__init__.py b/news/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/news/models.py b/news/models.py
new file mode 100644
index 0000000..c3db193
--- /dev/null
+++ b/news/models.py
@@ -0,0 +1,81 @@
+from django.db import models
+from django.db.models import Q
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel
+from teams.models import Team
+
+
+def news_photo_path(instance, filename):
+    return f"clubs/{instance.news_item.club.slug}/news/{instance.news_item.slug}/{filename}"
+
+
+class News(ClubScopedModel):
+    class Visibility(models.TextChoices):
+        INTERNAL = "internal", _("internal")
+        EXTERNAL = "external", _("external")
+        BOTH = "both", _("both")
+
+    class Status(models.TextChoices):
+        DRAFT = "draft", _("draft")
+        PUBLISHED = "published", _("published")
+
+    title = models.CharField(_("title"), max_length=255)
+    slug = models.SlugField(_("slug"), max_length=255, blank=True)
+    slug_source = "title"
+
+    body = models.TextField(_("body"))
+    teams = models.ManyToManyField(Team, related_name="news_items", blank=True, verbose_name=_("teams"), help_text=_("Leave empty for club-wide news."))
+
+    visibility = models.CharField(_("visibility"), max_length=10, choices=Visibility.choices, default=Visibility.INTERNAL)
+    status = models.CharField(_("status"), max_length=10, choices=Status.choices, default=Status.DRAFT)
+    published_at = models.DateTimeField(_("publish date"), null=True, blank=True, help_text=_("When this goes live. In the future to schedule it ahead of time."))
+
+    created_by = models.ForeignKey(Member, on_delete=models.SET_NULL, null=True, blank=True, related_name="news_items", verbose_name=_("created by"))
+
+    class Meta:
+        verbose_name = _("news item")
+        verbose_name_plural = _("news items")
+        ordering = ["-created"]
+        constraints = [
+            models.UniqueConstraint(fields=["club", "slug"], name="unique_news_slug_per_club"),
+        ]
+
+    def __str__(self):
+        return self.title
+
+    def publish(self, at=None):
+        self.status, self.published_at = self.Status.PUBLISHED, at or timezone.now()
+        self.save(update_fields=["status", "published_at"])
+
+    def unpublish(self):
+        self.status, self.published_at = self.Status.DRAFT, None
+        self.save(update_fields=["status", "published_at"])
+
+    @property
+    def is_scheduled(self):
+        """PUBLISHED (past the editor's release gate) but its publish date hasn't
+        arrived yet -- not actually live. A later consumer (member feed, public
+        API) filters `status=PUBLISHED, published_at__lte=now()`; nothing here
+        needs a cron job to "flip" it at the scheduled moment."""
+        return self.status == self.Status.PUBLISHED and self.published_at is not None and self.published_at > timezone.now()
+
+
+class NewsPhoto(UUIDModel):
+    news_item = models.ForeignKey(News, on_delete=models.CASCADE, related_name="photos", verbose_name=_("news item"))
+    image = models.ImageField(_("image"), upload_to=news_photo_path)
+    is_main = models.BooleanField(_("main picture"), default=False)
+    ordering = models.PositiveSmallIntegerField(_("ordering"), default=0)
+
+    class Meta:
+        verbose_name = _("news photo")
+        verbose_name_plural = _("news photos")
+        ordering = ["ordering", "created"]
+        constraints = [
+            models.UniqueConstraint(fields=["news_item"], condition=Q(is_main=True), name="unique_main_photo_per_news_item"),
+        ]
+
+    def __str__(self):
+        return f"{self.news_item} — photo"
diff --git a/news/signals.py b/news/signals.py
new file mode 100644
index 0000000..fc35865
--- /dev/null
+++ b/news/signals.py
@@ -0,0 +1,18 @@
+"""Keep NewsPhoto's file in sync with the row: deleting a NewsPhoto -- one at
+a time, or in bulk via a News item's cascade -- must also delete the image
+from storage, or it just accumulates orphaned files forever.
+
+Connecting a post_delete receiver also stops Django's fast-delete
+optimisation for a News cascade, so every NewsPhoto instance (and this
+signal) actually runs instead of being collapsed into one bulk SQL DELETE.
+"""
+
+from django.db.models.signals import post_delete
+from django.dispatch import receiver
+
+from .models import NewsPhoto
+
+
+@receiver(post_delete, sender=NewsPhoto)
+def delete_photo_file(sender, instance, **kwargs):
+    instance.image.delete(save=False)
diff --git a/news/tests.py b/news/tests.py
new file mode 100644
index 0000000..ff9bb82
--- /dev/null
+++ b/news/tests.py
@@ -0,0 +1,100 @@
+import datetime
+
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.db import IntegrityError
+from django.test import TestCase
+from django.utils import timezone
+
+from club.models import Club
+
+from .models import News, NewsPhoto
+
+
+def make_photo(news_item, *, is_main=False):
+    image = SimpleUploadedFile("photo.jpg", b"fake-image-bytes", content_type="image/jpeg")
+    return NewsPhoto.objects.create(news_item=news_item, image=image, is_main=is_main)
+
+
+class NewsModelTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_slug_is_derived_from_title(self):
+        item = News.objects.create(club=self.club, title="Season Kickoff", body="Body text.")
+
+        self.assertEqual(item.slug, "season-kickoff")
+
+    def test_slug_is_unique_per_club_not_globally(self):
+        News.objects.create(club=self.club, title="Season Kickoff", body="First.")
+        second = News.objects.create(club=self.club, title="Season Kickoff", body="Second.")
+
+        self.assertEqual(second.slug, "season-kickoff-2")
+
+    def test_two_clubs_can_share_the_same_slug(self):
+        other_club = Club.objects.create(name="Rival FC", slug="rival-fc")
+        News.objects.create(club=self.club, title="Season Kickoff", body="First.")
+
+        other = News.objects.create(club=other_club, title="Season Kickoff", body="Other club.")
+
+        self.assertEqual(other.slug, "season-kickoff")
+
+    def test_defaults_to_draft_and_internal(self):
+        item = News.objects.create(club=self.club, title="Draft item", body="Body.")
+
+        self.assertEqual(item.status, News.Status.DRAFT)
+        self.assertEqual(item.visibility, News.Visibility.INTERNAL)
+        self.assertIsNone(item.published_at)
+
+    def test_publish_defaults_the_publish_date_to_now(self):
+        item = News.objects.create(club=self.club, title="Item", body="Body.")
+
+        item.publish()
+
+        self.assertEqual(item.status, News.Status.PUBLISHED)
+        self.assertIsNotNone(item.published_at)
+        self.assertFalse(item.is_scheduled)
+
+    def test_publish_accepts_a_future_date_and_is_scheduled(self):
+        item = News.objects.create(club=self.club, title="Item", body="Body.")
+        future = timezone.now() + datetime.timedelta(days=7)
+
+        item.publish(at=future)
+
+        self.assertEqual(item.status, News.Status.PUBLISHED)
+        self.assertEqual(item.published_at, future)
+        self.assertTrue(item.is_scheduled)
+
+    def test_unpublish_clears_the_publish_date(self):
+        item = News.objects.create(club=self.club, title="Item", body="Body.")
+        item.publish()
+
+        item.unpublish()
+
+        self.assertEqual(item.status, News.Status.DRAFT)
+        self.assertIsNone(item.published_at)
+
+
+class NewsPhotoModelTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.item = News.objects.create(club=self.club, title="Match report", body="Body.")
+
+    def test_a_second_main_photo_is_rejected_at_the_database_level(self):
+        make_photo(self.item, is_main=True)
+
+        with self.assertRaises(IntegrityError):
+            make_photo(self.item, is_main=True)
+
+    def test_two_non_main_photos_are_fine(self):
+        make_photo(self.item, is_main=False)
+        make_photo(self.item, is_main=False)
+
+        self.assertEqual(self.item.photos.count(), 2)
+
+    def test_two_different_news_items_can_each_have_a_main_photo(self):
+        other_item = News.objects.create(club=self.club, title="Other item", body="Body.")
+
+        make_photo(self.item, is_main=True)
+        make_photo(other_item, is_main=True)
+
+        self.assertEqual(NewsPhoto.objects.filter(is_main=True).count(), 2)
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..96338b6
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,1246 @@
+{
+  "name": "rosterchief",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rosterchief",
+      "dependencies": {
+        "chart.js": "^4.5.1"
+      },
+      "devDependencies": {
+        "@fontsource-variable/jetbrains-mono": "^5.2.8",
+        "@fontsource-variable/roboto": "^5.2.10",
+        "@fontsource-variable/tourney": "^5.2.8",
+        "@fontsource/ubuntu": "^5.2.8",
+        "@tailwindcss/cli": "^4.1.0",
+        "daisyui": "^5.0.0",
+        "tailwindcss": "^4.1.0"
+      }
+    },
+    "node_modules/@fontsource-variable/jetbrains-mono": {
+      "version": "5.2.8",
+      "resolved": "https://registry.npmjs.org/@fontsource-variable/jetbrains-mono/-/jetbrains-mono-5.2.8.tgz",
+      "integrity": "sha512-WBA9elru6Jdp5df2mES55wuOO0WIrn3kpXnI4+W2ek5u3ZgLS9XS4gmIlcQhiZOWEKl95meYdvK7xI+ETLCq/Q==",
+      "dev": true,
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@fontsource-variable/roboto": {
+      "version": "5.2.10",
+      "resolved": "https://registry.npmjs.org/@fontsource-variable/roboto/-/roboto-5.2.10.tgz",
+      "integrity": "sha512-LJ0iLg6aHbLzN515gyHzmdTqJzd9NlI95cCg1DW0F5G7KkFqRLBBKBbqEJx4nSu4aby3IKmw3ZH6Fe928IfaSQ==",
+      "dev": true,
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@fontsource-variable/tourney": {
+      "version": "5.2.8",
+      "resolved": "https://registry.npmjs.org/@fontsource-variable/tourney/-/tourney-5.2.8.tgz",
+      "integrity": "sha512-jCKjAoSZGylpe8a3GWL5f94pUGDJf2wwvNCleLOPXNE63HOQz6wWis/YJs9sT6Qm0dgLLlBT5712mOLFj0YsSw==",
+      "dev": true,
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@fontsource/ubuntu": {
+      "version": "5.2.8",
+      "resolved": "https://registry.npmjs.org/@fontsource/ubuntu/-/ubuntu-5.2.8.tgz",
+      "integrity": "sha512-esSJCpgigwWOm4Ug9f7AMozUyBq5Iobea5C9QYsl2OlCb62wZABBUbXahHLdFv5Ru4lJCD9tUX6xEAeLwUTNBg==",
+      "dev": true,
+      "license": "UFL-1.0",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@kurkle/color": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
+      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
+      "license": "MIT"
+    },
+    "node_modules/@parcel/watcher": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
+      "integrity": "sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^1.0.3",
+        "is-glob": "^4.0.3",
+        "micromatch": "^4.0.5",
+        "node-addon-api": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher-android-arm64": "2.5.1",
+        "@parcel/watcher-darwin-arm64": "2.5.1",
+        "@parcel/watcher-darwin-x64": "2.5.1",
+        "@parcel/watcher-freebsd-x64": "2.5.1",
+        "@parcel/watcher-linux-arm-glibc": "2.5.1",
+        "@parcel/watcher-linux-arm-musl": "2.5.1",
+        "@parcel/watcher-linux-arm64-glibc": "2.5.1",
+        "@parcel/watcher-linux-arm64-musl": "2.5.1",
+        "@parcel/watcher-linux-x64-glibc": "2.5.1",
+        "@parcel/watcher-linux-x64-musl": "2.5.1",
+        "@parcel/watcher-win32-arm64": "2.5.1",
+        "@parcel/watcher-win32-ia32": "2.5.1",
+        "@parcel/watcher-win32-x64": "2.5.1"
+      }
+    },
+    "node_modules/@parcel/watcher-android-arm64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.1.tgz",
+      "integrity": "sha512-KF8+j9nNbUN8vzOFDpRMsaKBHZ/mcjEjMToVMJOhTozkDonQFFrRcfdLWn6yWKCmJKmdVxSgHiYvTCef4/qcBA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-arm64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.1.tgz",
+      "integrity": "sha512-eAzPv5osDmZyBhou8PoF4i6RQXAfeKL9tjb3QzYuccXFMQU0ruIc/POh30ePnaOyD1UXdlKguHBmsTs53tVoPw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-x64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.1.tgz",
+      "integrity": "sha512-1ZXDthrnNmwv10A0/3AJNZ9JGlzrF82i3gNQcWOzd7nJ8aj+ILyW1MTxVk35Db0u91oD5Nlk9MBiujMlwmeXZg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-freebsd-x64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.1.tgz",
+      "integrity": "sha512-SI4eljM7Flp9yPuKi8W0ird8TI/JK6CSxju3NojVI6BjHsTyK7zxA9urjVjEKJ5MBYC+bLmMcbAWlZ+rFkLpJQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-glibc": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.1.tgz",
+      "integrity": "sha512-RCdZlEyTs8geyBkkcnPWvtXLY44BCeZKmGYRtSgtwwnHR4dxfHRG3gR99XdMEdQ7KeiDdasJwwvNSF5jKtDwdA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-musl": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.1.tgz",
+      "integrity": "sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-glibc": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.1.tgz",
+      "integrity": "sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-musl": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.1.tgz",
+      "integrity": "sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-glibc": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.1.tgz",
+      "integrity": "sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-musl": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.1.tgz",
+      "integrity": "sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-arm64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.1.tgz",
+      "integrity": "sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-ia32": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.1.tgz",
+      "integrity": "sha512-c2KkcVN+NJmuA7CGlaGD1qJh1cLfDnQsHjE89E60vUEMlqduHGCdCLJCID5geFVM0dOtA3ZiIO8BoEQmzQVfpQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-x64": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.1.tgz",
+      "integrity": "sha512-9lHBdJITeNR++EvSQVUcaZoWupyHfXe1jZvGZ06O/5MflPcuPLtEphScIBL+AiCWBO46tDSHzWyD0uDmmZqsgA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/cli": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/cli/-/cli-4.3.2.tgz",
+      "integrity": "sha512-Fzt+HrIZHDlkRYKdLMBeufaroaPvwCBG70sMLdmurdeadNMO/LxbmT8Sbb+P83ep0iAlAImettb7Y+rO+37rXw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@parcel/watcher": "2.5.1",
+        "@tailwindcss/node": "4.3.2",
+        "@tailwindcss/oxide": "4.3.2",
+        "enhanced-resolve": "5.21.6",
+        "mri": "^1.2.0",
+        "picocolors": "^1.1.1",
+        "tailwindcss": "4.3.2"
+      },
+      "bin": {
+        "tailwindcss": "dist/index.mjs"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.2.tgz",
+      "integrity": "sha512-yWP/sqEcBLaD8JuA6zNwxoYKr75qxTioYwlRwekj5Jr/I5GXnoJfjetH/psLUIv74cYTH2lBUEzBkinthoYcBg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "5.21.6",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.2"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.2.tgz",
+      "integrity": "sha512-z8ZgnzX8gdNoWLBLqBPoh/sjnxkwvf9ZuWjnO0l0yIzbLa5/9S+eC5QxGZKRobVHIC3/1BoMWjHblqWjcgFgag==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-x64": "4.3.2",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.2",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.2",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.2",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.2",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.2"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.2.tgz",
+      "integrity": "sha512-WHxqIuHpvZ5VtdX6GTl1Ik/Vp2YuN42Et+0CdeaVd/frQ9jAvGmvR8vLT+jk3e8/Q3x8kECB9+R17pgpp2BulA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.2.tgz",
+      "integrity": "sha512-GZypeUY/IDJW3877KeM+O67vbXr3MBnbtEL4aYhNErv/JWZhye2vGSWWG9tB6iiqR2MqRNkY8IOUy4NdSZV26w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.2.tgz",
+      "integrity": "sha512-UIIzmefR6KO1sDU7MzRqAxC8iBpft/VhkGjTjnhoS6k7Z3rQ9wEgA1ODSiyH/tcSYssulNm4Ci3hOeK1jH7ccQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.2.tgz",
+      "integrity": "sha512-GN+uAmcI6DNspnCDwtOAZrTz6oukJnp337qZvxqCGLd3BHBzJpO0ZbTLRvJNdztOeAmTzewewGIMPb0tk2R4WA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.2.tgz",
+      "integrity": "sha512-4ABn7qSbdHRwTiDiuWNegCyb5+2FJ4vKIKc3DmKrvAFw7MU1Lm11dIkTPwUaFdTzc7IsOpDbqBrlh0x6y36U/w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.2.tgz",
+      "integrity": "sha512-wDgEIGwoM8w8pufh9LVt1PahDgNdKXrLC2qfAnV3vAmococ9RWbxeAw4pxPttd/TsJfwjyLf90Dg1y9y8I6Emw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.2.tgz",
+      "integrity": "sha512-J5Nuk0uZQIiMTJj3LEx4sAA9tMFUoXQZFv1J6An+QGYe53HKRJuFDi0rpq/tuouCZeAbOBY3kQ6g8qeD4TUjtA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.2.tgz",
+      "integrity": "sha512-kqCZpSKOBEJO4mz7OqWoofBZeXTAwaVGPj0ErAj7CojmhKpWVWVOnrt9dE8odoIraZq4oj3ausM37kXi+Tow8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.2.tgz",
+      "integrity": "sha512-cixpqbh2toJDmkuCRI68nXA8ZxNmdK9Y+9v5h3MC3ZQKy/0BO8AWzlkWyRM7JAFSGBlfig4YVTPsK6MVgqz1uw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.2.tgz",
+      "integrity": "sha512-4ec2Z/LOmRsAgU23CS4xeJfcJlmRg94A/XrbGRCF1gyU/zdDfRLYDVsS+ynSZCmGNxQ1jQriQOKMQeQxBA3Isw==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.2.tgz",
+      "integrity": "sha512-Zyr/M0+XcYZu3bZrUytc7TXvrk0ftWfl8gN2MwekNDzhqhKRUucMPSeOzM0o0wH5AWOU49BsKRrfKxI2atCPMQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.2.tgz",
+      "integrity": "sha512-QI9BO7KlNZsp2GuO0jwAAj5jCDABOKXRkCk2XuKTSaNEFSdfzqswYVTtCHBNKHLsqyjFyFkqlDiwkNbTYSssMQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/chart.js": {
+      "version": "4.5.1",
+      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.5.1.tgz",
+      "integrity": "sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==",
+      "license": "MIT",
+      "dependencies": {
+        "@kurkle/color": "^0.3.0"
+      },
+      "engines": {
+        "pnpm": ">=8"
+      }
+    },
+    "node_modules/daisyui": {
+      "version": "5.6.18",
+      "resolved": "https://registry.npmjs.org/daisyui/-/daisyui-5.6.18.tgz",
+      "integrity": "sha512-6y9rboRQl8fosnusy/5pg11yp+H0LtK3YdtfS4Vf2QVnaYOKasNdYm6hDxeiT6bwZPdl4WRPzVIlIApdo2ssBg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/saadeghi/daisyui?sponsor=1"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz",
+      "integrity": "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "detect-libc": "bin/detect-libc.js"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/enhanced-resolve": {
+      "version": "5.21.6",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
+      "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss/node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/mri": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
+      "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.2.tgz",
+      "integrity": "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    }
+  }
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..1b7712c
--- /dev/null
+++ b/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "rosterchief",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tailwindcss -i ./assets/app.css -o ./static/css/app.css --minify",
+    "watch": "tailwindcss -i ./assets/app.css -o ./static/css/app.css --watch",
+    "vendor:chart": "node -e \"const fs=require('fs');const s=fs.readFileSync('node_modules/chart.js/dist/chart.umd.js','utf8').split('\\n').filter(l=>!l.startsWith('//# sourceMappingURL=')).join('\\n');fs.writeFileSync('static/js/chart.js',s)\""
+  },
+  "devDependencies": {
+    "@fontsource-variable/jetbrains-mono": "^5.2.8",
+    "@fontsource-variable/roboto": "^5.2.10",
+    "@fontsource-variable/tourney": "^5.2.8",
+    "@fontsource/ubuntu": "^5.2.8",
+    "@tailwindcss/cli": "^4.1.0",
+    "daisyui": "^5.0.0",
+    "tailwindcss": "^4.1.0"
+  },
+  "dependencies": {
+    "chart.js": "^4.5.1"
+  }
+}
diff --git a/pyproject.toml b/pyproject.toml
index af2bc8b..28f933b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,13 +1,34 @@
 [project]
-name = "clubmanager"
+name = "rosterchief"
 version = "0.1.0"
 requires-python = ">=3.14"
 dependencies = [
+    "beautifulsoup4>=4.15.0",
+    "dj-database-url>=3.1.2",
     "django>=6.0.6",
+    "django-allauth[mfa]>=65.18.0",
+    "django-countries>=9.0.0",
+    "django-lucide",
+    "django-ninja>=1.6.2",
+    "django-phonenumber-field[phonenumbers]>=8.4.0",
+    "django-redis>=7.0.0",
+    "django-storages[s3]>=1.14.6",
+    "django-waffle>=5.0.0",
+    "gunicorn>=26.0.0",
+    "openpyxl>=3.1.5",
+    "pillow>=12.3.0",
+    "psycopg[binary]>=3.3.4",
+    "python-dateutil>=2.9.0.post0",
+    "python-decouple>=3.8",
+    "requests>=2.34.2",
+    "weasyprint>=69.0",
+    "whitenoise>=6.12.0",
 ]
 
 [dependency-groups]
 dev = [
+    "coverage>=7.15.0",
+    "django-browser-reload>=1.21.0",
     "ruff>=0.15.17",
 ]
 
@@ -19,24 +40,28 @@ extend-exclude = ["**/migrations/*"]
 
 [tool.ruff.lint]
 select = [
-    "E",    # pycodestyle errors
-    "W",    # pycodestyle warnings
-    "F",    # pyflakes
-    "I",    # isort
-    "UP",   # pyupgrade
-    "B",    # flake8-bugbear
-    "C4",   # flake8-comprehensions
-    "DJ",   # flake8-django
-    "RUF",  # ruff-specific rules
+    "E", # pycodestyle errors
+    "W", # pycodestyle warnings
+    "F", # pyflakes
+    "I", # isort
+    "UP", # pyupgrade
+    "B", # flake8-bugbear
+    "C4", # flake8-comprehensions
+    "DJ", # flake8-django
+    "RUF", # ruff-specific rules
 ]
 ignore = [
-    "RUF012",  # Django/Wagtail model attrs (panels, Meta.ordering, ...) are framework conventions, not mutable defaults to guard.
-    "RUF005",  # Wagtail's `Page.content_panels + [...]` concatenation is the documented idiom.
+    "RUF012", # Django/Wagtail model attrs (panels, Meta.ordering, ...) are framework conventions, not mutable defaults to guard.
+    "RUF005", # Wagtail's `Page.content_panels + [...]` concatenation is the documented idiom.
 ]
 
 [tool.ruff.lint.per-file-ignores]
 # Settings legitimately use star imports and long generated values.
-"clubmanager/settings/*" = ["F403", "F405", "E501"]
+"rosterchief/settings/*" = ["F403", "F405", "E501"]
 
 [tool.ruff.lint.isort]
-known-first-party = ["accounts", "club", "members", "teams", "events", "news", "pages", "home", "search", "clubmanager"]
+known-first-party = [
+    "api", "billing", "authentication", "club", "members", "teams", "events", "formbuilder", "shop", "controlpanel", "management", "news", "pages", "home", "search", "rosterchief"]
+
+[tool.uv.sources]
+django-lucide = { git = "https://github.com/bsiebens/lucide" }
diff --git a/rosterchief/__init__.py b/rosterchief/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/clubmanager/asgi.py b/rosterchief/asgi.py
similarity index 72%
rename from clubmanager/asgi.py
rename to rosterchief/asgi.py
index 0d569a9..7352af8 100644
--- a/clubmanager/asgi.py
+++ b/rosterchief/asgi.py
@@ -1,5 +1,5 @@
 """
-ASGI config for clubmanager project.
+ASGI config for rosterchief project.
 
 It exposes the ASGI callable as a module-level variable named ``application``.
 
@@ -11,6 +11,6 @@ import os
 
 from django.core.asgi import get_asgi_application
 
-os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'clubmanager.settings')
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rosterchief.settings")
 
 application = get_asgi_application()
diff --git a/rosterchief/base.py b/rosterchief/base.py
new file mode 100644
index 0000000..827012d
--- /dev/null
+++ b/rosterchief/base.py
@@ -0,0 +1,111 @@
+import uuid
+from typing import TYPE_CHECKING
+
+from django.core.exceptions import ValidationError
+from django.db import models
+from django.utils.text import slugify
+from django.utils.translation import gettext_lazy as _
+
+from club.tenancy import require_current_club
+
+if TYPE_CHECKING:
+    from club.models import Club
+
+
+def validate_club_scope(instance, owning_club_id, *, same_club_fields=(), member_fields=()):
+    """Reject FKs that leak across clubs.
+
+    ``same_club_fields`` are FKs to club-scoped models that must share
+    ``owning_club_id``; ``member_fields`` are Member FKs whose target must have
+    a ClubMembership in that club. Unset (None) FKs are skipped. Call from a
+    model's ``clean()``.
+    """
+    errors = {}
+    for field in same_club_fields:
+        if getattr(instance, f"{field}_id") is not None and getattr(instance, field).club_id != owning_club_id:
+            errors[field] = _("Must belong to the same club.")
+
+    if member_fields:
+        from club.models import ClubMembership
+
+        for field in member_fields:
+            if getattr(instance, f"{field}_id") is not None and not ClubMembership.objects.filter(club_id=owning_club_id, member=getattr(instance, field)).exists():
+                errors[field] = _("Must be a member of this club.")
+
+    if errors:
+        raise ValidationError(errors)
+
+
+def unique_slugify(instance, value, *, slug_field="slug", scope=None):
+    """Return a slug derived from ``value``, unique within ``scope``.
+
+    Truncates to the slug field's ``max_length`` and appends ``-2``, ``-3``, …
+    on collision. ``scope`` is a dict of field lookups the uniqueness is
+    checked within (e.g. ``{"club": club}`` for per-club, ``{}``/``None`` for
+    global).
+    """
+    max_length = instance._meta.get_field(slug_field).max_length
+    base = slugify(value)[:max_length] or "item"
+
+    queryset = type(instance)._default_manager.exclude(pk=instance.pk)
+    if scope:
+        queryset = queryset.filter(**scope)
+
+    slug = base
+    suffix = 2
+    while queryset.filter(**{slug_field: slug}).exists():
+        tail = f"-{suffix}"
+        slug = f"{base[: max_length - len(tail)]}{tail}"
+        suffix += 1
+    return slug
+
+
+class TenantQuerySet(models.QuerySet):
+    def for_club(self, club: Club):
+        return self.filter(club=club)
+
+    def current_club(self):
+        return self.filter(club=require_current_club())
+
+
+class TimeStampedModel(models.Model):
+    """Row birthdays. Without these, every metric can only describe the present —
+    "42 members" is knowable, "members joined this month" is not."""
+
+    created = models.DateTimeField(_("created"), auto_now_add=True)
+    modified = models.DateTimeField(_("modified"), auto_now=True)
+
+    class Meta:
+        abstract = True
+
+
+class UUIDModel(TimeStampedModel):
+    """Abstract base class giving every model a UUID primary key and timestamps."""
+
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+
+    class Meta:
+        abstract = True
+
+
+class ClubScopedModel(UUIDModel):
+    """Abstract base for entities owned by a single club (tenant root)."""
+
+    club = models.ForeignKey("club.Club", on_delete=models.CASCADE, related_name="%(class)ss")
+    objects = TenantQuerySet.as_manager()
+
+    # Subclasses with a ``slug`` field set this to the source field name (e.g.
+    # "name"/"title") to auto-populate the slug — unique per club — on save.
+    slug_source = None
+
+    class Meta:
+        abstract = True
+
+    def save(self, *args, **kwargs):
+        if self.club_id is None:
+            self.club = require_current_club()
+
+        if self.slug_source and not self.slug:
+            self.slug = unique_slugify(self, getattr(self, self.slug_source), scope={"club": self.club})
+
+        super().save(*args, **kwargs)
diff --git a/rosterchief/health.py b/rosterchief/health.py
new file mode 100644
index 0000000..aa12f1e
--- /dev/null
+++ b/rosterchief/health.py
@@ -0,0 +1,44 @@
+"""Liveness for the proxy today, for a load balancer later.
+
+Checks the two dependencies whose absence makes the app lie rather than fail: without the
+database it cannot serve anything, and without a shared cache the feature flags drift apart
+between workers. A health check that only proves the process is listening would call that
+healthy.
+"""
+
+from django.core.cache import cache
+from django.db import connection
+from django.http import JsonResponse
+from django.views.decorators.cache import never_cache
+
+PROBE_KEY = "healthz"
+
+
+@never_cache
+def healthz(request):
+    checks = {"database": _database(), "cache": _cache()}
+    healthy = all(checks.values())
+
+    return JsonResponse({"status": "ok" if healthy else "degraded", "checks": checks}, status=200 if healthy else 503)
+
+
+def _database() -> bool:
+    try:
+        with connection.cursor() as cursor:
+            cursor.execute("SELECT 1")
+            cursor.fetchone()
+    except Exception:
+        return False
+
+    return True
+
+
+def _cache() -> bool:
+    """A round trip, not a ping: a cache that accepts writes and returns nothing is worse
+    than one that is plainly down, because waffle would read every flag as unset."""
+    try:
+        cache.set(PROBE_KEY, "ok", 10)
+
+        return cache.get(PROBE_KEY) == "ok"
+    except Exception:
+        return False
diff --git a/rosterchief/settings.py b/rosterchief/settings.py
new file mode 100644
index 0000000..cb0a339
--- /dev/null
+++ b/rosterchief/settings.py
@@ -0,0 +1,333 @@
+"""
+Django settings for rosterchief project.
+
+Generated by 'django-admin startproject' using Django 6.0.6.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.0/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/6.0/ref/settings/
+"""
+
+from importlib.util import find_spec
+from pathlib import Path
+
+from decouple import Csv, config
+from dj_database_url import parse as db_url
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = config("DJANGO_SECRET_KEY")
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = config("DJANGO_DEBUG", default=False, cast=bool)
+
+ALLOWED_HOSTS = config("DJANGO_ALLOWED_HOSTS", cast=Csv(), default="")
+# The loopback is always allowed, and it must be: the container's own healthcheck and the
+# deploy probe hit /healthz over 127.0.0.1/localhost, before any proxy has supplied a real
+# Host header. Without this they get a 400 and the container is marked unhealthy forever.
+# It widens nothing — gunicorn binds to the loopback only; the proxy owns the public domains.
+ALLOWED_HOSTS += [host for host in ("localhost", "127.0.0.1") if host not in ALLOWED_HOSTS]
+
+INTERNAL_IPS = config("DJANGO_INTERNAL_IPS", cast=Csv(), default="127.0.0.1")
+
+CSRF_TRUSTED_ORIGINS = config("DJANGO_CSRF_TRUSTED_ORIGINS", cast=Csv(), default="")
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    # Required by allauth's security-key list template ({% load humanize %}); without it
+    # that page raises TemplateSyntaxError.
+    "django.contrib.humanize",
+    "phonenumber_field",
+    "django_countries",
+    "lucide",
+    # Auth: allauth deliberately WITHOUT django.contrib.sites — it is optional in
+    # allauth 65+, and ARCHITECTURE.md §2.4 rejects the Sites framework (Club is
+    # the tenant root, not Site).
+    "allauth",
+    "allauth.account",
+    "allauth.mfa",
+    "club.apps.ClubConfig",
+    "authentication.apps.AuthenticationConfig",
+    "members.apps.MembersConfig",
+    "teams.apps.TeamsConfig",
+    "events.apps.EventsConfig",
+    "news.apps.NewsConfig",
+    "formbuilder.apps.FormbuilderConfig",
+    "shop.apps.ShopConfig",
+    # Platform billing: RosterChief charging the clubs. Not tenant data — see billing/models.py.
+    "billing.apps.BillingConfig",
+    "waffle",
+    "features.apps.FeaturesConfig",
+    "controlpanel.apps.ControlpanelConfig",
+    # Club-facing UI for team managers, coaches and admins -- not controlpanel (platform
+    # staff managing every club) and not the future parent/player app.
+    "management.apps.ManagementConfig",
+    # Public, read-only JSON API for a club's own external website -- see api/urls.py.
+    "api.apps.ApiConfig",
+]
+
+# Feature flags (django-waffle). The Flag model is swappable, like AUTH_USER_MODEL:
+# ours adds a `clubs` M2M so a feature can be turned on per tenant. Because the
+# tenant middleware sets request.club, `flag_is_active(request, "x")` just works.
+WAFFLE_FLAG_MODEL = "features.Flag"
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    # Directly after SecurityMiddleware, per WhiteNoise's contract. It serves the collected
+    # static files from the app itself, so no shared volume or CDN is needed to add a second
+    # app server.
+    "whitenoise.middleware.WhiteNoiseMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "allauth.account.middleware.AccountMiddleware",
+    "authentication.middleware.RequireMFAMiddleware",
+    "club.tenancy.ClubTenantMiddleware",
+    # After tenancy: it decides club-vs-platform from request.club, which was just resolved.
+    "features.middleware.MaintenanceMiddleware",
+    # After maintenance: a club under maintenance closes its public API too, same as
+    # everything else on its subdomain.
+    "api.middleware.PublicApiCorsMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+# Reload the browser when templates, static files or Python change. Dev only: it injects a
+# script tag into every HTML response and serves an open event stream, neither of which
+# belongs in production.
+#
+# Guarded on the module being *importable*, not just on DEBUG: it is a dev dependency, and the
+# production image installs with --no-dev. Without the guard, DEBUG=True in a deployed
+# container does not merely turn on debugging — it stops the app from starting at all, with a
+# ModuleNotFoundError that says nothing about the actual mistake.
+BROWSER_RELOAD_AVAILABLE = find_spec("django_browser_reload") is not None
+
+if DEBUG and BROWSER_RELOAD_AVAILABLE:
+    INSTALLED_APPS += ["django_browser_reload"]
+    MIDDLEWARE += ["django_browser_reload.middleware.BrowserReloadMiddleware"]
+
+AUTHENTICATION_BACKENDS = [
+    "django.contrib.auth.backends.ModelBackend",
+    "allauth.account.auth_backends.AuthenticationBackend",
+]
+
+# Multi-tenancy: base domain whose subdomains resolve to a club, e.g.
+# "ajax-united.rosterchief.app" -> the club with slug "ajax-united". Leave
+# unset to fall back to generic "slug.example.com" (3+ label) resolution.
+ROSTERCHIEF_BASE_DOMAIN = config("ROSTERCHIEF_BASE_DOMAIN", default="")
+
+ROOT_URLCONF = "rosterchief.urls"
+
+AUTH_USER_MODEL = "authentication.User"
+
+
+# Authentication (django-allauth)
+
+LOGIN_URL = "account_login"
+LOGIN_REDIRECT_URL = "/"
+
+# The User model logs in by email and has no username field.
+ACCOUNT_USER_MODEL_USERNAME_FIELD = None
+ACCOUNT_LOGIN_METHODS = {"email"}
+ACCOUNT_SIGNUP_FIELDS = ["email*", "password1*", "password2*"]
+ACCOUNT_EMAIL_VERIFICATION = "none"
+
+
+# Two-factor authentication (allauth.mfa)
+
+MFA_SUPPORTED_TYPES = ["totp", "webauthn", "recovery_codes"]
+
+# Passkeys are a first factor: sign in with Touch ID / a security key alone.
+MFA_PASSKEY_LOGIN_ENABLED = True
+MFA_PASSKEY_SIGNUP_ENABLED = False
+
+# WebAuthn needs a secure context. Browsers treat *.localhost as secure, but the
+# dev server is plain HTTP, so allow the insecure origin while DEBUG.
+MFA_WEBAUTHN_ALLOW_INSECURE_ORIGIN = DEBUG
+
+# A passkey is bound to a Relying Party ID (a domain). Our adapter pins it to
+# ROSTERCHIEF_BASE_DOMAIN so that ONE passkey works across every club subdomain
+# — allauth's default (the request host) would bind it to a single club.
+MFA_ADAPTER = "authentication.adapters.RosterChiefMFAAdapter"
+MFA_WEBAUTHN_RP_NAME = config("ROSTERCHIEF_RP_NAME", default="RosterChief")
+
+# Where RequireMFAMiddleware sends privileged users who haven't enrolled yet.
+MFA_ENROLMENT_URL_NAME = "mfa_index"
+
+
+# Sessions are shared across club subdomains: log in once and you're authenticated
+# on every club (matching the one-passkey-everywhere model). Tenancy still scopes
+# what you can *see* — that is the access service's job, not the cookie's.
+# Browsers reject a Domain attribute on localhost, so it stays host-only in dev.
+SHARED_COOKIE_DOMAIN = f".{ROSTERCHIEF_BASE_DOMAIN}" if ROSTERCHIEF_BASE_DOMAIN and ROSTERCHIEF_BASE_DOMAIN != "localhost" else None
+
+SESSION_COOKIE_DOMAIN = config("DJANGO_SESSION_COOKIE_DOMAIN", default=SHARED_COOKIE_DOMAIN)
+CSRF_COOKIE_DOMAIN = config("DJANGO_CSRF_COOKIE_DOMAIN", default=SHARED_COOKIE_DOMAIN)
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [BASE_DIR / "templates"],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+                "club.context_processors.branding",
+                "features.context_processors.maintenance",
+                "management.context_processors.is_admin",
+                "management.context_processors.management_position",
+                "management.context_processors.management_link",
+                "management.context_processors.active_nav_section",
+                "management.context_processors.news_permissions",
+                "management.context_processors.feature_sections",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "rosterchief.wsgi.application"
+
+
+# Database
+# https://docs.djangoproject.com/en/6.0/ref/settings/#databases
+
+DATABASES = {
+    "default": config("DJANGO_DATABASE_URL", default="sqlite:///db.sqlite3", cast=db_url),
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/6.0/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = config("DJANGO_TIME_ZONE", default="Europe/Brussels", cast=str)
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Cache
+#
+# Redis in production, and not merely for speed: waffle caches each flag's targeting in the
+# Django cache, and LocMemCache is private to one process. Under several gunicorn workers a
+# toggle flipped in the control panel flushes ONE worker's cache while the others keep
+# serving the stale flag — a feature that "sometimes doesn't turn on". A shared cache is the
+# fix, so Redis is required from the first multi-worker deploy, not from the second server.
+
+REDIS_URL = config("DJANGO_REDIS_URL", default="")
+
+CACHES = {"default": {"BACKEND": "django_redis.cache.RedisCache", "LOCATION": REDIS_URL, "OPTIONS": {"CLIENT_CLASS": "django_redis.client.DefaultClient"}} if REDIS_URL else {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}}
+
+
+# Static files and uploads
+# https://docs.djangoproject.com/en/6.0/howto/static-files/
+
+STATIC_URL = "static/"
+STATIC_ROOT = BASE_DIR / "staticfiles"
+STATICFILES_DIRS = [BASE_DIR / "static"]
+
+MEDIA_URL = "media/"
+MEDIA_ROOT = BASE_DIR / "media"
+
+# Uploads (club logos) go to S3-compatible storage as soon as a bucket is configured. On one
+# server the local disk works; on two, a logo uploaded to node A 404s on node B — so this is
+# the switch that decides whether "add a server" is an afternoon or a migration.
+AWS_STORAGE_BUCKET_NAME = config("AWS_STORAGE_BUCKET_NAME", default="")
+AWS_S3_ENDPOINT_URL = config("AWS_S3_ENDPOINT_URL", default="")  # set for Hetzner/Scaleway/Backblaze
+AWS_S3_REGION_NAME = config("AWS_S3_REGION_NAME", default="")
+AWS_ACCESS_KEY_ID = config("AWS_ACCESS_KEY_ID", default="")
+AWS_SECRET_ACCESS_KEY = config("AWS_SECRET_ACCESS_KEY", default="")
+AWS_S3_FILE_OVERWRITE = False
+AWS_QUERYSTRING_AUTH = False  # logos are public; signed URLs would break browser caching
+
+STORAGES = {
+    "default": {"BACKEND": "storages.backends.s3.S3Storage"} if AWS_STORAGE_BUCKET_NAME else {"BACKEND": "django.core.files.storage.FileSystemStorage"},
+    # Manifest storage only in production: it demands a collectstatic manifest, and every
+    # {% static %} in a test would blow up without one.
+    "staticfiles": {"BACKEND": config("DJANGO_STATICFILES_BACKEND", default="django.contrib.staticfiles.storage.StaticFilesStorage")},
+}
+
+
+# HTTPS, behind a reverse proxy
+#
+# SECURE_PROXY_SSL_HEADER is not optional here: Caddy terminates TLS, so without it Django
+# believes every request is plain HTTP. request.is_secure() goes false, allauth and WebAuthn
+# disagree with the browser about the origin, and SECURE_SSL_REDIRECT becomes a loop.
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
+# Off by default and switched on by the production env, deliberately: defaulting these to
+# `not DEBUG` would redirect every test request to https and break the suite anywhere DEBUG
+# is unset. `manage.py check --deploy` is what catches a deploy that forgot them.
+SECURE_SSL_REDIRECT = config("DJANGO_SECURE_SSL_REDIRECT", default=False, cast=bool)
+SESSION_COOKIE_SECURE = config("DJANGO_SESSION_COOKIE_SECURE", default=False, cast=bool)
+CSRF_COOKIE_SECURE = config("DJANGO_CSRF_COOKIE_SECURE", default=False, cast=bool)
+
+SECURE_HSTS_SECONDS = config("DJANGO_SECURE_HSTS_SECONDS", default=0, cast=int)
+# Every club is a subdomain, so HSTS must cover them all or it protects only the bare domain.
+SECURE_HSTS_INCLUDE_SUBDOMAINS = config("DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS", default=True, cast=bool)
+SECURE_HSTS_PRELOAD = config("DJANGO_SECURE_HSTS_PRELOAD", default=False, cast=bool)
+
+
+# Logging
+#
+# Django's default LOGGING gates its console handler behind `require_debug_true`, so with
+# DEBUG=False (every real deployment) an unhandled exception becomes a 500 response and leaves
+# no trace anywhere — gunicorn's error log only sees WSGI-level crashes, not exceptions Django
+# already caught and turned into a response. Without this, `docker compose logs web` is silent
+# during exactly the incidents it most needs to explain.
+LOGGING = {
+    "version": 1,
+    "disable_existing_loggers": False,
+    "handlers": {
+        "console": {"class": "logging.StreamHandler"},
+    },
+    "loggers": {
+        "django.request": {"handlers": ["console"], "level": "ERROR", "propagate": False},
+    },
+}
+
+
+# Phone numbers (django-phonenumber-field)
+
+PHONENUMBER_DEFAULT_REGION = "BE"
+PHONENUMBER_DB_FORMAT = "E164"
diff --git a/rosterchief/tests.py b/rosterchief/tests.py
new file mode 100644
index 0000000..d7912b9
--- /dev/null
+++ b/rosterchief/tests.py
@@ -0,0 +1,88 @@
+import importlib
+from unittest import mock
+
+from django.db.utils import OperationalError
+from django.test import SimpleTestCase, override_settings
+from django.urls import Resolver404, clear_url_caches, resolve, reverse
+
+from . import urls
+
+
+class BrowserReloadUrlTests(SimpleTestCase):
+    """django-browser-reload serves an open event stream and injects a script into
+    every HTML response, so it must never be mounted outside DEBUG."""
+
+    def reload_urlconf(self):
+        importlib.reload(urls)
+        clear_url_caches()
+
+    def tearDown(self):
+        self.reload_urlconf()  # restore the real (DEBUG=False) urlconf
+
+    def test_the_reload_endpoint_is_mounted_in_debug(self):
+        with override_settings(DEBUG=True):
+            self.reload_urlconf()
+
+            self.assertEqual(resolve("/__reload__/events/").view_name, "django_browser_reload:events")
+
+    def test_the_reload_endpoint_is_absent_without_debug(self):
+        self.reload_urlconf()
+
+        with self.assertRaises(Resolver404):
+            resolve("/__reload__/events/")
+
+
+class HealthCheckTests(SimpleTestCase):
+    databases = {"default"}
+
+    def test_it_reports_ok_when_the_database_and_cache_answer(self):
+        response = self.client.get(reverse("healthz"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {"status": "ok", "checks": {"database": True, "cache": True}})
+
+    def test_a_dead_database_is_a_503(self):
+        # 200 while the database is unreachable is worse than no health check at all: the load
+        # balancer would keep sending traffic to a node that cannot serve a single page.
+        with mock.patch("rosterchief.health.connection") as db:
+            db.cursor.side_effect = OperationalError("connection refused")
+
+            response = self.client.get(reverse("healthz"))
+
+        self.assertEqual(response.status_code, 503)
+        self.assertFalse(response.json()["checks"]["database"])
+
+    def test_a_cache_that_swallows_writes_is_unhealthy(self):
+        # Not a ping: a cache that accepts writes and returns nothing would have waffle read
+        # every feature flag as unset.
+        with mock.patch("rosterchief.health.cache") as broken:
+            broken.get.return_value = None
+
+            response = self.client.get(reverse("healthz"))
+
+        self.assertEqual(response.status_code, 503)
+        self.assertFalse(response.json()["checks"]["cache"])
+
+    def test_an_unreachable_cache_is_a_503(self):
+        # Distinct from the cache that answers wrongly above: here Redis is simply down, and
+        # the check must fail rather than raise its way to a 500.
+        with mock.patch("rosterchief.health.cache") as down:
+            down.set.side_effect = ConnectionError("redis is down")
+
+            response = self.client.get(reverse("healthz"))
+
+        self.assertEqual(response.status_code, 503)
+        self.assertFalse(response.json()["checks"]["cache"])
+
+    def test_it_is_never_cached(self):
+        response = self.client.get(reverse("healthz"))
+
+        self.assertIn("no-cache", response["Cache-Control"])
+
+    @override_settings(ALLOWED_HOSTS=["example.com", "localhost", "127.0.0.1"])
+    def test_it_answers_over_the_loopback(self):
+        # The container healthcheck and the deploy probe hit it as 127.0.0.1/localhost, before
+        # a proxy supplies a real Host. If ALLOWED_HOSTS rejects those, /healthz 400s and the
+        # container is unhealthy forever — which is exactly how the first deploy failed.
+        for host in ("127.0.0.1", "localhost"):
+            self.assertEqual(self.client.get(reverse("healthz"), HTTP_HOST=host).status_code, 200, host)
diff --git a/rosterchief/urls.py b/rosterchief/urls.py
new file mode 100644
index 0000000..d4c2ec2
--- /dev/null
+++ b/rosterchief/urls.py
@@ -0,0 +1,57 @@
+"""URL configuration for rosterchief.
+
+``/admin/login/`` is deliberately intercepted *before* ``admin.site.urls`` and
+redirected to the allauth login, so Django staff go through the same MFA
+challenge as everyone else — Django's own admin login form knows nothing about
+second factors. ``RequireMFAMiddleware`` then blocks any staff user who has not
+enrolled.
+"""
+
+import re
+
+from django.conf import settings
+from django.contrib import admin
+from django.urls import include, path, re_path
+from django.views.generic import RedirectView
+from django.views.static import serve
+
+from api.urls import api
+from club.views import root
+
+from .health import healthz
+
+urlpatterns = [
+    # No auth and no tenant: the proxy and the load balancer must reach it on any host.
+    path("healthz", healthz, name="healthz"),
+    path("admin/login/", RedirectView.as_view(pattern_name="account_login", query_string=True), name="admin_login_redirect"),
+    path("admin/", admin.site.urls),
+    path("accounts/", include("allauth.urls")),
+    path("controlpanel/", include("controlpanel.urls")),
+    path("manage/", include("management.urls")),
+    path("api/v1/", api.urls),
+    # "/" resolves per tenant: a club subdomain lands on the club, the base domain
+    # hands off to the control panel. This is why LOGIN_REDIRECT_URL can stay "/".
+    path("", root, name="root"),
+]
+
+if settings.DEBUG:
+    # Only when the app is actually installed. It is a dev dependency, and the production
+    # image installs with --no-dev, so DEBUG=True in a container must not take the whole
+    # site down over a package that is only there to refresh a browser tab.
+    if settings.BROWSER_RELOAD_AVAILABLE:
+        urlpatterns += [path("__reload__/", include("django_browser_reload.urls"))]
+
+if not settings.AWS_STORAGE_BUCKET_NAME:
+    # Gated on the storage backend, not on DEBUG: local disk is the default until a bucket is
+    # configured (see settings.STORAGES), and Caddy only reverse-proxies — it never serves
+    # /media/* itself — so without this route every uploaded club logo 404s in production too.
+    # Once AWS_STORAGE_BUCKET_NAME is set, club.logo.url points straight at the bucket and this
+    # route is simply never hit.
+    #
+    # django.conf.urls.static.static() looks like the right helper, but it hard-codes its own
+    # `if not settings.DEBUG: return []` — it is documented as dev-only and silently no-ops in
+    # production no matter what guards the call site. Build the pattern directly against the
+    # view it wraps instead, which has no such gate.
+    urlpatterns += [
+        re_path(rf"^{re.escape(settings.MEDIA_URL.lstrip('/'))}(?P<path>.*)$", serve, {"document_root": settings.MEDIA_ROOT}),
+    ]
diff --git a/clubmanager/wsgi.py b/rosterchief/wsgi.py
similarity index 72%
rename from clubmanager/wsgi.py
rename to rosterchief/wsgi.py
index 45ad08d..958f022 100644
--- a/clubmanager/wsgi.py
+++ b/rosterchief/wsgi.py
@@ -1,5 +1,5 @@
 """
-WSGI config for clubmanager project.
+WSGI config for rosterchief project.
 
 It exposes the WSGI callable as a module-level variable named ``application``.
 
@@ -11,6 +11,6 @@ import os
 
 from django.core.wsgi import get_wsgi_application
 
-os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'clubmanager.settings')
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rosterchief.settings")
 
 application = get_wsgi_application()
diff --git a/shop/__init__.py b/shop/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/shop/admin.py b/shop/admin.py
new file mode 100644
index 0000000..2518db7
--- /dev/null
+++ b/shop/admin.py
@@ -0,0 +1,140 @@
+from django.contrib import admin
+
+from .models import (
+    AppliedDiscount,
+    Cart,
+    CartItem,
+    Discount,
+    Invoice,
+    Order,
+    OrderLine,
+    Payment,
+    Product,
+)
+
+
+class ClubScopedFKMixin:
+    """Restrict club-scoped FK dropdowns to the edited object's (or parent's) club.
+
+    ``scoped_fk_fields`` names FKs whose target is a club-scoped model. The club
+    is taken from the object being edited (or, for inlines, the parent object).
+    Enforcement still lives in each model's ``clean()``; this just keeps invalid
+    options out of the dropdowns.
+    """
+
+    scoped_fk_fields = ()
+
+    def get_form(self, request, obj=None, **kwargs):
+        request._club_obj = obj
+        return super().get_form(request, obj, **kwargs)
+
+    def get_formset(self, request, obj=None, **kwargs):
+        request._club_obj = obj
+        return super().get_formset(request, obj, **kwargs)
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name in self.scoped_fk_fields:
+            club_id = getattr(getattr(request, "_club_obj", None), "club_id", None)
+            if club_id is not None:
+                kwargs["queryset"] = db_field.related_model._default_manager.filter(club_id=club_id)
+        return super().formfield_for_foreignkey(db_field, request, **kwargs)
+
+
+@admin.register(Product)
+class ProductAdmin(ClubScopedFKMixin, admin.ModelAdmin):
+    scoped_fk_fields = ("season", "staff_role")
+    list_display = ["name", "product_type", "club", "is_active", "is_public"]
+    list_filter = ["club", "product_type", "is_active", "is_public"]
+    search_fields = ["name", "slug"]
+    prepopulated_fields = {"slug": ["name"]}
+
+
+class CartItemInline(ClubScopedFKMixin, admin.TabularInline):
+    model = CartItem
+    scoped_fk_fields = ("product", "team")
+    extra = 0
+    raw_id_fields = ["beneficiary"]
+
+
+@admin.register(Cart)
+class CartAdmin(admin.ModelAdmin):
+    list_display = ["user", "status", "club"]
+    list_filter = ["club", "status"]
+    search_fields = ["user__email"]
+    raw_id_fields = ["user"]
+    inlines = [CartItemInline]
+
+
+@admin.register(CartItem)
+class CartItemAdmin(admin.ModelAdmin):
+    list_display = ["cart", "product", "quantity", "beneficiary"]
+    search_fields = ["product__name"]
+    raw_id_fields = ["cart", "product", "beneficiary", "team"]
+
+
+class OrderLineInline(ClubScopedFKMixin, admin.TabularInline):
+    model = OrderLine
+    scoped_fk_fields = ("product", "team")
+    extra = 0
+    raw_id_fields = ["beneficiary"]
+
+
+class AppliedDiscountInline(ClubScopedFKMixin, admin.TabularInline):
+    model = AppliedDiscount
+    scoped_fk_fields = ("discount",)
+    extra = 0
+    raw_id_fields = ["applied_by"]
+
+
+class PaymentInline(admin.TabularInline):
+    model = Payment
+    extra = 0
+
+
+@admin.register(Order)
+class OrderAdmin(admin.ModelAdmin):
+    list_display = ["number", "purchaser", "status", "total", "club", "created"]
+    list_filter = ["club", "status"]
+    search_fields = ["number", "purchaser__first_name", "purchaser__last_name"]
+    raw_id_fields = ["purchaser"]
+    readonly_fields = ["number", "created", "modified"]
+    inlines = [OrderLineInline, AppliedDiscountInline, PaymentInline]
+
+
+@admin.register(OrderLine)
+class OrderLineAdmin(admin.ModelAdmin):
+    list_display = ["order", "product", "quantity", "line_total"]
+    search_fields = ["product__name", "order__number"]
+    raw_id_fields = ["order", "product", "beneficiary", "team"]
+
+
+@admin.register(Discount)
+class DiscountAdmin(admin.ModelAdmin):
+    list_display = ["name", "discount_type", "discount_amount", "club", "is_active"]
+    list_filter = ["club", "discount_type", "is_active"]
+    search_fields = ["name", "slug"]
+    prepopulated_fields = {"slug": ["name"]}
+
+
+@admin.register(AppliedDiscount)
+class AppliedDiscountAdmin(admin.ModelAdmin):
+    list_display = ["order", "discount", "discount_type", "discount_amount"]
+    search_fields = ["order__number", "discount__name"]
+    raw_id_fields = ["order", "discount", "applied_by"]
+
+
+@admin.register(Payment)
+class PaymentAdmin(admin.ModelAdmin):
+    list_display = ["order", "amount", "method", "status", "paid_at"]
+    list_filter = ["method", "status"]
+    search_fields = ["order__number", "reference"]
+    raw_id_fields = ["order"]
+
+
+@admin.register(Invoice)
+class InvoiceAdmin(ClubScopedFKMixin, admin.ModelAdmin):
+    scoped_fk_fields = ("order",)
+    list_display = ["number", "order", "club", "issued_at", "due_date"]
+    list_filter = ["club"]
+    search_fields = ["number", "order__number"]
+    readonly_fields = ["number", "issued_at"]
diff --git a/shop/apps.py b/shop/apps.py
new file mode 100644
index 0000000..7e18afb
--- /dev/null
+++ b/shop/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class ShopConfig(AppConfig):
+    name = "shop"
diff --git a/shop/migrations/0001_initial.py b/shop/migrations/0001_initial.py
new file mode 100644
index 0000000..8a5fd72
--- /dev/null
+++ b/shop/migrations/0001_initial.py
@@ -0,0 +1,29 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:29
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Product',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('slug', models.SlugField(max_length=255, unique=True, verbose_name='slug')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+    ]
diff --git a/shop/migrations/0002_alter_product_slug_and_more.py b/shop/migrations/0002_alter_product_slug_and_more.py
new file mode 100644
index 0000000..9b865f4
--- /dev/null
+++ b/shop/migrations/0002_alter_product_slug_and_more.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:39
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('shop', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='product',
+            name='slug',
+            field=models.SlugField(blank=True, max_length=255, verbose_name='slug'),
+        ),
+        migrations.AddConstraint(
+            model_name='product',
+            constraint=models.UniqueConstraint(fields=('club', 'slug'), name='unique_product_slug_per_club'),
+        ),
+    ]
diff --git a/shop/migrations/0003_alter_product_options_and_more.py b/shop/migrations/0003_alter_product_options_and_more.py
new file mode 100644
index 0000000..524c023
--- /dev/null
+++ b/shop/migrations/0003_alter_product_options_and_more.py
@@ -0,0 +1,59 @@
+# Generated by Django 6.0.6 on 2026-07-12 19:59
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('shop', '0002_alter_product_slug_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='product',
+            options={'ordering': ['name'], 'verbose_name': 'product', 'verbose_name_plural': 'products'},
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='early_bird_discount_amount',
+            field=models.DecimalField(decimal_places=2, default=0, max_digits=10, verbose_name='early bird discount amount'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='early_bird_discount_deadline',
+            field=models.DateField(blank=True, null=True, verbose_name='early bird discount deadline'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='early_bird_discount_enabled',
+            field=models.BooleanField(default=False, verbose_name='early bird discount enabled?'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='early_bird_discount_type',
+            field=models.CharField(choices=[('percentage', 'Percentage'), ('fixed_amount', 'Fixed amount')], default='percentage', max_length=255, verbose_name='early bird discount type'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='is_active',
+            field=models.BooleanField(default=True, verbose_name='is active?'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='is_public',
+            field=models.BooleanField(default=True, help_text='Non-public products are only visible to staff members for adding on to an order later on.', verbose_name='is public?'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='product_type',
+            field=models.CharField(choices=[('membership', 'Membership'), ('event_fee', 'Event fee'), ('merchandise', 'Merchandise'), ('donation', 'Donation')], default='membership', max_length=255, verbose_name='product type'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='season',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='products', to='club.season', verbose_name='season'),
+        ),
+    ]
diff --git a/shop/migrations/0004_cart.py b/shop/migrations/0004_cart.py
new file mode 100644
index 0000000..26305f9
--- /dev/null
+++ b/shop/migrations/0004_cart.py
@@ -0,0 +1,32 @@
+# Generated by Django 6.0.6 on 2026-07-12 20:02
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('shop', '0003_alter_product_options_and_more'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Cart',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('status', models.CharField(choices=[('open', 'Open'), ('checked_out', 'Checked out'), ('abandoned', 'Abandoned')], default='open', max_length=255, verbose_name='status')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='carts', to=settings.AUTH_USER_MODEL, verbose_name='user')),
+            ],
+            options={
+                'verbose_name': 'cart',
+                'verbose_name_plural': 'carts',
+                'constraints': [models.UniqueConstraint(condition=models.Q(('status', 'open')), fields=('club', 'user'), name='unique_open_cart_per_user_per_club')],
+            },
+        ),
+    ]
diff --git a/shop/migrations/0005_product_staff_role_cartitem_order.py b/shop/migrations/0005_product_staff_role_cartitem_order.py
new file mode 100644
index 0000000..6e067ed
--- /dev/null
+++ b/shop/migrations/0005_product_staff_role_cartitem_order.py
@@ -0,0 +1,59 @@
+# Generated by Django 6.0.6 on 2026-07-12 20:12
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('shop', '0004_cart'),
+        ('teams', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='product',
+            name='staff_role',
+            field=models.ForeignKey(blank=True, limit_choices_to={'staff_position': True}, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='staff_products', to='teams.position', verbose_name='staff role'),
+        ),
+        migrations.CreateModel(
+            name='CartItem',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('quantity', models.PositiveSmallIntegerField(default=1, verbose_name='quantity')),
+                ('unit_price', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='unit price')),
+                ('beneficiary', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='cart_items', to='members.member', verbose_name='beneficiary')),
+                ('cart', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='items', to='shop.cart', verbose_name='cart')),
+                ('product', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='cart_items', to='shop.product', verbose_name='product')),
+                ('team', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='cart_items', to='teams.team', verbose_name='team')),
+            ],
+            options={
+                'verbose_name': 'cart item',
+                'verbose_name_plural': 'cart items',
+                'constraints': [models.UniqueConstraint(fields=('cart', 'product', 'beneficiary'), name='unique_product_per_cart_per_beneficiary')],
+            },
+        ),
+        migrations.CreateModel(
+            name='Order',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('number', models.CharField(max_length=255, verbose_name='number')),
+                ('status', models.CharField(choices=[('pending', 'Pending'), ('paid', 'Paid'), ('partially_paid', 'Partially paid'), ('cancelled', 'Cancelled'), ('refunded', 'Refunded'), ('delivered', 'Delivered')], default='pending', max_length=255, verbose_name='status')),
+                ('total', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='total')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created at')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('purchaser', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='orders', to='members.member', verbose_name='purchaser')),
+            ],
+            options={
+                'verbose_name': 'order',
+                'verbose_name_plural': 'orders',
+                'ordering': ['-created'],
+                'constraints': [models.UniqueConstraint(fields=('club', 'number'), name='unique_order_number_per_club')],
+            },
+        ),
+    ]
diff --git a/shop/migrations/0006_alter_order_number.py b/shop/migrations/0006_alter_order_number.py
new file mode 100644
index 0000000..5b80f06
--- /dev/null
+++ b/shop/migrations/0006_alter_order_number.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-12 20:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('shop', '0005_product_staff_role_cartitem_order'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='order',
+            name='number',
+            field=models.CharField(blank=True, max_length=255, verbose_name='number'),
+        ),
+    ]
diff --git a/shop/migrations/0007_discount_applieddiscount_invoice_orderline_payment_and_more.py b/shop/migrations/0007_discount_applieddiscount_invoice_orderline_payment_and_more.py
new file mode 100644
index 0000000..cbffa6a
--- /dev/null
+++ b/shop/migrations/0007_discount_applieddiscount_invoice_orderline_payment_and_more.py
@@ -0,0 +1,113 @@
+# Generated by Django 6.0.6 on 2026-07-12 21:25
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('shop', '0006_alter_order_number'),
+        ('teams', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Discount',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('slug', models.SlugField(blank=True, max_length=255, verbose_name='slug')),
+                ('description', models.TextField(blank=True, verbose_name='description')),
+                ('discount_type', models.CharField(choices=[('percentage', 'Percentage'), ('fixed_amount', 'Fixed amount')], default='percentage', max_length=255, verbose_name='discount type')),
+                ('discount_amount', models.DecimalField(decimal_places=2, default=0, max_digits=10, verbose_name='discount amount')),
+                ('is_active', models.BooleanField(default=True, verbose_name='is active?')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'order discount type',
+                'verbose_name_plural': 'order discount types',
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='AppliedDiscount',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('discount_type', models.CharField(choices=[('percentage', 'Percentage'), ('fixed_amount', 'Fixed amount')], default='percentage', max_length=255, verbose_name='discount type')),
+                ('discount_amount', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='discount amount')),
+                ('description', models.TextField(blank=True, verbose_name='description')),
+                ('applied_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='applied_discounts', to=settings.AUTH_USER_MODEL, verbose_name='applied by')),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='applied_discounts', to='shop.order', verbose_name='order')),
+                ('discount', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='applied_discounts', to='shop.discount', verbose_name='discount')),
+            ],
+            options={
+                'verbose_name': 'applied discount',
+                'verbose_name_plural': 'applied discounts',
+            },
+        ),
+        migrations.CreateModel(
+            name='Invoice',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('number', models.CharField(blank=True, max_length=255, verbose_name='number')),
+                ('issued_at', models.DateTimeField(auto_now_add=True, verbose_name='issued at')),
+                ('due_date', models.DateField(blank=True, null=True, verbose_name='due date')),
+                ('billing_snapshot', models.JSONField(blank=True, null=True, verbose_name='billing snapshot')),
+                ('pdf', models.FileField(blank=True, null=True, upload_to='invoices', verbose_name='PDF')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+                ('order', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, related_name='invoice', to='shop.order', verbose_name='order')),
+            ],
+            options={
+                'verbose_name': 'invoice',
+                'verbose_name_plural': 'invoices',
+                'ordering': ['-issued_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='OrderLine',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('quantity', models.PositiveSmallIntegerField(default=1, verbose_name='quantity')),
+                ('unit_price', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='unit price')),
+                ('line_total', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='line total')),
+                ('beneficiary', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='order_items', to='members.member', verbose_name='beneficiary')),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='order_items', to='shop.order', verbose_name='order')),
+                ('product', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='order_items', to='shop.product', verbose_name='product')),
+                ('team', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='order_items', to='teams.team', verbose_name='team')),
+            ],
+            options={
+                'verbose_name': 'order line',
+                'verbose_name_plural': 'order lines',
+            },
+        ),
+        migrations.CreateModel(
+            name='Payment',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='amount')),
+                ('method', models.CharField(choices=[('credit_card', 'Credit card'), ('bank_transfer', 'Bank transfer'), ('cash', 'Cash')], default='credit_card', max_length=255, verbose_name='method')),
+                ('status', models.CharField(choices=[('pending', 'Pending'), ('confirmed', 'Confirmed'), ('failed', 'Failed'), ('refunded', 'Refunded')], default='pending', max_length=255, verbose_name='status')),
+                ('reference', models.CharField(blank=True, max_length=255, verbose_name='reference')),
+                ('paid_at', models.DateTimeField(blank=True, null=True, verbose_name='paid at')),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='payments', to='shop.order', verbose_name='order')),
+            ],
+            options={
+                'verbose_name': 'payment',
+                'verbose_name_plural': 'payments',
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='discount',
+            constraint=models.UniqueConstraint(fields=('club', 'slug'), name='unique_order_discount_type_slug_per_club'),
+        ),
+        migrations.AddConstraint(
+            model_name='invoice',
+            constraint=models.UniqueConstraint(fields=('club', 'number'), name='unique_invoice_number_per_club'),
+        ),
+    ]
diff --git a/shop/migrations/0008_alter_applieddiscount_applied_by.py b/shop/migrations/0008_alter_applieddiscount_applied_by.py
new file mode 100644
index 0000000..60c9ce9
--- /dev/null
+++ b/shop/migrations/0008_alter_applieddiscount_applied_by.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-12 21:31
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('shop', '0007_discount_applieddiscount_invoice_orderline_payment_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='applieddiscount',
+            name='applied_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='applied_discounts', to='members.member', verbose_name='applied by'),
+        ),
+    ]
diff --git a/shop/migrations/0009_applieddiscount_unique_discount_per_order.py b/shop/migrations/0009_applieddiscount_unique_discount_per_order.py
new file mode 100644
index 0000000..5f6fab6
--- /dev/null
+++ b/shop/migrations/0009_applieddiscount_unique_discount_per_order.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-12 21:41
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+        ('shop', '0008_alter_applieddiscount_applied_by'),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name='applieddiscount',
+            constraint=models.UniqueConstraint(fields=('order', 'discount'), name='unique_discount_per_order'),
+        ),
+    ]
diff --git a/shop/migrations/0010_applieddiscount_created_applieddiscount_modified_and_more.py b/shop/migrations/0010_applieddiscount_created_applieddiscount_modified_and_more.py
new file mode 100644
index 0000000..52e69ff
--- /dev/null
+++ b/shop/migrations/0010_applieddiscount_created_applieddiscount_modified_and_more.py
@@ -0,0 +1,107 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('shop', '0009_applieddiscount_unique_discount_per_order'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='applieddiscount',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566202, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='applieddiscount',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='cart',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566218, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='cart',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='cartitem',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566233, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='cartitem',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='discount',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566250, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='discount',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566266, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='orderline',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566282, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='orderline',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='payment',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566299, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='payment',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566314, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AlterField(
+            model_name='order',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, verbose_name='created'),
+        ),
+    ]
diff --git a/shop/migrations/__init__.py b/shop/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/shop/models.py b/shop/models.py
new file mode 100644
index 0000000..83bd5d6
--- /dev/null
+++ b/shop/models.py
@@ -0,0 +1,303 @@
+from django.db import IntegrityError, models, transaction
+from django.db.models import Q, UniqueConstraint
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from authentication.models import User
+from club.models import Season
+from club.tenancy import require_current_club
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel, validate_club_scope
+from teams.models import Position, Team
+
+
+class DiscountType(models.TextChoices):
+    """Shared by ``Product`` (early-bird), ``Discount`` and ``AppliedDiscount`` (its
+    snapshot on an order) — one discount vocabulary, not three copies of it."""
+
+    PERCENTAGE = "percentage", _("Percentage")
+    FIXED_AMOUNT = "fixed_amount", _("Fixed amount")
+
+
+def next_scoped_number(instance, code):
+    """Next per-club sequential number for the current year: ``<code>-<year>-<seq>``."""
+    prefix = f"{code}-{timezone.now().year}-"
+    model = type(instance)
+    sequences = [int(suffix) for number in model.objects.filter(club=instance.club, number__startswith=prefix).values_list("number", flat=True) if (suffix := number.removeprefix(prefix)).isdigit()]
+    return f"{prefix}{max(sequences, default=0) + 1:05d}"
+
+
+def save_with_number(instance, save):
+    """Assign a unique per-club number (retrying on collision) then save.
+
+    Relies on the model's ``generate_number()`` and its ``(club, number)``
+    unique constraint as the source of truth.
+    """
+    if instance.club_id is None:
+        instance.club = require_current_club()
+    if instance.number:
+        return save()
+    for attempt in range(5):
+        instance.number = instance.generate_number()
+        try:
+            with transaction.atomic():
+                return save()
+        except IntegrityError:
+            if attempt == 4:
+                raise
+
+
+class Product(ClubScopedModel):
+    class ProductType(models.TextChoices):
+        MEMBERSHIP = "membership", _("Membership")
+        EVENT_FEE = "event_fee", _("Event fee")
+        MERCHANDISE = "merchandise", _("Merchandise")
+        DONATION = "donation", _("Donation")
+
+    name = models.CharField(_("name"), max_length=255)
+    slug = models.SlugField(_("slug"), max_length=255, blank=True)
+
+    product_type = models.CharField(_("product type"), max_length=255, choices=ProductType.choices, default=ProductType.MEMBERSHIP)
+    season = models.ForeignKey(Season, on_delete=models.PROTECT, related_name="products", verbose_name=_("season"), blank=True, null=True)
+
+    is_active = models.BooleanField(_("is active?"), default=True)
+    is_public = models.BooleanField(_("is public?"), default=True, help_text=_("Non-public products are only visible to staff members for adding on to an order later on."))
+    staff_role = models.ForeignKey(Position, on_delete=models.PROTECT, related_name="staff_products", verbose_name=_("staff role"), blank=True, null=True, limit_choices_to={"staff_position": True})
+
+    early_bird_discount_enabled = models.BooleanField(_("early bird discount enabled?"), default=False)
+    early_bird_discount_deadline = models.DateField(_("early bird discount deadline"), blank=True, null=True)
+    early_bird_discount_type = models.CharField(_("early bird discount type"), max_length=255, choices=DiscountType.choices, default=DiscountType.PERCENTAGE)
+    early_bird_discount_amount = models.DecimalField(_("early bird discount amount"), max_digits=10, decimal_places=2, default=0)
+
+    slug_source = "name"
+
+    class Meta:
+        verbose_name = _("product")
+        verbose_name_plural = _("products")
+        ordering = ["name"]
+        constraints = [
+            UniqueConstraint(fields=["club", "slug"], name="unique_product_slug_per_club"),
+        ]
+
+    def __str__(self):
+        return self.name
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("season", "staff_role"))
+
+
+class Cart(ClubScopedModel):
+    class CartStatus(models.TextChoices):
+        OPEN = "open", _("Open")
+        CHECKED_OUT = "checked_out", _("Checked out")
+        ABANDONED = "abandoned", _("Abandoned")
+
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="carts", verbose_name=_("user"))
+    status = models.CharField(_("status"), max_length=255, choices=CartStatus.choices, default=CartStatus.OPEN)
+
+    class Meta:
+        verbose_name = _("cart")
+        verbose_name_plural = _("carts")
+        constraints = [
+            # At most one open cart per user per club (CartStatus.OPEN == "open").
+            UniqueConstraint(fields=["club", "user"], condition=Q(status="open"), name="unique_open_cart_per_user_per_club"),
+        ]
+
+    def __str__(self):
+        return f"{self.user} - {self.status}"
+
+
+class CartItem(UUIDModel):
+    cart = models.ForeignKey(Cart, on_delete=models.CASCADE, related_name="items", verbose_name=_("cart"))
+    product = models.ForeignKey(Product, on_delete=models.PROTECT, related_name="cart_items", verbose_name=_("product"))
+
+    quantity = models.PositiveSmallIntegerField(_("quantity"), default=1)
+    unit_price = models.DecimalField(_("unit price"), max_digits=10, decimal_places=2)
+
+    beneficiary = models.ForeignKey(Member, on_delete=models.PROTECT, related_name="cart_items", verbose_name=_("beneficiary"), blank=True, null=True)
+    team = models.ForeignKey(Team, on_delete=models.PROTECT, related_name="cart_items", verbose_name=_("team"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("cart item")
+        verbose_name_plural = _("cart items")
+        constraints = [
+            UniqueConstraint(fields=["cart", "product", "beneficiary"], name="unique_product_per_cart_per_beneficiary"),
+        ]
+
+    def __str__(self):
+        return f"{self.product} - {self.quantity}x"
+
+    def clean(self):
+        club_id = self.cart.club_id if self.cart_id else None
+        validate_club_scope(self, club_id, same_club_fields=("product", "team"), member_fields=("beneficiary",))
+
+
+class Order(ClubScopedModel):
+    class OrderStatus(models.TextChoices):
+        PENDING = "pending", _("Pending")
+        PAID = "paid", _("Paid")
+        PARTIALLY_PAID = "partially_paid", _("Partially paid")
+        CANCELLED = "cancelled", _("Cancelled")
+        REFUNDED = "refunded", _("Refunded")
+        DELIVERED = "delivered", _("Delivered")
+
+    number = models.CharField(_("number"), max_length=255, blank=True)
+    purchaser = models.ForeignKey(Member, on_delete=models.PROTECT, related_name="orders", verbose_name=_("purchaser"))
+    status = models.CharField(_("status"), max_length=255, choices=OrderStatus.choices, default=OrderStatus.PENDING)
+    total = models.DecimalField(_("total"), max_digits=10, decimal_places=2)
+
+    # `created`/`modified` come from TimeStampedModel — declaring them here as well
+    # would clash with the abstract base.
+
+    class Meta:
+        verbose_name = _("order")
+        verbose_name_plural = _("orders")
+        ordering = ["-created"]
+        constraints = [
+            UniqueConstraint(fields=["club", "number"], name="unique_order_number_per_club"),
+        ]
+
+    def __str__(self):
+        return self.number
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, member_fields=("purchaser",))
+
+    def generate_number(self):
+        """Next per-club order number for the current year: ``ORD-<year>-<seq>``."""
+        return next_scoped_number(self, "ORD")
+
+    def save(self, *args, **kwargs):
+        return save_with_number(self, lambda: super(Order, self).save(*args, **kwargs))
+
+
+class OrderLine(UUIDModel):
+    order = models.ForeignKey(Order, on_delete=models.CASCADE, related_name="order_items", verbose_name=_("order"))
+    product = models.ForeignKey(Product, on_delete=models.PROTECT, related_name="order_items", verbose_name=_("product"))
+
+    quantity = models.PositiveSmallIntegerField(_("quantity"), default=1)
+    unit_price = models.DecimalField(_("unit price"), max_digits=10, decimal_places=2)
+
+    beneficiary = models.ForeignKey(Member, on_delete=models.PROTECT, related_name="order_items", verbose_name=_("beneficiary"), blank=True, null=True)
+    team = models.ForeignKey(Team, on_delete=models.PROTECT, related_name="order_items", verbose_name=_("team"), blank=True, null=True)
+    line_total = models.DecimalField(_("line total"), max_digits=10, decimal_places=2)
+
+    class Meta:
+        verbose_name = _("order line")
+        verbose_name_plural = _("order lines")
+
+    def __str__(self):
+        return f"{self.product} - {self.quantity}x"
+
+    def clean(self):
+        club_id = self.order.club_id if self.order_id else None
+        validate_club_scope(self, club_id, same_club_fields=("product", "team"), member_fields=("beneficiary",))
+
+
+class Discount(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    slug = models.SlugField(_("slug"), max_length=255, blank=True)
+    description = models.TextField(_("description"), blank=True)
+
+    discount_type = models.CharField(_("discount type"), max_length=255, choices=DiscountType.choices, default=DiscountType.PERCENTAGE)
+    discount_amount = models.DecimalField(_("discount amount"), max_digits=10, decimal_places=2, default=0)
+
+    is_active = models.BooleanField(_("is active?"), default=True)
+
+    slug_source = "name"
+
+    class Meta:
+        verbose_name = _("order discount type")
+        verbose_name_plural = _("order discount types")
+        ordering = ["name"]
+        constraints = [
+            UniqueConstraint(fields=["club", "slug"], name="unique_order_discount_type_slug_per_club"),
+        ]
+
+    def __str__(self):
+        return self.name
+
+
+class AppliedDiscount(UUIDModel):
+    order = models.ForeignKey(Order, on_delete=models.CASCADE, related_name="applied_discounts", verbose_name=_("order"))
+    discount = models.ForeignKey(Discount, on_delete=models.PROTECT, related_name="applied_discounts", verbose_name=_("discount"))
+
+    discount_type = models.CharField(_("discount type"), max_length=255, choices=DiscountType.choices, default=DiscountType.PERCENTAGE)
+    discount_amount = models.DecimalField(_("discount amount"), max_digits=10, decimal_places=2)
+    description = models.TextField(_("description"), blank=True)
+
+    applied_by = models.ForeignKey(Member, on_delete=models.PROTECT, related_name="applied_discounts", verbose_name=_("applied by"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("applied discount")
+        verbose_name_plural = _("applied discounts")
+        constraints = [
+            UniqueConstraint(fields=["order", "discount"], name="unique_discount_per_order"),
+        ]
+
+    def __str__(self):
+        suffix = "%" if self.discount_type == DiscountType.PERCENTAGE else ""
+        return f"{self.discount} - {self.discount_amount}{suffix}"
+
+    def clean(self):
+        club_id = self.order.club_id if self.order_id else None
+        validate_club_scope(self, club_id, same_club_fields=("discount",), member_fields=("applied_by",))
+
+
+class Payment(UUIDModel):
+    class PaymentMethod(models.TextChoices):
+        CREDIT_CARD = "credit_card", _("Credit card")
+        BANK_TRANSFER = "bank_transfer", _("Bank transfer")
+        CASH = "cash", _("Cash")
+
+    class PaymentStatus(models.TextChoices):
+        PENDING = "pending", _("Pending")
+        CONFIRMED = "confirmed", _("Confirmed")
+        FAILED = "failed", _("Failed")
+        REFUNDED = "refunded", _("Refunded")
+
+    order = models.ForeignKey(Order, on_delete=models.CASCADE, related_name="payments", verbose_name=_("order"))
+    amount = models.DecimalField(_("amount"), max_digits=10, decimal_places=2)
+    method = models.CharField(_("method"), max_length=255, choices=PaymentMethod.choices, default=PaymentMethod.CREDIT_CARD)
+    status = models.CharField(_("status"), max_length=255, choices=PaymentStatus.choices, default=PaymentStatus.PENDING)
+    reference = models.CharField(_("reference"), max_length=255, blank=True)
+    paid_at = models.DateTimeField(_("paid at"), blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("payment")
+        verbose_name_plural = _("payments")
+
+    def __str__(self):
+        return f"{self.order} - {self.status}"
+
+
+class Invoice(ClubScopedModel):
+    number = models.CharField(_("number"), max_length=255, blank=True)
+    order = models.OneToOneField(Order, on_delete=models.CASCADE, related_name="invoice", verbose_name=_("order"))
+
+    issued_at = models.DateTimeField(_("issued at"), auto_now_add=True)
+    due_date = models.DateField(_("due date"), blank=True, null=True)
+
+    billing_snapshot = models.JSONField(_("billing snapshot"), blank=True, null=True)  # Name/address information
+    pdf = models.FileField(_("PDF"), upload_to="invoices", blank=True, null=True)
+
+    class Meta:
+        verbose_name = _("invoice")
+        verbose_name_plural = _("invoices")
+        ordering = ["-issued_at"]
+        constraints = [
+            UniqueConstraint(fields=["club", "number"], name="unique_invoice_number_per_club"),
+        ]
+
+    def __str__(self):
+        return self.number
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("order",))
+
+    def generate_number(self):
+        """Next per-club invoice number for the current year: ``INV-<year>-<seq>``."""
+        return next_scoped_number(self, "INV")
+
+    def save(self, *args, **kwargs):
+        return save_with_number(self, lambda: super(Invoice, self).save(*args, **kwargs))
diff --git a/shop/tests.py b/shop/tests.py
new file mode 100644
index 0000000..92d8c7c
--- /dev/null
+++ b/shop/tests.py
@@ -0,0 +1,461 @@
+from datetime import timedelta
+from decimal import Decimal
+from unittest.mock import patch
+
+from django.contrib.admin.sites import AdminSite
+from django.core.exceptions import ValidationError
+from django.db import IntegrityError
+from django.db.models import ProtectedError
+from django.test import RequestFactory, TestCase
+from django.utils import timezone
+
+from authentication.models import User
+from club.models import Club, ClubMembership, Season
+from club.tenancy import reset_current_club, set_current_club
+from members.models import Member
+from teams.models import Position, Team
+
+from .admin import ProductAdmin
+from .models import (
+    AppliedDiscount,
+    Cart,
+    CartItem,
+    Discount,
+    DiscountType,
+    Invoice,
+    Order,
+    OrderLine,
+    Payment,
+    Product,
+)
+
+
+class ProductSlugTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+
+    def test_slug_auto_populated_from_name(self):
+        product = Product.objects.create(club=self.club, name="Home Jersey")
+
+        self.assertEqual(product.slug, "home-jersey")
+
+    def test_explicit_slug_is_preserved(self):
+        product = Product.objects.create(club=self.club, name="Home Jersey", slug="custom")
+
+        self.assertEqual(product.slug, "custom")
+
+    def test_slug_is_unique_per_club_with_suffix(self):
+        first = Product.objects.create(club=self.club, name="Home Jersey")
+        second = Product.objects.create(club=self.club, name="Home Jersey")
+
+        self.assertEqual(first.slug, "home-jersey")
+        self.assertEqual(second.slug, "home-jersey-2")
+
+    def test_same_slug_allowed_in_a_different_club(self):
+        other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        here = Product.objects.create(club=self.club, name="Home Jersey")
+        there = Product.objects.create(club=other, name="Home Jersey")
+
+        self.assertEqual(here.slug, there.slug)
+
+    def test_unsluggable_name_falls_back(self):
+        product = Product.objects.create(club=self.club, name="###")
+
+        self.assertEqual(product.slug, "item")
+
+    def test_str_returns_name(self):
+        product = Product.objects.create(club=self.club, name="Home Jersey")
+
+        self.assertEqual(str(product), "Home Jersey")
+
+
+class OpenCartConstraintTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.user = User.objects.create_user(email="shopper@example.com", password="pw")
+
+    def test_only_one_open_cart_per_user_per_club(self):
+        Cart.objects.create(club=self.club, user=self.user)
+
+        with self.assertRaises(IntegrityError):
+            Cart.objects.create(club=self.club, user=self.user)
+
+    def test_open_and_closed_carts_coexist(self):
+        Cart.objects.create(club=self.club, user=self.user, status=Cart.CartStatus.CHECKED_OUT)
+        Cart.objects.create(club=self.club, user=self.user, status=Cart.CartStatus.ABANDONED)
+        Cart.objects.create(club=self.club, user=self.user)
+
+        self.assertEqual(self.user.carts.count(), 3)
+        self.assertEqual(self.user.carts.filter(status=Cart.CartStatus.OPEN).count(), 1)
+
+    def test_open_cart_allowed_in_each_club(self):
+        other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Cart.objects.create(club=self.club, user=self.user)
+        Cart.objects.create(club=other, user=self.user)
+
+        self.assertEqual(self.user.carts.filter(status=Cart.CartStatus.OPEN).count(), 2)
+
+    def test_str(self):
+        cart = Cart.objects.create(club=self.club, user=self.user)
+
+        self.assertEqual(str(cart), f"{self.user} - open")
+
+
+class CartItemTests(TestCase):
+    def test_str(self):
+        club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        user = User.objects.create_user(email="shopper@example.com", password="pw")
+        cart = Cart.objects.create(club=club, user=user)
+        product = Product.objects.create(club=club, name="Home Jersey")
+        item = CartItem.objects.create(cart=cart, product=product, quantity=2, unit_price=Decimal("25.00"))
+
+        self.assertEqual(str(item), "Home Jersey - 2x")
+
+
+class OrderNumberTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+        self.year = timezone.now().year
+
+    def make_order(self, **kwargs):
+        kwargs.setdefault("club", self.club)
+        kwargs.setdefault("purchaser", self.member)
+        kwargs.setdefault("total", Decimal("10.00"))
+        return Order.objects.create(**kwargs)
+
+    def test_number_is_generated(self):
+        order = self.make_order()
+
+        self.assertEqual(order.number, f"ORD-{self.year}-00001")
+
+    def test_number_increments_within_club_and_year(self):
+        first = self.make_order()
+        second = self.make_order()
+
+        self.assertEqual(first.number, f"ORD-{self.year}-00001")
+        self.assertEqual(second.number, f"ORD-{self.year}-00002")
+
+    def test_number_is_scoped_per_club(self):
+        other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.make_order()
+
+        order = self.make_order(club=other)
+
+        self.assertEqual(order.number, f"ORD-{self.year}-00001")
+
+    def test_explicit_number_is_preserved(self):
+        order = self.make_order(number="CUSTOM-1")
+
+        self.assertEqual(order.number, "CUSTOM-1")
+
+    def test_resaving_keeps_the_number(self):
+        order = self.make_order()
+        original = order.number
+
+        order.status = Order.OrderStatus.PAID
+        order.save()
+
+        order.refresh_from_db()
+        self.assertEqual(order.number, original)
+
+    def test_non_numeric_suffix_is_ignored(self):
+        Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("5"), number=f"ORD-{self.year}-oops")
+
+        order = self.make_order()
+
+        self.assertEqual(order.number, f"ORD-{self.year}-00001")
+
+    def test_club_filled_from_tenant_context(self):
+        token = set_current_club(self.club)
+        try:
+            order = Order.objects.create(purchaser=self.member, total=Decimal("5"))
+        finally:
+            reset_current_club(token)
+
+        self.assertEqual(order.club, self.club)
+
+    def test_retries_on_collision(self):
+        taken = self.make_order().number
+        with patch.object(Order, "generate_number", side_effect=[taken, "ORD-2999-00001"]):
+            order = Order(club=self.club, purchaser=self.member, total=Decimal("5"))
+            order.save()
+
+        self.assertEqual(order.number, "ORD-2999-00001")
+
+    def test_gives_up_after_exhausting_retries(self):
+        taken = self.make_order().number
+        with patch.object(Order, "generate_number", return_value=taken), self.assertRaises(IntegrityError):
+            Order(club=self.club, purchaser=self.member, total=Decimal("5")).save()
+
+    def test_str_is_the_number(self):
+        order = self.make_order()
+
+        self.assertEqual(str(order), order.number)
+
+
+class ShopEntitiesTestBase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+        self.product = Product.objects.create(club=self.club, name="Home Jersey")
+        self.order = Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("50.00"))
+        self.year = timezone.now().year
+
+
+class OrderLineTests(ShopEntitiesTestBase):
+    def make_line(self, **kwargs):
+        kwargs.setdefault("order", self.order)
+        kwargs.setdefault("product", self.product)
+        kwargs.setdefault("quantity", 2)
+        kwargs.setdefault("unit_price", Decimal("25.00"))
+        kwargs.setdefault("line_total", Decimal("50.00"))
+        return OrderLine.objects.create(**kwargs)
+
+    def test_str(self):
+        self.assertEqual(str(self.make_line()), "Home Jersey - 2x")
+
+    def test_deleting_order_cascades_to_lines(self):
+        self.make_line()
+        self.order.delete()
+        self.assertFalse(OrderLine.objects.exists())
+
+    def test_product_is_protected_while_referenced(self):
+        self.make_line()
+        with self.assertRaises(ProtectedError):
+            self.product.delete()
+
+
+class DiscountTests(ShopEntitiesTestBase):
+    def test_slug_and_str(self):
+        discount = Discount.objects.create(club=self.club, name="Sibling discount")
+
+        self.assertEqual(discount.slug, "sibling-discount")
+        self.assertEqual(str(discount), "Sibling discount")
+
+    def test_slug_is_unique_per_club(self):
+        Discount.objects.create(club=self.club, name="Sibling")
+        second = Discount.objects.create(club=self.club, name="Sibling")
+
+        self.assertEqual(second.slug, "sibling-2")
+
+
+class AppliedDiscountTests(ShopEntitiesTestBase):
+    def setUp(self):
+        super().setUp()
+        self.discount = Discount.objects.create(club=self.club, name="Sibling")
+
+    def apply(self, **kwargs):
+        kwargs.setdefault("order", self.order)
+        kwargs.setdefault("discount", self.discount)
+        kwargs.setdefault("discount_amount", Decimal("10.00"))
+        return AppliedDiscount.objects.create(**kwargs)
+
+    def test_str_percentage_shows_percent(self):
+        applied = self.apply(discount_type=DiscountType.PERCENTAGE)
+
+        self.assertEqual(str(applied), "Sibling - 10.00%")
+
+    def test_str_fixed_amount_has_no_percent(self):
+        applied = self.apply(discount_type=DiscountType.FIXED_AMOUNT)
+
+        self.assertEqual(str(applied), "Sibling - 10.00")
+
+    def test_deleting_order_cascades(self):
+        self.apply()
+        self.order.delete()
+        self.assertFalse(AppliedDiscount.objects.exists())
+
+    def test_discount_is_protected_while_referenced(self):
+        self.apply()
+        with self.assertRaises(ProtectedError):
+            self.discount.delete()
+
+
+class PaymentTests(ShopEntitiesTestBase):
+    def test_str(self):
+        payment = Payment.objects.create(order=self.order, amount=Decimal("50.00"))
+
+        self.assertEqual(str(payment), f"{self.order} - pending")
+
+    def test_deleting_order_cascades(self):
+        Payment.objects.create(order=self.order, amount=Decimal("50.00"))
+        self.order.delete()
+        self.assertFalse(Payment.objects.exists())
+
+
+class InvoiceTests(ShopEntitiesTestBase):
+    def test_number_generated_and_str(self):
+        invoice = Invoice.objects.create(club=self.club, order=self.order)
+
+        self.assertEqual(invoice.number, f"INV-{self.year}-00001")
+        self.assertEqual(str(invoice), invoice.number)
+
+    def test_number_increments_per_club(self):
+        second_order = Order.objects.create(club=self.club, purchaser=self.member, total=Decimal("10.00"))
+        Invoice.objects.create(club=self.club, order=self.order)
+        second = Invoice.objects.create(club=self.club, order=second_order)
+
+        self.assertEqual(second.number, f"INV-{self.year}-00002")
+
+    def test_one_invoice_per_order(self):
+        Invoice.objects.create(club=self.club, order=self.order)
+
+        with self.assertRaises(IntegrityError):
+            Invoice.objects.create(club=self.club, order=self.order)
+
+    def test_deleting_order_cascades_to_invoice(self):
+        Invoice.objects.create(club=self.club, order=self.order)
+        self.order.delete()
+        self.assertFalse(Invoice.objects.exists())
+
+
+class ClubScopeValidationTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today + timedelta(days=300))
+        self.other_season = Season.objects.create(club=self.other, start_date=today, end_date=today + timedelta(days=300))
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+        ClubMembership.objects.create(club=self.club, member=self.member, season=self.season)
+        self.stranger = Member.objects.create(first_name="Stray", last_name="Ger")
+
+    def make_cart(self, club):
+        user = User.objects.create_user(email=f"u-{club.slug}@example.com", password="pw")
+        return Cart.objects.create(club=club, user=user)
+
+    def make_order(self, club):
+        return Order.objects.create(club=club, purchaser=self.member, total=Decimal("10.00"))
+
+    # --- Product ---
+    def test_product_rejects_cross_club_season(self):
+        product = Product(club=self.club, name="Jersey", season=self.other_season)
+        with self.assertRaises(ValidationError) as ctx:
+            product.full_clean()
+        self.assertIn("season", ctx.exception.error_dict)
+
+    def test_product_rejects_cross_club_staff_role(self):
+        position = Position.objects.create(club=self.other, name="Coach", short_name="C", staff_position=True)
+        product = Product(club=self.club, name="Jersey", staff_role=position)
+        with self.assertRaises(ValidationError) as ctx:
+            product.full_clean()
+        self.assertIn("staff_role", ctx.exception.error_dict)
+
+    def test_product_accepts_same_club_season(self):
+        Product(club=self.club, name="Jersey", season=self.season).full_clean()
+
+    # --- CartItem ---
+    def test_cartitem_rejects_cross_club_product(self):
+        cart = self.make_cart(self.club)
+        product = Product.objects.create(club=self.other, name="Jersey")
+        item = CartItem(cart=cart, product=product, unit_price=Decimal("5"))
+        with self.assertRaises(ValidationError) as ctx:
+            item.full_clean()
+        self.assertIn("product", ctx.exception.error_dict)
+
+    def test_cartitem_rejects_cross_club_team(self):
+        cart = self.make_cart(self.club)
+        product = Product.objects.create(club=self.club, name="Jersey")
+        team = Team.objects.create(club=self.other, name="First", short_name="1")
+        item = CartItem(cart=cart, product=product, team=team, unit_price=Decimal("5"))
+        with self.assertRaises(ValidationError) as ctx:
+            item.full_clean()
+        self.assertIn("team", ctx.exception.error_dict)
+
+    def test_cartitem_rejects_non_member_beneficiary(self):
+        cart = self.make_cart(self.club)
+        product = Product.objects.create(club=self.club, name="Jersey")
+        item = CartItem(cart=cart, product=product, beneficiary=self.stranger, unit_price=Decimal("5"))
+        with self.assertRaises(ValidationError) as ctx:
+            item.full_clean()
+        self.assertIn("beneficiary", ctx.exception.error_dict)
+
+    def test_cartitem_accepts_same_club(self):
+        cart = self.make_cart(self.club)
+        product = Product.objects.create(club=self.club, name="Jersey")
+        CartItem(cart=cart, product=product, beneficiary=self.member, unit_price=Decimal("5")).full_clean()
+
+    def test_cartitem_clean_without_cart_is_noop(self):
+        CartItem().clean()
+
+    # --- OrderLine ---
+    def test_orderline_rejects_cross_club_product(self):
+        order = self.make_order(self.club)
+        product = Product.objects.create(club=self.other, name="Jersey")
+        line = OrderLine(order=order, product=product, unit_price=Decimal("5"), line_total=Decimal("5"))
+        with self.assertRaises(ValidationError) as ctx:
+            line.full_clean()
+        self.assertIn("product", ctx.exception.error_dict)
+
+    def test_orderline_clean_without_order_is_noop(self):
+        OrderLine().clean()
+
+    # --- Order ---
+    def test_order_rejects_non_member_purchaser(self):
+        order = Order(club=self.club, purchaser=self.stranger, total=Decimal("10"))
+        with self.assertRaises(ValidationError) as ctx:
+            order.full_clean()
+        self.assertIn("purchaser", ctx.exception.error_dict)
+
+    def test_order_accepts_member_purchaser(self):
+        Order(club=self.club, purchaser=self.member, total=Decimal("10")).full_clean()
+
+    # --- AppliedDiscount ---
+    def test_applieddiscount_rejects_cross_club_discount(self):
+        order = self.make_order(self.club)
+        discount = Discount.objects.create(club=self.other, name="Sibling")
+        applied = AppliedDiscount(order=order, discount=discount, discount_amount=Decimal("5"))
+        with self.assertRaises(ValidationError) as ctx:
+            applied.full_clean()
+        self.assertIn("discount", ctx.exception.error_dict)
+
+    def test_applieddiscount_rejects_non_member_applied_by(self):
+        order = self.make_order(self.club)
+        discount = Discount.objects.create(club=self.club, name="Sibling")
+        applied = AppliedDiscount(order=order, discount=discount, discount_amount=Decimal("5"), applied_by=self.stranger)
+        with self.assertRaises(ValidationError) as ctx:
+            applied.full_clean()
+        self.assertIn("applied_by", ctx.exception.error_dict)
+
+    def test_applieddiscount_is_unique_per_order(self):
+        order = self.make_order(self.club)
+        discount = Discount.objects.create(club=self.club, name="Sibling")
+        AppliedDiscount.objects.create(order=order, discount=discount, discount_amount=Decimal("5"))
+        with self.assertRaises(IntegrityError):
+            AppliedDiscount.objects.create(order=order, discount=discount, discount_amount=Decimal("5"))
+
+    def test_applieddiscount_clean_without_order_is_noop(self):
+        AppliedDiscount().clean()
+
+    # --- Invoice ---
+    def test_invoice_rejects_cross_club_order(self):
+        order = self.make_order(self.other)
+        invoice = Invoice(club=self.club, order=order)
+        with self.assertRaises(ValidationError) as ctx:
+            invoice.full_clean()
+        self.assertIn("order", ctx.exception.error_dict)
+
+    def test_invoice_accepts_same_club_order(self):
+        order = self.make_order(self.club)
+        Invoice(club=self.club, order=order).full_clean()
+
+
+class AdminScopingTests(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        today = timezone.localdate()
+        self.season = Season.objects.create(club=self.club, start_date=today, end_date=today + timedelta(days=300))
+        self.other_season = Season.objects.create(club=self.other, start_date=today, end_date=today + timedelta(days=300))
+
+    def test_fk_dropdown_scoped_to_object_club(self):
+        product = Product.objects.create(club=self.club, name="Jersey")
+        admin_obj = ProductAdmin(Product, AdminSite())
+        request = RequestFactory().get("/")
+        request._club_obj = product
+
+        field = admin_obj.formfield_for_foreignkey(Product._meta.get_field("season"), request)
+
+        self.assertIn(self.season, field.queryset)
+        self.assertNotIn(self.other_season, field.queryset)
diff --git a/shop/views.py b/shop/views.py
new file mode 100644
index 0000000..60f00ef
--- /dev/null
+++ b/shop/views.py
@@ -0,0 +1 @@
+# Create your views here.
diff --git a/static/.DS_Store b/static/.DS_Store
new file mode 100644
index 0000000..bff4bec
Binary files /dev/null and b/static/.DS_Store differ
diff --git a/static/.gitkeep b/static/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/static/fonts/jetbrains-mono-latin-ext-wght-normal.woff2 b/static/fonts/jetbrains-mono-latin-ext-wght-normal.woff2
new file mode 100644
index 0000000..01769d9
Binary files /dev/null and b/static/fonts/jetbrains-mono-latin-ext-wght-normal.woff2 differ
diff --git a/static/fonts/jetbrains-mono-latin-wght-normal.woff2 b/static/fonts/jetbrains-mono-latin-wght-normal.woff2
new file mode 100644
index 0000000..cd5102a
Binary files /dev/null and b/static/fonts/jetbrains-mono-latin-wght-normal.woff2 differ
diff --git a/static/fonts/roboto-latin-ext-standard-normal.woff2 b/static/fonts/roboto-latin-ext-standard-normal.woff2
new file mode 100644
index 0000000..0842339
Binary files /dev/null and b/static/fonts/roboto-latin-ext-standard-normal.woff2 differ
diff --git a/static/fonts/roboto-latin-standard-normal.woff2 b/static/fonts/roboto-latin-standard-normal.woff2
new file mode 100644
index 0000000..20c3f4a
Binary files /dev/null and b/static/fonts/roboto-latin-standard-normal.woff2 differ
diff --git a/static/fonts/tourney-latin-ext-standard-normal.woff2 b/static/fonts/tourney-latin-ext-standard-normal.woff2
new file mode 100644
index 0000000..5060660
Binary files /dev/null and b/static/fonts/tourney-latin-ext-standard-normal.woff2 differ
diff --git a/static/fonts/tourney-latin-standard-normal.woff2 b/static/fonts/tourney-latin-standard-normal.woff2
new file mode 100644
index 0000000..5f5badf
Binary files /dev/null and b/static/fonts/tourney-latin-standard-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-400-italic.woff2 b/static/fonts/ubuntu-latin-400-italic.woff2
new file mode 100644
index 0000000..2b557a7
Binary files /dev/null and b/static/fonts/ubuntu-latin-400-italic.woff2 differ
diff --git a/static/fonts/ubuntu-latin-400-normal.woff2 b/static/fonts/ubuntu-latin-400-normal.woff2
new file mode 100644
index 0000000..8cb3d32
Binary files /dev/null and b/static/fonts/ubuntu-latin-400-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-500-normal.woff2 b/static/fonts/ubuntu-latin-500-normal.woff2
new file mode 100644
index 0000000..7740fd9
Binary files /dev/null and b/static/fonts/ubuntu-latin-500-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-700-normal.woff2 b/static/fonts/ubuntu-latin-700-normal.woff2
new file mode 100644
index 0000000..8eaed1f
Binary files /dev/null and b/static/fonts/ubuntu-latin-700-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-ext-400-italic.woff2 b/static/fonts/ubuntu-latin-ext-400-italic.woff2
new file mode 100644
index 0000000..88658c1
Binary files /dev/null and b/static/fonts/ubuntu-latin-ext-400-italic.woff2 differ
diff --git a/static/fonts/ubuntu-latin-ext-400-normal.woff2 b/static/fonts/ubuntu-latin-ext-400-normal.woff2
new file mode 100644
index 0000000..16afeec
Binary files /dev/null and b/static/fonts/ubuntu-latin-ext-400-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-ext-500-normal.woff2 b/static/fonts/ubuntu-latin-ext-500-normal.woff2
new file mode 100644
index 0000000..d11b8f9
Binary files /dev/null and b/static/fonts/ubuntu-latin-ext-500-normal.woff2 differ
diff --git a/static/fonts/ubuntu-latin-ext-700-normal.woff2 b/static/fonts/ubuntu-latin-ext-700-normal.woff2
new file mode 100644
index 0000000..a0d4e55
Binary files /dev/null and b/static/fonts/ubuntu-latin-ext-700-normal.woff2 differ
diff --git a/static/images/rosterchief-dark.svg b/static/images/rosterchief-dark.svg
new file mode 100644
index 0000000..d58f99f
--- /dev/null
+++ b/static/images/rosterchief-dark.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="200" height="200">
+  <path d="M50 4 L90 18 V50 C90 76 72 92 50 98 C28 92 10 76 10 50 V18 Z" fill="#0F1A2E"></path>
+  <rect x="27" y="30" width="46" height="8" rx="4" fill="#FFFFFF"></rect>
+  <rect x="27" y="44" width="34" height="8" rx="4" fill="#FFFFFF"></rect>
+  <path d="M27 80 L50 62 L73 80 L66 85 L50 72 L34 85 Z" fill="#FFFFFF"></path>
+</svg>
\ No newline at end of file
diff --git a/static/images/rosterchief-white.svg b/static/images/rosterchief-white.svg
new file mode 100644
index 0000000..12f0bfb
--- /dev/null
+++ b/static/images/rosterchief-white.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="200" height="200">
+  <path d="M50 4 L90 18 V50 C90 76 72 92 50 98 C28 92 10 76 10 50 V18 Z" fill="#FFFFFF"></path>
+  <rect x="27" y="30" width="46" height="8" rx="4" fill="#0F1A2E"></rect>
+  <rect x="27" y="44" width="34" height="8" rx="4" fill="#0F1A2E"></rect>
+  <path d="M27 80 L50 62 L73 80 L66 85 L50 72 L34 85 Z" fill="#0F1A2E"></path>
+</svg>
\ No newline at end of file
diff --git a/static/js/chart.js b/static/js/chart.js
new file mode 100644
index 0000000..4bd8b46
--- /dev/null
+++ b/static/js/chart.js
@@ -0,0 +1,13 @@
+/*!
+ * Chart.js v4.5.1
+ * https://www.chartjs.org
+ * (c) 2025 Chart.js Contributors
+ * Released under the MIT License
+ */
+!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t||self).Chart=e()}(this,(function(){"use strict";var t=Object.freeze({__proto__:null,get Colors(){return Jo},get Decimation(){return ta},get Filler(){return ba},get Legend(){return Ma},get SubTitle(){return Pa},get Title(){return ka},get Tooltip(){return Na}});function e(){}const i=(()=>{let t=0;return()=>t++})();function s(t){return null==t}function n(t){if(Array.isArray&&Array.isArray(t))return!0;const e=Object.prototype.toString.call(t);return"[object"===e.slice(0,7)&&"Array]"===e.slice(-6)}function o(t){return null!==t&&"[object Object]"===Object.prototype.toString.call(t)}function a(t){return("number"==typeof t||t instanceof Number)&&isFinite(+t)}function r(t,e){return a(t)?t:e}function l(t,e){return void 0===t?e:t}const h=(t,e)=>"string"==typeof t&&t.endsWith("%")?parseFloat(t)/100:+t/e,c=(t,e)=>"string"==typeof t&&t.endsWith("%")?parseFloat(t)/100*e:+t;function d(t,e,i){if(t&&"function"==typeof t.call)return t.apply(i,e)}function u(t,e,i,s){let a,r,l;if(n(t))if(r=t.length,s)for(a=r-1;a>=0;a--)e.call(i,t[a],a);else for(a=0;a<r;a++)e.call(i,t[a],a);else if(o(t))for(l=Object.keys(t),r=l.length,a=0;a<r;a++)e.call(i,t[l[a]],l[a])}function f(t,e){let i,s,n,o;if(!t||!e||t.length!==e.length)return!1;for(i=0,s=t.length;i<s;++i)if(n=t[i],o=e[i],n.datasetIndex!==o.datasetIndex||n.index!==o.index)return!1;return!0}function g(t){if(n(t))return t.map(g);if(o(t)){const e=Object.create(null),i=Object.keys(t),s=i.length;let n=0;for(;n<s;++n)e[i[n]]=g(t[i[n]]);return e}return t}function p(t){return-1===["__proto__","prototype","constructor"].indexOf(t)}function m(t,e,i,s){if(!p(t))return;const n=e[t],a=i[t];o(n)&&o(a)?x(n,a,s):e[t]=g(a)}function x(t,e,i){const s=n(e)?e:[e],a=s.length;if(!o(t))return t;const r=(i=i||{}).merger||m;let l;for(let e=0;e<a;++e){if(l=s[e],!o(l))continue;const n=Object.keys(l);for(let e=0,s=n.length;e<s;++e)r(n[e],t,l,i)}return t}function b(t,e){return x(t,e,{merger:_})}function _(t,e,i){if(!p(t))return;const s=e[t],n=i[t];o(s)&&o(n)?b(s,n):Object.prototype.hasOwnProperty.call(e,t)||(e[t]=g(n))}const y={"":t=>t,x:t=>t.x,y:t=>t.y};function v(t){const e=t.split("."),i=[];let s="";for(const t of e)s+=t,s.endsWith("\\")?s=s.slice(0,-1)+".":(i.push(s),s="");return i}function M(t,e){const i=y[e]||(y[e]=function(t){const e=v(t);return t=>{for(const i of e){if(""===i)break;t=t&&t[i]}return t}}(e));return i(t)}function w(t){return t.charAt(0).toUpperCase()+t.slice(1)}const k=t=>void 0!==t,S=t=>"function"==typeof t,P=(t,e)=>{if(t.size!==e.size)return!1;for(const i of t)if(!e.has(i))return!1;return!0};function D(t){return"mouseup"===t.type||"click"===t.type||"contextmenu"===t.type}const C=Math.PI,O=2*C,A=O+C,T=Number.POSITIVE_INFINITY,L=C/180,E=C/2,R=C/4,I=2*C/3,z=Math.log10,F=Math.sign;function V(t,e,i){return Math.abs(t-e)<i}function B(t){const e=Math.round(t);t=V(t,e,t/1e3)?e:t;const i=Math.pow(10,Math.floor(z(t))),s=t/i;return(s<=1?1:s<=2?2:s<=5?5:10)*i}function W(t){const e=[],i=Math.sqrt(t);let s;for(s=1;s<i;s++)t%s==0&&(e.push(s),e.push(t/s));return i===(0|i)&&e.push(i),e.sort(((t,e)=>t-e)).pop(),e}function N(t){return!function(t){return"symbol"==typeof t||"object"==typeof t&&null!==t&&!(Symbol.toPrimitive in t||"toString"in t||"valueOf"in t)}(t)&&!isNaN(parseFloat(t))&&isFinite(t)}function H(t,e){const i=Math.round(t);return i-e<=t&&i+e>=t}function j(t,e,i){let s,n,o;for(s=0,n=t.length;s<n;s++)o=t[s][i],isNaN(o)||(e.min=Math.min(e.min,o),e.max=Math.max(e.max,o))}function $(t){return t*(C/180)}function Y(t){return t*(180/C)}function U(t){if(!a(t))return;let e=1,i=0;for(;Math.round(t*e)/e!==t;)e*=10,i++;return i}function X(t,e){const i=e.x-t.x,s=e.y-t.y,n=Math.sqrt(i*i+s*s);let o=Math.atan2(s,i);return o<-.5*C&&(o+=O),{angle:o,distance:n}}function q(t,e){return Math.sqrt(Math.pow(e.x-t.x,2)+Math.pow(e.y-t.y,2))}function K(t,e){return(t-e+A)%O-C}function G(t){return(t%O+O)%O}function J(t,e,i,s){const n=G(t),o=G(e),a=G(i),r=G(o-n),l=G(a-n),h=G(n-o),c=G(n-a);return n===o||n===a||s&&o===a||r>l&&h<c}function Z(t,e,i){return Math.max(e,Math.min(i,t))}function Q(t){return Z(t,-32768,32767)}function tt(t,e,i,s=1e-6){return t>=Math.min(e,i)-s&&t<=Math.max(e,i)+s}function et(t,e,i){i=i||(i=>t[i]<e);let s,n=t.length-1,o=0;for(;n-o>1;)s=o+n>>1,i(s)?o=s:n=s;return{lo:o,hi:n}}const it=(t,e,i,s)=>et(t,i,s?s=>{const n=t[s][e];return n<i||n===i&&t[s+1][e]===i}:s=>t[s][e]<i),st=(t,e,i)=>et(t,i,(s=>t[s][e]>=i));function nt(t,e,i){let s=0,n=t.length;for(;s<n&&t[s]<e;)s++;for(;n>s&&t[n-1]>i;)n--;return s>0||n<t.length?t.slice(s,n):t}const ot=["push","pop","shift","splice","unshift"];function at(t,e){t._chartjs?t._chartjs.listeners.push(e):(Object.defineProperty(t,"_chartjs",{configurable:!0,enumerable:!1,value:{listeners:[e]}}),ot.forEach((e=>{const i="_onData"+w(e),s=t[e];Object.defineProperty(t,e,{configurable:!0,enumerable:!1,value(...e){const n=s.apply(this,e);return t._chartjs.listeners.forEach((t=>{"function"==typeof t[i]&&t[i](...e)})),n}})})))}function rt(t,e){const i=t._chartjs;if(!i)return;const s=i.listeners,n=s.indexOf(e);-1!==n&&s.splice(n,1),s.length>0||(ot.forEach((e=>{delete t[e]})),delete t._chartjs)}function lt(t){const e=new Set(t);return e.size===t.length?t:Array.from(e)}const ht="undefined"==typeof window?function(t){return t()}:window.requestAnimationFrame;function ct(t,e){let i=[],s=!1;return function(...n){i=n,s||(s=!0,ht.call(window,(()=>{s=!1,t.apply(e,i)})))}}function dt(t,e){let i;return function(...s){return e?(clearTimeout(i),i=setTimeout(t,e,s)):t.apply(this,s),e}}const ut=t=>"start"===t?"left":"end"===t?"right":"center",ft=(t,e,i)=>"start"===t?e:"end"===t?i:(e+i)/2,gt=(t,e,i,s)=>t===(s?"left":"right")?i:"center"===t?(e+i)/2:e;function pt(t,e,i){const n=e.length;let o=0,a=n;if(t._sorted){const{iScale:r,vScale:l,_parsed:h}=t,c=t.dataset&&t.dataset.options?t.dataset.options.spanGaps:null,d=r.axis,{min:u,max:f,minDefined:g,maxDefined:p}=r.getUserBounds();if(g){if(o=Math.min(it(h,d,u).lo,i?n:it(e,d,r.getPixelForValue(u)).lo),c){const t=h.slice(0,o+1).reverse().findIndex((t=>!s(t[l.axis])));o-=Math.max(0,t)}o=Z(o,0,n-1)}if(p){let t=Math.max(it(h,r.axis,f,!0).hi+1,i?0:it(e,d,r.getPixelForValue(f),!0).hi+1);if(c){const e=h.slice(t-1).findIndex((t=>!s(t[l.axis])));t+=Math.max(0,e)}a=Z(t,o,n)-o}else a=n-o}return{start:o,count:a}}function mt(t){const{xScale:e,yScale:i,_scaleRanges:s}=t,n={xmin:e.min,xmax:e.max,ymin:i.min,ymax:i.max};if(!s)return t._scaleRanges=n,!0;const o=s.xmin!==e.min||s.xmax!==e.max||s.ymin!==i.min||s.ymax!==i.max;return Object.assign(s,n),o}class xt{constructor(){this._request=null,this._charts=new Map,this._running=!1,this._lastDate=void 0}_notify(t,e,i,s){const n=e.listeners[s],o=e.duration;n.forEach((s=>s({chart:t,initial:e.initial,numSteps:o,currentStep:Math.min(i-e.start,o)})))}_refresh(){this._request||(this._running=!0,this._request=ht.call(window,(()=>{this._update(),this._request=null,this._running&&this._refresh()})))}_update(t=Date.now()){let e=0;this._charts.forEach(((i,s)=>{if(!i.running||!i.items.length)return;const n=i.items;let o,a=n.length-1,r=!1;for(;a>=0;--a)o=n[a],o._active?(o._total>i.duration&&(i.duration=o._total),o.tick(t),r=!0):(n[a]=n[n.length-1],n.pop());r&&(s.draw(),this._notify(s,i,t,"progress")),n.length||(i.running=!1,this._notify(s,i,t,"complete"),i.initial=!1),e+=n.length})),this._lastDate=t,0===e&&(this._running=!1)}_getAnims(t){const e=this._charts;let i=e.get(t);return i||(i={running:!1,initial:!0,items:[],listeners:{complete:[],progress:[]}},e.set(t,i)),i}listen(t,e,i){this._getAnims(t).listeners[e].push(i)}add(t,e){e&&e.length&&this._getAnims(t).items.push(...e)}has(t){return this._getAnims(t).items.length>0}start(t){const e=this._charts.get(t);e&&(e.running=!0,e.start=Date.now(),e.duration=e.items.reduce(((t,e)=>Math.max(t,e._duration)),0),this._refresh())}running(t){if(!this._running)return!1;const e=this._charts.get(t);return!!(e&&e.running&&e.items.length)}stop(t){const e=this._charts.get(t);if(!e||!e.items.length)return;const i=e.items;let s=i.length-1;for(;s>=0;--s)i[s].cancel();e.items=[],this._notify(t,e,Date.now(),"complete")}remove(t){return this._charts.delete(t)}}var bt=new xt;
+/*!
+ * @kurkle/color v0.3.2
+ * https://github.com/kurkle/color#readme
+ * (c) 2023 Jukka Kurkela
+ * Released under the MIT License
+ */function _t(t){return t+.5|0}const yt=(t,e,i)=>Math.max(Math.min(t,i),e);function vt(t){return yt(_t(2.55*t),0,255)}function Mt(t){return yt(_t(255*t),0,255)}function wt(t){return yt(_t(t/2.55)/100,0,1)}function kt(t){return yt(_t(100*t),0,100)}const St={0:0,1:1,2:2,3:3,4:4,5:5,6:6,7:7,8:8,9:9,A:10,B:11,C:12,D:13,E:14,F:15,a:10,b:11,c:12,d:13,e:14,f:15},Pt=[..."0123456789ABCDEF"],Dt=t=>Pt[15&t],Ct=t=>Pt[(240&t)>>4]+Pt[15&t],Ot=t=>(240&t)>>4==(15&t);function At(t){var e=(t=>Ot(t.r)&&Ot(t.g)&&Ot(t.b)&&Ot(t.a))(t)?Dt:Ct;return t?"#"+e(t.r)+e(t.g)+e(t.b)+((t,e)=>t<255?e(t):"")(t.a,e):void 0}const Tt=/^(hsla?|hwb|hsv)\(\s*([-+.e\d]+)(?:deg)?[\s,]+([-+.e\d]+)%[\s,]+([-+.e\d]+)%(?:[\s,]+([-+.e\d]+)(%)?)?\s*\)$/;function Lt(t,e,i){const s=e*Math.min(i,1-i),n=(e,n=(e+t/30)%12)=>i-s*Math.max(Math.min(n-3,9-n,1),-1);return[n(0),n(8),n(4)]}function Et(t,e,i){const s=(s,n=(s+t/60)%6)=>i-i*e*Math.max(Math.min(n,4-n,1),0);return[s(5),s(3),s(1)]}function Rt(t,e,i){const s=Lt(t,1,.5);let n;for(e+i>1&&(n=1/(e+i),e*=n,i*=n),n=0;n<3;n++)s[n]*=1-e-i,s[n]+=e;return s}function It(t){const e=t.r/255,i=t.g/255,s=t.b/255,n=Math.max(e,i,s),o=Math.min(e,i,s),a=(n+o)/2;let r,l,h;return n!==o&&(h=n-o,l=a>.5?h/(2-n-o):h/(n+o),r=function(t,e,i,s,n){return t===n?(e-i)/s+(e<i?6:0):e===n?(i-t)/s+2:(t-e)/s+4}(e,i,s,h,n),r=60*r+.5),[0|r,l||0,a]}function zt(t,e,i,s){return(Array.isArray(e)?t(e[0],e[1],e[2]):t(e,i,s)).map(Mt)}function Ft(t,e,i){return zt(Lt,t,e,i)}function Vt(t){return(t%360+360)%360}function Bt(t){const e=Tt.exec(t);let i,s=255;if(!e)return;e[5]!==i&&(s=e[6]?vt(+e[5]):Mt(+e[5]));const n=Vt(+e[2]),o=+e[3]/100,a=+e[4]/100;return i="hwb"===e[1]?function(t,e,i){return zt(Rt,t,e,i)}(n,o,a):"hsv"===e[1]?function(t,e,i){return zt(Et,t,e,i)}(n,o,a):Ft(n,o,a),{r:i[0],g:i[1],b:i[2],a:s}}const Wt={x:"dark",Z:"light",Y:"re",X:"blu",W:"gr",V:"medium",U:"slate",A:"ee",T:"ol",S:"or",B:"ra",C:"lateg",D:"ights",R:"in",Q:"turquois",E:"hi",P:"ro",O:"al",N:"le",M:"de",L:"yello",F:"en",K:"ch",G:"arks",H:"ea",I:"ightg",J:"wh"},Nt={OiceXe:"f0f8ff",antiquewEte:"faebd7",aqua:"ffff",aquamarRe:"7fffd4",azuY:"f0ffff",beige:"f5f5dc",bisque:"ffe4c4",black:"0",blanKedOmond:"ffebcd",Xe:"ff",XeviTet:"8a2be2",bPwn:"a52a2a",burlywood:"deb887",caMtXe:"5f9ea0",KartYuse:"7fff00",KocTate:"d2691e",cSO:"ff7f50",cSnflowerXe:"6495ed",cSnsilk:"fff8dc",crimson:"dc143c",cyan:"ffff",xXe:"8b",xcyan:"8b8b",xgTMnPd:"b8860b",xWay:"a9a9a9",xgYF:"6400",xgYy:"a9a9a9",xkhaki:"bdb76b",xmagFta:"8b008b",xTivegYF:"556b2f",xSange:"ff8c00",xScEd:"9932cc",xYd:"8b0000",xsOmon:"e9967a",xsHgYF:"8fbc8f",xUXe:"483d8b",xUWay:"2f4f4f",xUgYy:"2f4f4f",xQe:"ced1",xviTet:"9400d3",dAppRk:"ff1493",dApskyXe:"bfff",dimWay:"696969",dimgYy:"696969",dodgerXe:"1e90ff",fiYbrick:"b22222",flSOwEte:"fffaf0",foYstWAn:"228b22",fuKsia:"ff00ff",gaRsbSo:"dcdcdc",ghostwEte:"f8f8ff",gTd:"ffd700",gTMnPd:"daa520",Way:"808080",gYF:"8000",gYFLw:"adff2f",gYy:"808080",honeyMw:"f0fff0",hotpRk:"ff69b4",RdianYd:"cd5c5c",Rdigo:"4b0082",ivSy:"fffff0",khaki:"f0e68c",lavFMr:"e6e6fa",lavFMrXsh:"fff0f5",lawngYF:"7cfc00",NmoncEffon:"fffacd",ZXe:"add8e6",ZcSO:"f08080",Zcyan:"e0ffff",ZgTMnPdLw:"fafad2",ZWay:"d3d3d3",ZgYF:"90ee90",ZgYy:"d3d3d3",ZpRk:"ffb6c1",ZsOmon:"ffa07a",ZsHgYF:"20b2aa",ZskyXe:"87cefa",ZUWay:"778899",ZUgYy:"778899",ZstAlXe:"b0c4de",ZLw:"ffffe0",lime:"ff00",limegYF:"32cd32",lRF:"faf0e6",magFta:"ff00ff",maPon:"800000",VaquamarRe:"66cdaa",VXe:"cd",VScEd:"ba55d3",VpurpN:"9370db",VsHgYF:"3cb371",VUXe:"7b68ee",VsprRggYF:"fa9a",VQe:"48d1cc",VviTetYd:"c71585",midnightXe:"191970",mRtcYam:"f5fffa",mistyPse:"ffe4e1",moccasR:"ffe4b5",navajowEte:"ffdead",navy:"80",Tdlace:"fdf5e6",Tive:"808000",TivedBb:"6b8e23",Sange:"ffa500",SangeYd:"ff4500",ScEd:"da70d6",pOegTMnPd:"eee8aa",pOegYF:"98fb98",pOeQe:"afeeee",pOeviTetYd:"db7093",papayawEp:"ffefd5",pHKpuff:"ffdab9",peru:"cd853f",pRk:"ffc0cb",plum:"dda0dd",powMrXe:"b0e0e6",purpN:"800080",YbeccapurpN:"663399",Yd:"ff0000",Psybrown:"bc8f8f",PyOXe:"4169e1",saddNbPwn:"8b4513",sOmon:"fa8072",sandybPwn:"f4a460",sHgYF:"2e8b57",sHshell:"fff5ee",siFna:"a0522d",silver:"c0c0c0",skyXe:"87ceeb",UXe:"6a5acd",UWay:"708090",UgYy:"708090",snow:"fffafa",sprRggYF:"ff7f",stAlXe:"4682b4",tan:"d2b48c",teO:"8080",tEstN:"d8bfd8",tomato:"ff6347",Qe:"40e0d0",viTet:"ee82ee",JHt:"f5deb3",wEte:"ffffff",wEtesmoke:"f5f5f5",Lw:"ffff00",LwgYF:"9acd32"};let Ht;function jt(t){Ht||(Ht=function(){const t={},e=Object.keys(Nt),i=Object.keys(Wt);let s,n,o,a,r;for(s=0;s<e.length;s++){for(a=r=e[s],n=0;n<i.length;n++)o=i[n],r=r.replace(o,Wt[o]);o=parseInt(Nt[a],16),t[r]=[o>>16&255,o>>8&255,255&o]}return t}(),Ht.transparent=[0,0,0,0]);const e=Ht[t.toLowerCase()];return e&&{r:e[0],g:e[1],b:e[2],a:4===e.length?e[3]:255}}const $t=/^rgba?\(\s*([-+.\d]+)(%)?[\s,]+([-+.e\d]+)(%)?[\s,]+([-+.e\d]+)(%)?(?:[\s,/]+([-+.e\d]+)(%)?)?\s*\)$/;const Yt=t=>t<=.0031308?12.92*t:1.055*Math.pow(t,1/2.4)-.055,Ut=t=>t<=.04045?t/12.92:Math.pow((t+.055)/1.055,2.4);function Xt(t,e,i){if(t){let s=It(t);s[e]=Math.max(0,Math.min(s[e]+s[e]*i,0===e?360:1)),s=Ft(s),t.r=s[0],t.g=s[1],t.b=s[2]}}function qt(t,e){return t?Object.assign(e||{},t):t}function Kt(t){var e={r:0,g:0,b:0,a:255};return Array.isArray(t)?t.length>=3&&(e={r:t[0],g:t[1],b:t[2],a:255},t.length>3&&(e.a=Mt(t[3]))):(e=qt(t,{r:0,g:0,b:0,a:1})).a=Mt(e.a),e}function Gt(t){return"r"===t.charAt(0)?function(t){const e=$t.exec(t);let i,s,n,o=255;if(e){if(e[7]!==i){const t=+e[7];o=e[8]?vt(t):yt(255*t,0,255)}return i=+e[1],s=+e[3],n=+e[5],i=255&(e[2]?vt(i):yt(i,0,255)),s=255&(e[4]?vt(s):yt(s,0,255)),n=255&(e[6]?vt(n):yt(n,0,255)),{r:i,g:s,b:n,a:o}}}(t):Bt(t)}class Jt{constructor(t){if(t instanceof Jt)return t;const e=typeof t;let i;var s,n,o;"object"===e?i=Kt(t):"string"===e&&(o=(s=t).length,"#"===s[0]&&(4===o||5===o?n={r:255&17*St[s[1]],g:255&17*St[s[2]],b:255&17*St[s[3]],a:5===o?17*St[s[4]]:255}:7!==o&&9!==o||(n={r:St[s[1]]<<4|St[s[2]],g:St[s[3]]<<4|St[s[4]],b:St[s[5]]<<4|St[s[6]],a:9===o?St[s[7]]<<4|St[s[8]]:255})),i=n||jt(t)||Gt(t)),this._rgb=i,this._valid=!!i}get valid(){return this._valid}get rgb(){var t=qt(this._rgb);return t&&(t.a=wt(t.a)),t}set rgb(t){this._rgb=Kt(t)}rgbString(){return this._valid?(t=this._rgb)&&(t.a<255?`rgba(${t.r}, ${t.g}, ${t.b}, ${wt(t.a)})`:`rgb(${t.r}, ${t.g}, ${t.b})`):void 0;var t}hexString(){return this._valid?At(this._rgb):void 0}hslString(){return this._valid?function(t){if(!t)return;const e=It(t),i=e[0],s=kt(e[1]),n=kt(e[2]);return t.a<255?`hsla(${i}, ${s}%, ${n}%, ${wt(t.a)})`:`hsl(${i}, ${s}%, ${n}%)`}(this._rgb):void 0}mix(t,e){if(t){const i=this.rgb,s=t.rgb;let n;const o=e===n?.5:e,a=2*o-1,r=i.a-s.a,l=((a*r==-1?a:(a+r)/(1+a*r))+1)/2;n=1-l,i.r=255&l*i.r+n*s.r+.5,i.g=255&l*i.g+n*s.g+.5,i.b=255&l*i.b+n*s.b+.5,i.a=o*i.a+(1-o)*s.a,this.rgb=i}return this}interpolate(t,e){return t&&(this._rgb=function(t,e,i){const s=Ut(wt(t.r)),n=Ut(wt(t.g)),o=Ut(wt(t.b));return{r:Mt(Yt(s+i*(Ut(wt(e.r))-s))),g:Mt(Yt(n+i*(Ut(wt(e.g))-n))),b:Mt(Yt(o+i*(Ut(wt(e.b))-o))),a:t.a+i*(e.a-t.a)}}(this._rgb,t._rgb,e)),this}clone(){return new Jt(this.rgb)}alpha(t){return this._rgb.a=Mt(t),this}clearer(t){return this._rgb.a*=1-t,this}greyscale(){const t=this._rgb,e=_t(.3*t.r+.59*t.g+.11*t.b);return t.r=t.g=t.b=e,this}opaquer(t){return this._rgb.a*=1+t,this}negate(){const t=this._rgb;return t.r=255-t.r,t.g=255-t.g,t.b=255-t.b,this}lighten(t){return Xt(this._rgb,2,t),this}darken(t){return Xt(this._rgb,2,-t),this}saturate(t){return Xt(this._rgb,1,t),this}desaturate(t){return Xt(this._rgb,1,-t),this}rotate(t){return function(t,e){var i=It(t);i[0]=Vt(i[0]+e),i=Ft(i),t.r=i[0],t.g=i[1],t.b=i[2]}(this._rgb,t),this}}function Zt(t){if(t&&"object"==typeof t){const e=t.toString();return"[object CanvasPattern]"===e||"[object CanvasGradient]"===e}return!1}function Qt(t){return Zt(t)?t:new Jt(t)}function te(t){return Zt(t)?t:new Jt(t).saturate(.5).darken(.1).hexString()}const ee=["x","y","borderWidth","radius","tension"],ie=["color","borderColor","backgroundColor"];const se=new Map;function ne(t,e,i){return function(t,e){e=e||{};const i=t+JSON.stringify(e);let s=se.get(i);return s||(s=new Intl.NumberFormat(t,e),se.set(i,s)),s}(e,i).format(t)}const oe={values:t=>n(t)?t:""+t,numeric(t,e,i){if(0===t)return"0";const s=this.chart.options.locale;let n,o=t;if(i.length>1){const e=Math.max(Math.abs(i[0].value),Math.abs(i[i.length-1].value));(e<1e-4||e>1e15)&&(n="scientific"),o=function(t,e){let i=e.length>3?e[2].value-e[1].value:e[1].value-e[0].value;Math.abs(i)>=1&&t!==Math.floor(t)&&(i=t-Math.floor(t));return i}(t,i)}const a=z(Math.abs(o)),r=isNaN(a)?1:Math.max(Math.min(-1*Math.floor(a),20),0),l={notation:n,minimumFractionDigits:r,maximumFractionDigits:r};return Object.assign(l,this.options.ticks.format),ne(t,s,l)},logarithmic(t,e,i){if(0===t)return"0";const s=i[e].significand||t/Math.pow(10,Math.floor(z(t)));return[1,2,3,5,10,15].includes(s)||e>.8*i.length?oe.numeric.call(this,t,e,i):""}};var ae={formatters:oe};const re=Object.create(null),le=Object.create(null);function he(t,e){if(!e)return t;const i=e.split(".");for(let e=0,s=i.length;e<s;++e){const s=i[e];t=t[s]||(t[s]=Object.create(null))}return t}function ce(t,e,i){return"string"==typeof e?x(he(t,e),i):x(he(t,""),e)}class de{constructor(t,e){this.animation=void 0,this.backgroundColor="rgba(0,0,0,0.1)",this.borderColor="rgba(0,0,0,0.1)",this.color="#666",this.datasets={},this.devicePixelRatio=t=>t.chart.platform.getDevicePixelRatio(),this.elements={},this.events=["mousemove","mouseout","click","touchstart","touchmove"],this.font={family:"'Helvetica Neue', 'Helvetica', 'Arial', sans-serif",size:12,style:"normal",lineHeight:1.2,weight:null},this.hover={},this.hoverBackgroundColor=(t,e)=>te(e.backgroundColor),this.hoverBorderColor=(t,e)=>te(e.borderColor),this.hoverColor=(t,e)=>te(e.color),this.indexAxis="x",this.interaction={mode:"nearest",intersect:!0,includeInvisible:!1},this.maintainAspectRatio=!0,this.onHover=null,this.onClick=null,this.parsing=!0,this.plugins={},this.responsive=!0,this.scale=void 0,this.scales={},this.showLine=!0,this.drawActiveElementsOnTop=!0,this.describe(t),this.apply(e)}set(t,e){return ce(this,t,e)}get(t){return he(this,t)}describe(t,e){return ce(le,t,e)}override(t,e){return ce(re,t,e)}route(t,e,i,s){const n=he(this,t),a=he(this,i),r="_"+e;Object.defineProperties(n,{[r]:{value:n[e],writable:!0},[e]:{enumerable:!0,get(){const t=this[r],e=a[s];return o(t)?Object.assign({},e,t):l(t,e)},set(t){this[r]=t}}})}apply(t){t.forEach((t=>t(this)))}}var ue=new de({_scriptable:t=>!t.startsWith("on"),_indexable:t=>"events"!==t,hover:{_fallback:"interaction"},interaction:{_scriptable:!1,_indexable:!1}},[function(t){t.set("animation",{delay:void 0,duration:1e3,easing:"easeOutQuart",fn:void 0,from:void 0,loop:void 0,to:void 0,type:void 0}),t.describe("animation",{_fallback:!1,_indexable:!1,_scriptable:t=>"onProgress"!==t&&"onComplete"!==t&&"fn"!==t}),t.set("animations",{colors:{type:"color",properties:ie},numbers:{type:"number",properties:ee}}),t.describe("animations",{_fallback:"animation"}),t.set("transitions",{active:{animation:{duration:400}},resize:{animation:{duration:0}},show:{animations:{colors:{from:"transparent"},visible:{type:"boolean",duration:0}}},hide:{animations:{colors:{to:"transparent"},visible:{type:"boolean",easing:"linear",fn:t=>0|t}}}})},function(t){t.set("layout",{autoPadding:!0,padding:{top:0,right:0,bottom:0,left:0}})},function(t){t.set("scale",{display:!0,offset:!1,reverse:!1,beginAtZero:!1,bounds:"ticks",clip:!0,grace:0,grid:{display:!0,lineWidth:1,drawOnChartArea:!0,drawTicks:!0,tickLength:8,tickWidth:(t,e)=>e.lineWidth,tickColor:(t,e)=>e.color,offset:!1},border:{display:!0,dash:[],dashOffset:0,width:1},title:{display:!1,text:"",padding:{top:4,bottom:4}},ticks:{minRotation:0,maxRotation:50,mirror:!1,textStrokeWidth:0,textStrokeColor:"",padding:3,display:!0,autoSkip:!0,autoSkipPadding:3,labelOffset:0,callback:ae.formatters.values,minor:{},major:{},align:"center",crossAlign:"near",showLabelBackdrop:!1,backdropColor:"rgba(255, 255, 255, 0.75)",backdropPadding:2}}),t.route("scale.ticks","color","","color"),t.route("scale.grid","color","","borderColor"),t.route("scale.border","color","","borderColor"),t.route("scale.title","color","","color"),t.describe("scale",{_fallback:!1,_scriptable:t=>!t.startsWith("before")&&!t.startsWith("after")&&"callback"!==t&&"parser"!==t,_indexable:t=>"borderDash"!==t&&"tickBorderDash"!==t&&"dash"!==t}),t.describe("scales",{_fallback:"scale"}),t.describe("scale.ticks",{_scriptable:t=>"backdropPadding"!==t&&"callback"!==t,_indexable:t=>"backdropPadding"!==t})}]);function fe(){return"undefined"!=typeof window&&"undefined"!=typeof document}function ge(t){let e=t.parentNode;return e&&"[object ShadowRoot]"===e.toString()&&(e=e.host),e}function pe(t,e,i){let s;return"string"==typeof t?(s=parseInt(t,10),-1!==t.indexOf("%")&&(s=s/100*e.parentNode[i])):s=t,s}const me=t=>t.ownerDocument.defaultView.getComputedStyle(t,null);function xe(t,e){return me(t).getPropertyValue(e)}const be=["top","right","bottom","left"];function _e(t,e,i){const s={};i=i?"-"+i:"";for(let n=0;n<4;n++){const o=be[n];s[o]=parseFloat(t[e+"-"+o+i])||0}return s.width=s.left+s.right,s.height=s.top+s.bottom,s}const ye=(t,e,i)=>(t>0||e>0)&&(!i||!i.shadowRoot);function ve(t,e){if("native"in t)return t;const{canvas:i,currentDevicePixelRatio:s}=e,n=me(i),o="border-box"===n.boxSizing,a=_e(n,"padding"),r=_e(n,"border","width"),{x:l,y:h,box:c}=function(t,e){const i=t.touches,s=i&&i.length?i[0]:t,{offsetX:n,offsetY:o}=s;let a,r,l=!1;if(ye(n,o,t.target))a=n,r=o;else{const t=e.getBoundingClientRect();a=s.clientX-t.left,r=s.clientY-t.top,l=!0}return{x:a,y:r,box:l}}(t,i),d=a.left+(c&&r.left),u=a.top+(c&&r.top);let{width:f,height:g}=e;return o&&(f-=a.width+r.width,g-=a.height+r.height),{x:Math.round((l-d)/f*i.width/s),y:Math.round((h-u)/g*i.height/s)}}const Me=t=>Math.round(10*t)/10;function we(t,e,i,s){const n=me(t),o=_e(n,"margin"),a=pe(n.maxWidth,t,"clientWidth")||T,r=pe(n.maxHeight,t,"clientHeight")||T,l=function(t,e,i){let s,n;if(void 0===e||void 0===i){const o=t&&ge(t);if(o){const t=o.getBoundingClientRect(),a=me(o),r=_e(a,"border","width"),l=_e(a,"padding");e=t.width-l.width-r.width,i=t.height-l.height-r.height,s=pe(a.maxWidth,o,"clientWidth"),n=pe(a.maxHeight,o,"clientHeight")}else e=t.clientWidth,i=t.clientHeight}return{width:e,height:i,maxWidth:s||T,maxHeight:n||T}}(t,e,i);let{width:h,height:c}=l;if("content-box"===n.boxSizing){const t=_e(n,"border","width"),e=_e(n,"padding");h-=e.width+t.width,c-=e.height+t.height}h=Math.max(0,h-o.width),c=Math.max(0,s?h/s:c-o.height),h=Me(Math.min(h,a,l.maxWidth)),c=Me(Math.min(c,r,l.maxHeight)),h&&!c&&(c=Me(h/2));return(void 0!==e||void 0!==i)&&s&&l.height&&c>l.height&&(c=l.height,h=Me(Math.floor(c*s))),{width:h,height:c}}function ke(t,e,i){const s=e||1,n=Me(t.height*s),o=Me(t.width*s);t.height=Me(t.height),t.width=Me(t.width);const a=t.canvas;return a.style&&(i||!a.style.height&&!a.style.width)&&(a.style.height=`${t.height}px`,a.style.width=`${t.width}px`),(t.currentDevicePixelRatio!==s||a.height!==n||a.width!==o)&&(t.currentDevicePixelRatio=s,a.height=n,a.width=o,t.ctx.setTransform(s,0,0,s,0,0),!0)}const Se=function(){let t=!1;try{const e={get passive(){return t=!0,!1}};fe()&&(window.addEventListener("test",null,e),window.removeEventListener("test",null,e))}catch(t){}return t}();function Pe(t,e){const i=xe(t,e),s=i&&i.match(/^(\d+)(\.\d+)?px$/);return s?+s[1]:void 0}function De(t){return!t||s(t.size)||s(t.family)?null:(t.style?t.style+" ":"")+(t.weight?t.weight+" ":"")+t.size+"px "+t.family}function Ce(t,e,i,s,n){let o=e[n];return o||(o=e[n]=t.measureText(n).width,i.push(n)),o>s&&(s=o),s}function Oe(t,e,i,s){let o=(s=s||{}).data=s.data||{},a=s.garbageCollect=s.garbageCollect||[];s.font!==e&&(o=s.data={},a=s.garbageCollect=[],s.font=e),t.save(),t.font=e;let r=0;const l=i.length;let h,c,d,u,f;for(h=0;h<l;h++)if(u=i[h],null==u||n(u)){if(n(u))for(c=0,d=u.length;c<d;c++)f=u[c],null==f||n(f)||(r=Ce(t,o,a,r,f))}else r=Ce(t,o,a,r,u);t.restore();const g=a.length/2;if(g>i.length){for(h=0;h<g;h++)delete o[a[h]];a.splice(0,g)}return r}function Ae(t,e,i){const s=t.currentDevicePixelRatio,n=0!==i?Math.max(i/2,.5):0;return Math.round((e-n)*s)/s+n}function Te(t,e){(e||t)&&((e=e||t.getContext("2d")).save(),e.resetTransform(),e.clearRect(0,0,t.width,t.height),e.restore())}function Le(t,e,i,s){Ee(t,e,i,s,null)}function Ee(t,e,i,s,n){let o,a,r,l,h,c,d,u;const f=e.pointStyle,g=e.rotation,p=e.radius;let m=(g||0)*L;if(f&&"object"==typeof f&&(o=f.toString(),"[object HTMLImageElement]"===o||"[object HTMLCanvasElement]"===o))return t.save(),t.translate(i,s),t.rotate(m),t.drawImage(f,-f.width/2,-f.height/2,f.width,f.height),void t.restore();if(!(isNaN(p)||p<=0)){switch(t.beginPath(),f){default:n?t.ellipse(i,s,n/2,p,0,0,O):t.arc(i,s,p,0,O),t.closePath();break;case"triangle":c=n?n/2:p,t.moveTo(i+Math.sin(m)*c,s-Math.cos(m)*p),m+=I,t.lineTo(i+Math.sin(m)*c,s-Math.cos(m)*p),m+=I,t.lineTo(i+Math.sin(m)*c,s-Math.cos(m)*p),t.closePath();break;case"rectRounded":h=.516*p,l=p-h,a=Math.cos(m+R)*l,d=Math.cos(m+R)*(n?n/2-h:l),r=Math.sin(m+R)*l,u=Math.sin(m+R)*(n?n/2-h:l),t.arc(i-d,s-r,h,m-C,m-E),t.arc(i+u,s-a,h,m-E,m),t.arc(i+d,s+r,h,m,m+E),t.arc(i-u,s+a,h,m+E,m+C),t.closePath();break;case"rect":if(!g){l=Math.SQRT1_2*p,c=n?n/2:l,t.rect(i-c,s-l,2*c,2*l);break}m+=R;case"rectRot":d=Math.cos(m)*(n?n/2:p),a=Math.cos(m)*p,r=Math.sin(m)*p,u=Math.sin(m)*(n?n/2:p),t.moveTo(i-d,s-r),t.lineTo(i+u,s-a),t.lineTo(i+d,s+r),t.lineTo(i-u,s+a),t.closePath();break;case"crossRot":m+=R;case"cross":d=Math.cos(m)*(n?n/2:p),a=Math.cos(m)*p,r=Math.sin(m)*p,u=Math.sin(m)*(n?n/2:p),t.moveTo(i-d,s-r),t.lineTo(i+d,s+r),t.moveTo(i+u,s-a),t.lineTo(i-u,s+a);break;case"star":d=Math.cos(m)*(n?n/2:p),a=Math.cos(m)*p,r=Math.sin(m)*p,u=Math.sin(m)*(n?n/2:p),t.moveTo(i-d,s-r),t.lineTo(i+d,s+r),t.moveTo(i+u,s-a),t.lineTo(i-u,s+a),m+=R,d=Math.cos(m)*(n?n/2:p),a=Math.cos(m)*p,r=Math.sin(m)*p,u=Math.sin(m)*(n?n/2:p),t.moveTo(i-d,s-r),t.lineTo(i+d,s+r),t.moveTo(i+u,s-a),t.lineTo(i-u,s+a);break;case"line":a=n?n/2:Math.cos(m)*p,r=Math.sin(m)*p,t.moveTo(i-a,s-r),t.lineTo(i+a,s+r);break;case"dash":t.moveTo(i,s),t.lineTo(i+Math.cos(m)*(n?n/2:p),s+Math.sin(m)*p);break;case!1:t.closePath()}t.fill(),e.borderWidth>0&&t.stroke()}}function Re(t,e,i){return i=i||.5,!e||t&&t.x>e.left-i&&t.x<e.right+i&&t.y>e.top-i&&t.y<e.bottom+i}function Ie(t,e){t.save(),t.beginPath(),t.rect(e.left,e.top,e.right-e.left,e.bottom-e.top),t.clip()}function ze(t){t.restore()}function Fe(t,e,i,s,n){if(!e)return t.lineTo(i.x,i.y);if("middle"===n){const s=(e.x+i.x)/2;t.lineTo(s,e.y),t.lineTo(s,i.y)}else"after"===n!=!!s?t.lineTo(e.x,i.y):t.lineTo(i.x,e.y);t.lineTo(i.x,i.y)}function Ve(t,e,i,s){if(!e)return t.lineTo(i.x,i.y);t.bezierCurveTo(s?e.cp1x:e.cp2x,s?e.cp1y:e.cp2y,s?i.cp2x:i.cp1x,s?i.cp2y:i.cp1y,i.x,i.y)}function Be(t,e,i,s,n){if(n.strikethrough||n.underline){const o=t.measureText(s),a=e-o.actualBoundingBoxLeft,r=e+o.actualBoundingBoxRight,l=i-o.actualBoundingBoxAscent,h=i+o.actualBoundingBoxDescent,c=n.strikethrough?(l+h)/2:h;t.strokeStyle=t.fillStyle,t.beginPath(),t.lineWidth=n.decorationWidth||2,t.moveTo(a,c),t.lineTo(r,c),t.stroke()}}function We(t,e){const i=t.fillStyle;t.fillStyle=e.color,t.fillRect(e.left,e.top,e.width,e.height),t.fillStyle=i}function Ne(t,e,i,o,a,r={}){const l=n(e)?e:[e],h=r.strokeWidth>0&&""!==r.strokeColor;let c,d;for(t.save(),t.font=a.string,function(t,e){e.translation&&t.translate(e.translation[0],e.translation[1]),s(e.rotation)||t.rotate(e.rotation),e.color&&(t.fillStyle=e.color),e.textAlign&&(t.textAlign=e.textAlign),e.textBaseline&&(t.textBaseline=e.textBaseline)}(t,r),c=0;c<l.length;++c)d=l[c],r.backdrop&&We(t,r.backdrop),h&&(r.strokeColor&&(t.strokeStyle=r.strokeColor),s(r.strokeWidth)||(t.lineWidth=r.strokeWidth),t.strokeText(d,i,o,r.maxWidth)),t.fillText(d,i,o,r.maxWidth),Be(t,i,o,d,r),o+=Number(a.lineHeight);t.restore()}function He(t,e){const{x:i,y:s,w:n,h:o,radius:a}=e;t.arc(i+a.topLeft,s+a.topLeft,a.topLeft,1.5*C,C,!0),t.lineTo(i,s+o-a.bottomLeft),t.arc(i+a.bottomLeft,s+o-a.bottomLeft,a.bottomLeft,C,E,!0),t.lineTo(i+n-a.bottomRight,s+o),t.arc(i+n-a.bottomRight,s+o-a.bottomRight,a.bottomRight,E,0,!0),t.lineTo(i+n,s+a.topRight),t.arc(i+n-a.topRight,s+a.topRight,a.topRight,0,-E,!0),t.lineTo(i+a.topLeft,s)}function je(t,e=[""],i,s,n=(()=>t[0])){const o=i||t;void 0===s&&(s=ti("_fallback",t));const a={[Symbol.toStringTag]:"Object",_cacheable:!0,_scopes:t,_rootScopes:o,_fallback:s,_getTarget:n,override:i=>je([i,...t],e,o,s)};return new Proxy(a,{deleteProperty:(e,i)=>(delete e[i],delete e._keys,delete t[0][i],!0),get:(i,s)=>qe(i,s,(()=>function(t,e,i,s){let n;for(const o of e)if(n=ti(Ue(o,t),i),void 0!==n)return Xe(t,n)?Ze(i,s,t,n):n}(s,e,t,i))),getOwnPropertyDescriptor:(t,e)=>Reflect.getOwnPropertyDescriptor(t._scopes[0],e),getPrototypeOf:()=>Reflect.getPrototypeOf(t[0]),has:(t,e)=>ei(t).includes(e),ownKeys:t=>ei(t),set(t,e,i){const s=t._storage||(t._storage=n());return t[e]=s[e]=i,delete t._keys,!0}})}function $e(t,e,i,s){const a={_cacheable:!1,_proxy:t,_context:e,_subProxy:i,_stack:new Set,_descriptors:Ye(t,s),setContext:e=>$e(t,e,i,s),override:n=>$e(t.override(n),e,i,s)};return new Proxy(a,{deleteProperty:(e,i)=>(delete e[i],delete t[i],!0),get:(t,e,i)=>qe(t,e,(()=>function(t,e,i){const{_proxy:s,_context:a,_subProxy:r,_descriptors:l}=t;let h=s[e];S(h)&&l.isScriptable(e)&&(h=function(t,e,i,s){const{_proxy:n,_context:o,_subProxy:a,_stack:r}=i;if(r.has(t))throw new Error("Recursion detected: "+Array.from(r).join("->")+"->"+t);r.add(t);let l=e(o,a||s);r.delete(t),Xe(t,l)&&(l=Ze(n._scopes,n,t,l));return l}(e,h,t,i));n(h)&&h.length&&(h=function(t,e,i,s){const{_proxy:n,_context:a,_subProxy:r,_descriptors:l}=i;if(void 0!==a.index&&s(t))return e[a.index%e.length];if(o(e[0])){const i=e,s=n._scopes.filter((t=>t!==i));e=[];for(const o of i){const i=Ze(s,n,t,o);e.push($e(i,a,r&&r[t],l))}}return e}(e,h,t,l.isIndexable));Xe(e,h)&&(h=$e(h,a,r&&r[e],l));return h}(t,e,i))),getOwnPropertyDescriptor:(e,i)=>e._descriptors.allKeys?Reflect.has(t,i)?{enumerable:!0,configurable:!0}:void 0:Reflect.getOwnPropertyDescriptor(t,i),getPrototypeOf:()=>Reflect.getPrototypeOf(t),has:(e,i)=>Reflect.has(t,i),ownKeys:()=>Reflect.ownKeys(t),set:(e,i,s)=>(t[i]=s,delete e[i],!0)})}function Ye(t,e={scriptable:!0,indexable:!0}){const{_scriptable:i=e.scriptable,_indexable:s=e.indexable,_allKeys:n=e.allKeys}=t;return{allKeys:n,scriptable:i,indexable:s,isScriptable:S(i)?i:()=>i,isIndexable:S(s)?s:()=>s}}const Ue=(t,e)=>t?t+w(e):e,Xe=(t,e)=>o(e)&&"adapters"!==t&&(null===Object.getPrototypeOf(e)||e.constructor===Object);function qe(t,e,i){if(Object.prototype.hasOwnProperty.call(t,e)||"constructor"===e)return t[e];const s=i();return t[e]=s,s}function Ke(t,e,i){return S(t)?t(e,i):t}const Ge=(t,e)=>!0===t?e:"string"==typeof t?M(e,t):void 0;function Je(t,e,i,s,n){for(const o of e){const e=Ge(i,o);if(e){t.add(e);const o=Ke(e._fallback,i,n);if(void 0!==o&&o!==i&&o!==s)return o}else if(!1===e&&void 0!==s&&i!==s)return null}return!1}function Ze(t,e,i,s){const a=e._rootScopes,r=Ke(e._fallback,i,s),l=[...t,...a],h=new Set;h.add(s);let c=Qe(h,l,i,r||i,s);return null!==c&&((void 0===r||r===i||(c=Qe(h,l,r,c,s),null!==c))&&je(Array.from(h),[""],a,r,(()=>function(t,e,i){const s=t._getTarget();e in s||(s[e]={});const a=s[e];if(n(a)&&o(i))return i;return a||{}}(e,i,s))))}function Qe(t,e,i,s,n){for(;i;)i=Je(t,e,i,s,n);return i}function ti(t,e){for(const i of e){if(!i)continue;const e=i[t];if(void 0!==e)return e}}function ei(t){let e=t._keys;return e||(e=t._keys=function(t){const e=new Set;for(const i of t)for(const t of Object.keys(i).filter((t=>!t.startsWith("_"))))e.add(t);return Array.from(e)}(t._scopes)),e}function ii(t,e,i,s){const{iScale:n}=t,{key:o="r"}=this._parsing,a=new Array(s);let r,l,h,c;for(r=0,l=s;r<l;++r)h=r+i,c=e[h],a[r]={r:n.parse(M(c,o),h)};return a}const si=Number.EPSILON||1e-14,ni=(t,e)=>e<t.length&&!t[e].skip&&t[e],oi=t=>"x"===t?"y":"x";function ai(t,e,i,s){const n=t.skip?e:t,o=e,a=i.skip?e:i,r=q(o,n),l=q(a,o);let h=r/(r+l),c=l/(r+l);h=isNaN(h)?0:h,c=isNaN(c)?0:c;const d=s*h,u=s*c;return{previous:{x:o.x-d*(a.x-n.x),y:o.y-d*(a.y-n.y)},next:{x:o.x+u*(a.x-n.x),y:o.y+u*(a.y-n.y)}}}function ri(t,e="x"){const i=oi(e),s=t.length,n=Array(s).fill(0),o=Array(s);let a,r,l,h=ni(t,0);for(a=0;a<s;++a)if(r=l,l=h,h=ni(t,a+1),l){if(h){const t=h[e]-l[e];n[a]=0!==t?(h[i]-l[i])/t:0}o[a]=r?h?F(n[a-1])!==F(n[a])?0:(n[a-1]+n[a])/2:n[a-1]:n[a]}!function(t,e,i){const s=t.length;let n,o,a,r,l,h=ni(t,0);for(let c=0;c<s-1;++c)l=h,h=ni(t,c+1),l&&h&&(V(e[c],0,si)?i[c]=i[c+1]=0:(n=i[c]/e[c],o=i[c+1]/e[c],r=Math.pow(n,2)+Math.pow(o,2),r<=9||(a=3/Math.sqrt(r),i[c]=n*a*e[c],i[c+1]=o*a*e[c])))}(t,n,o),function(t,e,i="x"){const s=oi(i),n=t.length;let o,a,r,l=ni(t,0);for(let h=0;h<n;++h){if(a=r,r=l,l=ni(t,h+1),!r)continue;const n=r[i],c=r[s];a&&(o=(n-a[i])/3,r[`cp1${i}`]=n-o,r[`cp1${s}`]=c-o*e[h]),l&&(o=(l[i]-n)/3,r[`cp2${i}`]=n+o,r[`cp2${s}`]=c+o*e[h])}}(t,o,e)}function li(t,e,i){return Math.max(Math.min(t,i),e)}function hi(t,e,i,s,n){let o,a,r,l;if(e.spanGaps&&(t=t.filter((t=>!t.skip))),"monotone"===e.cubicInterpolationMode)ri(t,n);else{let i=s?t[t.length-1]:t[0];for(o=0,a=t.length;o<a;++o)r=t[o],l=ai(i,r,t[Math.min(o+1,a-(s?0:1))%a],e.tension),r.cp1x=l.previous.x,r.cp1y=l.previous.y,r.cp2x=l.next.x,r.cp2y=l.next.y,i=r}e.capBezierPoints&&function(t,e){let i,s,n,o,a,r=Re(t[0],e);for(i=0,s=t.length;i<s;++i)a=o,o=r,r=i<s-1&&Re(t[i+1],e),o&&(n=t[i],a&&(n.cp1x=li(n.cp1x,e.left,e.right),n.cp1y=li(n.cp1y,e.top,e.bottom)),r&&(n.cp2x=li(n.cp2x,e.left,e.right),n.cp2y=li(n.cp2y,e.top,e.bottom)))}(t,i)}const ci=t=>0===t||1===t,di=(t,e,i)=>-Math.pow(2,10*(t-=1))*Math.sin((t-e)*O/i),ui=(t,e,i)=>Math.pow(2,-10*t)*Math.sin((t-e)*O/i)+1,fi={linear:t=>t,easeInQuad:t=>t*t,easeOutQuad:t=>-t*(t-2),easeInOutQuad:t=>(t/=.5)<1?.5*t*t:-.5*(--t*(t-2)-1),easeInCubic:t=>t*t*t,easeOutCubic:t=>(t-=1)*t*t+1,easeInOutCubic:t=>(t/=.5)<1?.5*t*t*t:.5*((t-=2)*t*t+2),easeInQuart:t=>t*t*t*t,easeOutQuart:t=>-((t-=1)*t*t*t-1),easeInOutQuart:t=>(t/=.5)<1?.5*t*t*t*t:-.5*((t-=2)*t*t*t-2),easeInQuint:t=>t*t*t*t*t,easeOutQuint:t=>(t-=1)*t*t*t*t+1,easeInOutQuint:t=>(t/=.5)<1?.5*t*t*t*t*t:.5*((t-=2)*t*t*t*t+2),easeInSine:t=>1-Math.cos(t*E),easeOutSine:t=>Math.sin(t*E),easeInOutSine:t=>-.5*(Math.cos(C*t)-1),easeInExpo:t=>0===t?0:Math.pow(2,10*(t-1)),easeOutExpo:t=>1===t?1:1-Math.pow(2,-10*t),easeInOutExpo:t=>ci(t)?t:t<.5?.5*Math.pow(2,10*(2*t-1)):.5*(2-Math.pow(2,-10*(2*t-1))),easeInCirc:t=>t>=1?t:-(Math.sqrt(1-t*t)-1),easeOutCirc:t=>Math.sqrt(1-(t-=1)*t),easeInOutCirc:t=>(t/=.5)<1?-.5*(Math.sqrt(1-t*t)-1):.5*(Math.sqrt(1-(t-=2)*t)+1),easeInElastic:t=>ci(t)?t:di(t,.075,.3),easeOutElastic:t=>ci(t)?t:ui(t,.075,.3),easeInOutElastic(t){const e=.1125;return ci(t)?t:t<.5?.5*di(2*t,e,.45):.5+.5*ui(2*t-1,e,.45)},easeInBack(t){const e=1.70158;return t*t*((e+1)*t-e)},easeOutBack(t){const e=1.70158;return(t-=1)*t*((e+1)*t+e)+1},easeInOutBack(t){let e=1.70158;return(t/=.5)<1?t*t*((1+(e*=1.525))*t-e)*.5:.5*((t-=2)*t*((1+(e*=1.525))*t+e)+2)},easeInBounce:t=>1-fi.easeOutBounce(1-t),easeOutBounce(t){const e=7.5625,i=2.75;return t<1/i?e*t*t:t<2/i?e*(t-=1.5/i)*t+.75:t<2.5/i?e*(t-=2.25/i)*t+.9375:e*(t-=2.625/i)*t+.984375},easeInOutBounce:t=>t<.5?.5*fi.easeInBounce(2*t):.5*fi.easeOutBounce(2*t-1)+.5};function gi(t,e,i,s){return{x:t.x+i*(e.x-t.x),y:t.y+i*(e.y-t.y)}}function pi(t,e,i,s){return{x:t.x+i*(e.x-t.x),y:"middle"===s?i<.5?t.y:e.y:"after"===s?i<1?t.y:e.y:i>0?e.y:t.y}}function mi(t,e,i,s){const n={x:t.cp2x,y:t.cp2y},o={x:e.cp1x,y:e.cp1y},a=gi(t,n,i),r=gi(n,o,i),l=gi(o,e,i),h=gi(a,r,i),c=gi(r,l,i);return gi(h,c,i)}const xi=/^(normal|(\d+(?:\.\d+)?)(px|em|%)?)$/,bi=/^(normal|italic|initial|inherit|unset|(oblique( -?[0-9]?[0-9]deg)?))$/;function _i(t,e){const i=(""+t).match(xi);if(!i||"normal"===i[1])return 1.2*e;switch(t=+i[2],i[3]){case"px":return t;case"%":t/=100}return e*t}const yi=t=>+t||0;function vi(t,e){const i={},s=o(e),n=s?Object.keys(e):e,a=o(t)?s?i=>l(t[i],t[e[i]]):e=>t[e]:()=>t;for(const t of n)i[t]=yi(a(t));return i}function Mi(t){return vi(t,{top:"y",right:"x",bottom:"y",left:"x"})}function wi(t){return vi(t,["topLeft","topRight","bottomLeft","bottomRight"])}function ki(t){const e=Mi(t);return e.width=e.left+e.right,e.height=e.top+e.bottom,e}function Si(t,e){t=t||{},e=e||ue.font;let i=l(t.size,e.size);"string"==typeof i&&(i=parseInt(i,10));let s=l(t.style,e.style);s&&!(""+s).match(bi)&&(console.warn('Invalid font style specified: "'+s+'"'),s=void 0);const n={family:l(t.family,e.family),lineHeight:_i(l(t.lineHeight,e.lineHeight),i),size:i,style:s,weight:l(t.weight,e.weight),string:""};return n.string=De(n),n}function Pi(t,e,i,s){let o,a,r,l=!0;for(o=0,a=t.length;o<a;++o)if(r=t[o],void 0!==r&&(void 0!==e&&"function"==typeof r&&(r=r(e),l=!1),void 0!==i&&n(r)&&(r=r[i%r.length],l=!1),void 0!==r))return s&&!l&&(s.cacheable=!1),r}function Di(t,e,i){const{min:s,max:n}=t,o=c(e,(n-s)/2),a=(t,e)=>i&&0===t?0:t+e;return{min:a(s,-Math.abs(o)),max:a(n,o)}}function Ci(t,e){return Object.assign(Object.create(t),e)}function Oi(t,e,i){return t?function(t,e){return{x:i=>t+t+e-i,setWidth(t){e=t},textAlign:t=>"center"===t?t:"right"===t?"left":"right",xPlus:(t,e)=>t-e,leftForLtr:(t,e)=>t-e}}(e,i):{x:t=>t,setWidth(t){},textAlign:t=>t,xPlus:(t,e)=>t+e,leftForLtr:(t,e)=>t}}function Ai(t,e){let i,s;"ltr"!==e&&"rtl"!==e||(i=t.canvas.style,s=[i.getPropertyValue("direction"),i.getPropertyPriority("direction")],i.setProperty("direction",e,"important"),t.prevTextDirection=s)}function Ti(t,e){void 0!==e&&(delete t.prevTextDirection,t.canvas.style.setProperty("direction",e[0],e[1]))}function Li(t){return"angle"===t?{between:J,compare:K,normalize:G}:{between:tt,compare:(t,e)=>t-e,normalize:t=>t}}function Ei({start:t,end:e,count:i,loop:s,style:n}){return{start:t%i,end:e%i,loop:s&&(e-t+1)%i==0,style:n}}function Ri(t,e,i){if(!i)return[t];const{property:s,start:n,end:o}=i,a=e.length,{compare:r,between:l,normalize:h}=Li(s),{start:c,end:d,loop:u,style:f}=function(t,e,i){const{property:s,start:n,end:o}=i,{between:a,normalize:r}=Li(s),l=e.length;let h,c,{start:d,end:u,loop:f}=t;if(f){for(d+=l,u+=l,h=0,c=l;h<c&&a(r(e[d%l][s]),n,o);++h)d--,u--;d%=l,u%=l}return u<d&&(u+=l),{start:d,end:u,loop:f,style:t.style}}(t,e,i),g=[];let p,m,x,b=!1,_=null;const y=()=>b||l(n,x,p)&&0!==r(n,x),v=()=>!b||0===r(o,p)||l(o,x,p);for(let t=c,i=c;t<=d;++t)m=e[t%a],m.skip||(p=h(m[s]),p!==x&&(b=l(p,n,o),null===_&&y()&&(_=0===r(p,n)?t:i),null!==_&&v()&&(g.push(Ei({start:_,end:t,loop:u,count:a,style:f})),_=null),i=t,x=p));return null!==_&&g.push(Ei({start:_,end:d,loop:u,count:a,style:f})),g}function Ii(t,e){const i=[],s=t.segments;for(let n=0;n<s.length;n++){const o=Ri(s[n],t.points,e);o.length&&i.push(...o)}return i}function zi(t,e){const i=t.points,s=t.options.spanGaps,n=i.length;if(!n)return[];const o=!!t._loop,{start:a,end:r}=function(t,e,i,s){let n=0,o=e-1;if(i&&!s)for(;n<e&&!t[n].skip;)n++;for(;n<e&&t[n].skip;)n++;for(n%=e,i&&(o+=n);o>n&&t[o%e].skip;)o--;return o%=e,{start:n,end:o}}(i,n,o,s);if(!0===s)return Fi(t,[{start:a,end:r,loop:o}],i,e);return Fi(t,function(t,e,i,s){const n=t.length,o=[];let a,r=e,l=t[e];for(a=e+1;a<=i;++a){const i=t[a%n];i.skip||i.stop?l.skip||(s=!1,o.push({start:e%n,end:(a-1)%n,loop:s}),e=r=i.stop?a:null):(r=a,l.skip&&(e=a)),l=i}return null!==r&&o.push({start:e%n,end:r%n,loop:s}),o}(i,a,r<a?r+n:r,!!t._fullLoop&&0===a&&r===n-1),i,e)}function Fi(t,e,i,s){return s&&s.setContext&&i?function(t,e,i,s){const n=t._chart.getContext(),o=Vi(t.options),{_datasetIndex:a,options:{spanGaps:r}}=t,l=i.length,h=[];let c=o,d=e[0].start,u=d;function f(t,e,s,n){const o=r?-1:1;if(t!==e){for(t+=l;i[t%l].skip;)t-=o;for(;i[e%l].skip;)e+=o;t%l!=e%l&&(h.push({start:t%l,end:e%l,loop:s,style:n}),c=n,d=e%l)}}for(const t of e){d=r?d:t.start;let e,o=i[d%l];for(u=d+1;u<=t.end;u++){const r=i[u%l];e=Vi(s.setContext(Ci(n,{type:"segment",p0:o,p1:r,p0DataIndex:(u-1)%l,p1DataIndex:u%l,datasetIndex:a}))),Bi(e,c)&&f(d,u-1,t.loop,c),o=r,c=e}d<u-1&&f(d,u-1,t.loop,c)}return h}(t,e,i,s):e}function Vi(t){return{backgroundColor:t.backgroundColor,borderCapStyle:t.borderCapStyle,borderDash:t.borderDash,borderDashOffset:t.borderDashOffset,borderJoinStyle:t.borderJoinStyle,borderWidth:t.borderWidth,borderColor:t.borderColor}}function Bi(t,e){if(!e)return!1;const i=[],s=function(t,e){return Zt(e)?(i.includes(e)||i.push(e),i.indexOf(e)):e};return JSON.stringify(t,s)!==JSON.stringify(e,s)}function Wi(t,e,i){return t.options.clip?t[i]:e[i]}function Ni(t,e){const i=e._clip;if(i.disabled)return!1;const s=function(t,e){const{xScale:i,yScale:s}=t;return i&&s?{left:Wi(i,e,"left"),right:Wi(i,e,"right"),top:Wi(s,e,"top"),bottom:Wi(s,e,"bottom")}:e}(e,t.chartArea);return{left:!1===i.left?0:s.left-(!0===i.left?0:i.left),right:!1===i.right?t.width:s.right+(!0===i.right?0:i.right),top:!1===i.top?0:s.top-(!0===i.top?0:i.top),bottom:!1===i.bottom?t.height:s.bottom+(!0===i.bottom?0:i.bottom)}}var Hi=Object.freeze({__proto__:null,HALF_PI:E,INFINITY:T,PI:C,PITAU:A,QUARTER_PI:R,RAD_PER_DEG:L,TAU:O,TWO_THIRDS_PI:I,_addGrace:Di,_alignPixel:Ae,_alignStartEnd:ft,_angleBetween:J,_angleDiff:K,_arrayUnique:lt,_attachContext:$e,_bezierCurveTo:Ve,_bezierInterpolation:mi,_boundSegment:Ri,_boundSegments:Ii,_capitalize:w,_computeSegments:zi,_createResolver:je,_decimalPlaces:U,_deprecated:function(t,e,i,s){void 0!==e&&console.warn(t+': "'+i+'" is deprecated. Please use "'+s+'" instead')},_descriptors:Ye,_elementsEqual:f,_factorize:W,_filterBetween:nt,_getParentNode:ge,_getStartAndCountOfVisiblePoints:pt,_int16Range:Q,_isBetween:tt,_isClickEvent:D,_isDomSupported:fe,_isPointInArea:Re,_limitValue:Z,_longestText:Oe,_lookup:et,_lookupByKey:it,_measureText:Ce,_merger:m,_mergerIf:_,_normalizeAngle:G,_parseObjectDataRadialScale:ii,_pointInLine:gi,_readValueToProps:vi,_rlookupByKey:st,_scaleRangesChanged:mt,_setMinAndMaxByKey:j,_splitKey:v,_steppedInterpolation:pi,_steppedLineTo:Fe,_textX:gt,_toLeftRightCenter:ut,_updateBezierControlPoints:hi,addRoundedRectPath:He,almostEquals:V,almostWhole:H,callback:d,clearCanvas:Te,clipArea:Ie,clone:g,color:Qt,createContext:Ci,debounce:dt,defined:k,distanceBetweenPoints:q,drawPoint:Le,drawPointLegend:Ee,each:u,easingEffects:fi,finiteOrDefault:r,fontString:function(t,e,i){return e+" "+t+"px "+i},formatNumber:ne,getAngleFromPoint:X,getDatasetClipArea:Ni,getHoverColor:te,getMaximumSize:we,getRelativePosition:ve,getRtlAdapter:Oi,getStyle:xe,isArray:n,isFinite:a,isFunction:S,isNullOrUndef:s,isNumber:N,isObject:o,isPatternOrGradient:Zt,listenArrayEvents:at,log10:z,merge:x,mergeIf:b,niceNum:B,noop:e,overrideTextDirection:Ai,readUsedSize:Pe,renderText:Ne,requestAnimFrame:ht,resolve:Pi,resolveObjectKey:M,restoreTextDirection:Ti,retinaScale:ke,setsEqual:P,sign:F,splineCurve:ai,splineCurveMonotone:ri,supportsEventListenerOptions:Se,throttled:ct,toDegrees:Y,toDimension:c,toFont:Si,toFontString:De,toLineHeight:_i,toPadding:ki,toPercentage:h,toRadians:$,toTRBL:Mi,toTRBLCorners:wi,uid:i,unclipArea:ze,unlistenArrayEvents:rt,valueOrDefault:l});function ji(t,e,i,n){const{controller:o,data:a,_sorted:r}=t,l=o._cachedMeta.iScale,h=t.dataset&&t.dataset.options?t.dataset.options.spanGaps:null;if(l&&e===l.axis&&"r"!==e&&r&&a.length){const r=l._reversePixels?st:it;if(!n){const n=r(a,e,i);if(h){const{vScale:e}=o._cachedMeta,{_parsed:i}=t,a=i.slice(0,n.lo+1).reverse().findIndex((t=>!s(t[e.axis])));n.lo-=Math.max(0,a);const r=i.slice(n.hi).findIndex((t=>!s(t[e.axis])));n.hi+=Math.max(0,r)}return n}if(o._sharedOptions){const t=a[0],s="function"==typeof t.getRange&&t.getRange(e);if(s){const t=r(a,e,i-s),n=r(a,e,i+s);return{lo:t.lo,hi:n.hi}}}}return{lo:0,hi:a.length-1}}function $i(t,e,i,s,n){const o=t.getSortedVisibleDatasetMetas(),a=i[e];for(let t=0,i=o.length;t<i;++t){const{index:i,data:r}=o[t],{lo:l,hi:h}=ji(o[t],e,a,n);for(let t=l;t<=h;++t){const e=r[t];e.skip||s(e,i,t)}}}function Yi(t,e,i,s,n){const o=[];if(!n&&!t.isPointInArea(e))return o;return $i(t,i,e,(function(i,a,r){(n||Re(i,t.chartArea,0))&&i.inRange(e.x,e.y,s)&&o.push({element:i,datasetIndex:a,index:r})}),!0),o}function Ui(t,e,i,s,n,o){let a=[];const r=function(t){const e=-1!==t.indexOf("x"),i=-1!==t.indexOf("y");return function(t,s){const n=e?Math.abs(t.x-s.x):0,o=i?Math.abs(t.y-s.y):0;return Math.sqrt(Math.pow(n,2)+Math.pow(o,2))}}(i);let l=Number.POSITIVE_INFINITY;return $i(t,i,e,(function(i,h,c){const d=i.inRange(e.x,e.y,n);if(s&&!d)return;const u=i.getCenterPoint(n);if(!(!!o||t.isPointInArea(u))&&!d)return;const f=r(e,u);f<l?(a=[{element:i,datasetIndex:h,index:c}],l=f):f===l&&a.push({element:i,datasetIndex:h,index:c})})),a}function Xi(t,e,i,s,n,o){return o||t.isPointInArea(e)?"r"!==i||s?Ui(t,e,i,s,n,o):function(t,e,i,s){let n=[];return $i(t,i,e,(function(t,i,o){const{startAngle:a,endAngle:r}=t.getProps(["startAngle","endAngle"],s),{angle:l}=X(t,{x:e.x,y:e.y});J(l,a,r)&&n.push({element:t,datasetIndex:i,index:o})})),n}(t,e,i,n):[]}function qi(t,e,i,s,n){const o=[],a="x"===i?"inXRange":"inYRange";let r=!1;return $i(t,i,e,((t,s,l)=>{t[a]&&t[a](e[i],n)&&(o.push({element:t,datasetIndex:s,index:l}),r=r||t.inRange(e.x,e.y,n))})),s&&!r?[]:o}var Ki={evaluateInteractionItems:$i,modes:{index(t,e,i,s){const n=ve(e,t),o=i.axis||"x",a=i.includeInvisible||!1,r=i.intersect?Yi(t,n,o,s,a):Xi(t,n,o,!1,s,a),l=[];return r.length?(t.getSortedVisibleDatasetMetas().forEach((t=>{const e=r[0].index,i=t.data[e];i&&!i.skip&&l.push({element:i,datasetIndex:t.index,index:e})})),l):[]},dataset(t,e,i,s){const n=ve(e,t),o=i.axis||"xy",a=i.includeInvisible||!1;let r=i.intersect?Yi(t,n,o,s,a):Xi(t,n,o,!1,s,a);if(r.length>0){const e=r[0].datasetIndex,i=t.getDatasetMeta(e).data;r=[];for(let t=0;t<i.length;++t)r.push({element:i[t],datasetIndex:e,index:t})}return r},point:(t,e,i,s)=>Yi(t,ve(e,t),i.axis||"xy",s,i.includeInvisible||!1),nearest(t,e,i,s){const n=ve(e,t),o=i.axis||"xy",a=i.includeInvisible||!1;return Xi(t,n,o,i.intersect,s,a)},x:(t,e,i,s)=>qi(t,ve(e,t),"x",i.intersect,s),y:(t,e,i,s)=>qi(t,ve(e,t),"y",i.intersect,s)}};const Gi=["left","top","right","bottom"];function Ji(t,e){return t.filter((t=>t.pos===e))}function Zi(t,e){return t.filter((t=>-1===Gi.indexOf(t.pos)&&t.box.axis===e))}function Qi(t,e){return t.sort(((t,i)=>{const s=e?i:t,n=e?t:i;return s.weight===n.weight?s.index-n.index:s.weight-n.weight}))}function ts(t,e){const i=function(t){const e={};for(const i of t){const{stack:t,pos:s,stackWeight:n}=i;if(!t||!Gi.includes(s))continue;const o=e[t]||(e[t]={count:0,placed:0,weight:0,size:0});o.count++,o.weight+=n}return e}(t),{vBoxMaxWidth:s,hBoxMaxHeight:n}=e;let o,a,r;for(o=0,a=t.length;o<a;++o){r=t[o];const{fullSize:a}=r.box,l=i[r.stack],h=l&&r.stackWeight/l.weight;r.horizontal?(r.width=h?h*s:a&&e.availableWidth,r.height=n):(r.width=s,r.height=h?h*n:a&&e.availableHeight)}return i}function es(t,e,i,s){return Math.max(t[i],e[i])+Math.max(t[s],e[s])}function is(t,e){t.top=Math.max(t.top,e.top),t.left=Math.max(t.left,e.left),t.bottom=Math.max(t.bottom,e.bottom),t.right=Math.max(t.right,e.right)}function ss(t,e,i,s){const{pos:n,box:a}=i,r=t.maxPadding;if(!o(n)){i.size&&(t[n]-=i.size);const e=s[i.stack]||{size:0,count:1};e.size=Math.max(e.size,i.horizontal?a.height:a.width),i.size=e.size/e.count,t[n]+=i.size}a.getPadding&&is(r,a.getPadding());const l=Math.max(0,e.outerWidth-es(r,t,"left","right")),h=Math.max(0,e.outerHeight-es(r,t,"top","bottom")),c=l!==t.w,d=h!==t.h;return t.w=l,t.h=h,i.horizontal?{same:c,other:d}:{same:d,other:c}}function ns(t,e){const i=e.maxPadding;function s(t){const s={left:0,top:0,right:0,bottom:0};return t.forEach((t=>{s[t]=Math.max(e[t],i[t])})),s}return s(t?["left","right"]:["top","bottom"])}function os(t,e,i,s){const n=[];let o,a,r,l,h,c;for(o=0,a=t.length,h=0;o<a;++o){r=t[o],l=r.box,l.update(r.width||e.w,r.height||e.h,ns(r.horizontal,e));const{same:a,other:d}=ss(e,i,r,s);h|=a&&n.length,c=c||d,l.fullSize||n.push(r)}return h&&os(n,e,i,s)||c}function as(t,e,i,s,n){t.top=i,t.left=e,t.right=e+s,t.bottom=i+n,t.width=s,t.height=n}function rs(t,e,i,s){const n=i.padding;let{x:o,y:a}=e;for(const r of t){const t=r.box,l=s[r.stack]||{count:1,placed:0,weight:1},h=r.stackWeight/l.weight||1;if(r.horizontal){const s=e.w*h,o=l.size||t.height;k(l.start)&&(a=l.start),t.fullSize?as(t,n.left,a,i.outerWidth-n.right-n.left,o):as(t,e.left+l.placed,a,s,o),l.start=a,l.placed+=s,a=t.bottom}else{const s=e.h*h,a=l.size||t.width;k(l.start)&&(o=l.start),t.fullSize?as(t,o,n.top,a,i.outerHeight-n.bottom-n.top):as(t,o,e.top+l.placed,a,s),l.start=o,l.placed+=s,o=t.right}}e.x=o,e.y=a}var ls={addBox(t,e){t.boxes||(t.boxes=[]),e.fullSize=e.fullSize||!1,e.position=e.position||"top",e.weight=e.weight||0,e._layers=e._layers||function(){return[{z:0,draw(t){e.draw(t)}}]},t.boxes.push(e)},removeBox(t,e){const i=t.boxes?t.boxes.indexOf(e):-1;-1!==i&&t.boxes.splice(i,1)},configure(t,e,i){e.fullSize=i.fullSize,e.position=i.position,e.weight=i.weight},update(t,e,i,s){if(!t)return;const n=ki(t.options.layout.padding),o=Math.max(e-n.width,0),a=Math.max(i-n.height,0),r=function(t){const e=function(t){const e=[];let i,s,n,o,a,r;for(i=0,s=(t||[]).length;i<s;++i)n=t[i],({position:o,options:{stack:a,stackWeight:r=1}}=n),e.push({index:i,box:n,pos:o,horizontal:n.isHorizontal(),weight:n.weight,stack:a&&o+a,stackWeight:r});return e}(t),i=Qi(e.filter((t=>t.box.fullSize)),!0),s=Qi(Ji(e,"left"),!0),n=Qi(Ji(e,"right")),o=Qi(Ji(e,"top"),!0),a=Qi(Ji(e,"bottom")),r=Zi(e,"x"),l=Zi(e,"y");return{fullSize:i,leftAndTop:s.concat(o),rightAndBottom:n.concat(l).concat(a).concat(r),chartArea:Ji(e,"chartArea"),vertical:s.concat(n).concat(l),horizontal:o.concat(a).concat(r)}}(t.boxes),l=r.vertical,h=r.horizontal;u(t.boxes,(t=>{"function"==typeof t.beforeLayout&&t.beforeLayout()}));const c=l.reduce(((t,e)=>e.box.options&&!1===e.box.options.display?t:t+1),0)||1,d=Object.freeze({outerWidth:e,outerHeight:i,padding:n,availableWidth:o,availableHeight:a,vBoxMaxWidth:o/2/c,hBoxMaxHeight:a/2}),f=Object.assign({},n);is(f,ki(s));const g=Object.assign({maxPadding:f,w:o,h:a,x:n.left,y:n.top},n),p=ts(l.concat(h),d);os(r.fullSize,g,d,p),os(l,g,d,p),os(h,g,d,p)&&os(l,g,d,p),function(t){const e=t.maxPadding;function i(i){const s=Math.max(e[i]-t[i],0);return t[i]+=s,s}t.y+=i("top"),t.x+=i("left"),i("right"),i("bottom")}(g),rs(r.leftAndTop,g,d,p),g.x+=g.w,g.y+=g.h,rs(r.rightAndBottom,g,d,p),t.chartArea={left:g.left,top:g.top,right:g.left+g.w,bottom:g.top+g.h,height:g.h,width:g.w},u(r.chartArea,(e=>{const i=e.box;Object.assign(i,t.chartArea),i.update(g.w,g.h,{left:0,top:0,right:0,bottom:0})}))}};class hs{acquireContext(t,e){}releaseContext(t){return!1}addEventListener(t,e,i){}removeEventListener(t,e,i){}getDevicePixelRatio(){return 1}getMaximumSize(t,e,i,s){return e=Math.max(0,e||t.width),i=i||t.height,{width:e,height:Math.max(0,s?Math.floor(e/s):i)}}isAttached(t){return!0}updateConfig(t){}}class cs extends hs{acquireContext(t){return t&&t.getContext&&t.getContext("2d")||null}updateConfig(t){t.options.animation=!1}}const ds="$chartjs",us={touchstart:"mousedown",touchmove:"mousemove",touchend:"mouseup",pointerenter:"mouseenter",pointerdown:"mousedown",pointermove:"mousemove",pointerup:"mouseup",pointerleave:"mouseout",pointerout:"mouseout"},fs=t=>null===t||""===t;const gs=!!Se&&{passive:!0};function ps(t,e,i){t&&t.canvas&&t.canvas.removeEventListener(e,i,gs)}function ms(t,e){for(const i of t)if(i===e||i.contains(e))return!0}function xs(t,e,i){const s=t.canvas,n=new MutationObserver((t=>{let e=!1;for(const i of t)e=e||ms(i.addedNodes,s),e=e&&!ms(i.removedNodes,s);e&&i()}));return n.observe(document,{childList:!0,subtree:!0}),n}function bs(t,e,i){const s=t.canvas,n=new MutationObserver((t=>{let e=!1;for(const i of t)e=e||ms(i.removedNodes,s),e=e&&!ms(i.addedNodes,s);e&&i()}));return n.observe(document,{childList:!0,subtree:!0}),n}const _s=new Map;let ys=0;function vs(){const t=window.devicePixelRatio;t!==ys&&(ys=t,_s.forEach(((e,i)=>{i.currentDevicePixelRatio!==t&&e()})))}function Ms(t,e,i){const s=t.canvas,n=s&&ge(s);if(!n)return;const o=ct(((t,e)=>{const s=n.clientWidth;i(t,e),s<n.clientWidth&&i()}),window),a=new ResizeObserver((t=>{const e=t[0],i=e.contentRect.width,s=e.contentRect.height;0===i&&0===s||o(i,s)}));return a.observe(n),function(t,e){_s.size||window.addEventListener("resize",vs),_s.set(t,e)}(t,o),a}function ws(t,e,i){i&&i.disconnect(),"resize"===e&&function(t){_s.delete(t),_s.size||window.removeEventListener("resize",vs)}(t)}function ks(t,e,i){const s=t.canvas,n=ct((e=>{null!==t.ctx&&i(function(t,e){const i=us[t.type]||t.type,{x:s,y:n}=ve(t,e);return{type:i,chart:e,native:t,x:void 0!==s?s:null,y:void 0!==n?n:null}}(e,t))}),t);return function(t,e,i){t&&t.addEventListener(e,i,gs)}(s,e,n),n}class Ss extends hs{acquireContext(t,e){const i=t&&t.getContext&&t.getContext("2d");return i&&i.canvas===t?(function(t,e){const i=t.style,s=t.getAttribute("height"),n=t.getAttribute("width");if(t[ds]={initial:{height:s,width:n,style:{display:i.display,height:i.height,width:i.width}}},i.display=i.display||"block",i.boxSizing=i.boxSizing||"border-box",fs(n)){const e=Pe(t,"width");void 0!==e&&(t.width=e)}if(fs(s))if(""===t.style.height)t.height=t.width/(e||2);else{const e=Pe(t,"height");void 0!==e&&(t.height=e)}}(t,e),i):null}releaseContext(t){const e=t.canvas;if(!e[ds])return!1;const i=e[ds].initial;["height","width"].forEach((t=>{const n=i[t];s(n)?e.removeAttribute(t):e.setAttribute(t,n)}));const n=i.style||{};return Object.keys(n).forEach((t=>{e.style[t]=n[t]})),e.width=e.width,delete e[ds],!0}addEventListener(t,e,i){this.removeEventListener(t,e);const s=t.$proxies||(t.$proxies={}),n={attach:xs,detach:bs,resize:Ms}[e]||ks;s[e]=n(t,e,i)}removeEventListener(t,e){const i=t.$proxies||(t.$proxies={}),s=i[e];if(!s)return;({attach:ws,detach:ws,resize:ws}[e]||ps)(t,e,s),i[e]=void 0}getDevicePixelRatio(){return window.devicePixelRatio}getMaximumSize(t,e,i,s){return we(t,e,i,s)}isAttached(t){const e=t&&ge(t);return!(!e||!e.isConnected)}}function Ps(t){return!fe()||"undefined"!=typeof OffscreenCanvas&&t instanceof OffscreenCanvas?cs:Ss}var Ds=Object.freeze({__proto__:null,BasePlatform:hs,BasicPlatform:cs,DomPlatform:Ss,_detectPlatform:Ps});const Cs="transparent",Os={boolean:(t,e,i)=>i>.5?e:t,color(t,e,i){const s=Qt(t||Cs),n=s.valid&&Qt(e||Cs);return n&&n.valid?n.mix(s,i).hexString():e},number:(t,e,i)=>t+(e-t)*i};class As{constructor(t,e,i,s){const n=e[i];s=Pi([t.to,s,n,t.from]);const o=Pi([t.from,n,s]);this._active=!0,this._fn=t.fn||Os[t.type||typeof o],this._easing=fi[t.easing]||fi.linear,this._start=Math.floor(Date.now()+(t.delay||0)),this._duration=this._total=Math.floor(t.duration),this._loop=!!t.loop,this._target=e,this._prop=i,this._from=o,this._to=s,this._promises=void 0}active(){return this._active}update(t,e,i){if(this._active){this._notify(!1);const s=this._target[this._prop],n=i-this._start,o=this._duration-n;this._start=i,this._duration=Math.floor(Math.max(o,t.duration)),this._total+=n,this._loop=!!t.loop,this._to=Pi([t.to,e,s,t.from]),this._from=Pi([t.from,s,e])}}cancel(){this._active&&(this.tick(Date.now()),this._active=!1,this._notify(!1))}tick(t){const e=t-this._start,i=this._duration,s=this._prop,n=this._from,o=this._loop,a=this._to;let r;if(this._active=n!==a&&(o||e<i),!this._active)return this._target[s]=a,void this._notify(!0);e<0?this._target[s]=n:(r=e/i%2,r=o&&r>1?2-r:r,r=this._easing(Math.min(1,Math.max(0,r))),this._target[s]=this._fn(n,a,r))}wait(){const t=this._promises||(this._promises=[]);return new Promise(((e,i)=>{t.push({res:e,rej:i})}))}_notify(t){const e=t?"res":"rej",i=this._promises||[];for(let t=0;t<i.length;t++)i[t][e]()}}class Ts{constructor(t,e){this._chart=t,this._properties=new Map,this.configure(e)}configure(t){if(!o(t))return;const e=Object.keys(ue.animation),i=this._properties;Object.getOwnPropertyNames(t).forEach((s=>{const a=t[s];if(!o(a))return;const r={};for(const t of e)r[t]=a[t];(n(a.properties)&&a.properties||[s]).forEach((t=>{t!==s&&i.has(t)||i.set(t,r)}))}))}_animateOptions(t,e){const i=e.options,s=function(t,e){if(!e)return;let i=t.options;if(!i)return void(t.options=e);i.$shared&&(t.options=i=Object.assign({},i,{$shared:!1,$animations:{}}));return i}(t,i);if(!s)return[];const n=this._createAnimations(s,i);return i.$shared&&function(t,e){const i=[],s=Object.keys(e);for(let e=0;e<s.length;e++){const n=t[s[e]];n&&n.active()&&i.push(n.wait())}return Promise.all(i)}(t.options.$animations,i).then((()=>{t.options=i}),(()=>{})),n}_createAnimations(t,e){const i=this._properties,s=[],n=t.$animations||(t.$animations={}),o=Object.keys(e),a=Date.now();let r;for(r=o.length-1;r>=0;--r){const l=o[r];if("$"===l.charAt(0))continue;if("options"===l){s.push(...this._animateOptions(t,e));continue}const h=e[l];let c=n[l];const d=i.get(l);if(c){if(d&&c.active()){c.update(d,h,a);continue}c.cancel()}d&&d.duration?(n[l]=c=new As(d,t,l,h),s.push(c)):t[l]=h}return s}update(t,e){if(0===this._properties.size)return void Object.assign(t,e);const i=this._createAnimations(t,e);return i.length?(bt.add(this._chart,i),!0):void 0}}function Ls(t,e){const i=t&&t.options||{},s=i.reverse,n=void 0===i.min?e:0,o=void 0===i.max?e:0;return{start:s?o:n,end:s?n:o}}function Es(t,e){const i=[],s=t._getSortedDatasetMetas(e);let n,o;for(n=0,o=s.length;n<o;++n)i.push(s[n].index);return i}function Rs(t,e,i,s={}){const n=t.keys,o="single"===s.mode;let r,l,h,c;if(null===e)return;let d=!1;for(r=0,l=n.length;r<l;++r){if(h=+n[r],h===i){if(d=!0,s.all)continue;break}c=t.values[h],a(c)&&(o||0===e||F(e)===F(c))&&(e+=c)}return d||s.all?e:0}function Is(t,e){const i=t&&t.options.stacked;return i||void 0===i&&void 0!==e.stack}function zs(t,e,i){const s=t[e]||(t[e]={});return s[i]||(s[i]={})}function Fs(t,e,i,s){for(const n of e.getMatchingVisibleMetas(s).reverse()){const e=t[n.index];if(i&&e>0||!i&&e<0)return n.index}return null}function Vs(t,e){const{chart:i,_cachedMeta:s}=t,n=i._stacks||(i._stacks={}),{iScale:o,vScale:a,index:r}=s,l=o.axis,h=a.axis,c=function(t,e,i){return`${t.id}.${e.id}.${i.stack||i.type}`}(o,a,s),d=e.length;let u;for(let t=0;t<d;++t){const i=e[t],{[l]:o,[h]:d}=i;u=(i._stacks||(i._stacks={}))[h]=zs(n,c,o),u[r]=d,u._top=Fs(u,a,!0,s.type),u._bottom=Fs(u,a,!1,s.type);(u._visualValues||(u._visualValues={}))[r]=d}}function Bs(t,e){const i=t.scales;return Object.keys(i).filter((t=>i[t].axis===e)).shift()}function Ws(t,e){const i=t.controller.index,s=t.vScale&&t.vScale.axis;if(s){e=e||t._parsed;for(const t of e){const e=t._stacks;if(!e||void 0===e[s]||void 0===e[s][i])return;delete e[s][i],void 0!==e[s]._visualValues&&void 0!==e[s]._visualValues[i]&&delete e[s]._visualValues[i]}}}const Ns=t=>"reset"===t||"none"===t,Hs=(t,e)=>e?t:Object.assign({},t);class js{static defaults={};static datasetElementType=null;static dataElementType=null;constructor(t,e){this.chart=t,this._ctx=t.ctx,this.index=e,this._cachedDataOpts={},this._cachedMeta=this.getMeta(),this._type=this._cachedMeta.type,this.options=void 0,this._parsing=!1,this._data=void 0,this._objectData=void 0,this._sharedOptions=void 0,this._drawStart=void 0,this._drawCount=void 0,this.enableOptionSharing=!1,this.supportsDecimation=!1,this.$context=void 0,this._syncList=[],this.datasetElementType=new.target.datasetElementType,this.dataElementType=new.target.dataElementType,this.initialize()}initialize(){const t=this._cachedMeta;this.configure(),this.linkScales(),t._stacked=Is(t.vScale,t),this.addElements(),this.options.fill&&!this.chart.isPluginEnabled("filler")&&console.warn("Tried to use the 'fill' option without the 'Filler' plugin enabled. Please import and register the 'Filler' plugin and make sure it is not disabled in the options")}updateIndex(t){this.index!==t&&Ws(this._cachedMeta),this.index=t}linkScales(){const t=this.chart,e=this._cachedMeta,i=this.getDataset(),s=(t,e,i,s)=>"x"===t?e:"r"===t?s:i,n=e.xAxisID=l(i.xAxisID,Bs(t,"x")),o=e.yAxisID=l(i.yAxisID,Bs(t,"y")),a=e.rAxisID=l(i.rAxisID,Bs(t,"r")),r=e.indexAxis,h=e.iAxisID=s(r,n,o,a),c=e.vAxisID=s(r,o,n,a);e.xScale=this.getScaleForId(n),e.yScale=this.getScaleForId(o),e.rScale=this.getScaleForId(a),e.iScale=this.getScaleForId(h),e.vScale=this.getScaleForId(c)}getDataset(){return this.chart.data.datasets[this.index]}getMeta(){return this.chart.getDatasetMeta(this.index)}getScaleForId(t){return this.chart.scales[t]}_getOtherScale(t){const e=this._cachedMeta;return t===e.iScale?e.vScale:e.iScale}reset(){this._update("reset")}_destroy(){const t=this._cachedMeta;this._data&&rt(this._data,this),t._stacked&&Ws(t)}_dataCheck(){const t=this.getDataset(),e=t.data||(t.data=[]),i=this._data;if(o(e)){const t=this._cachedMeta;this._data=function(t,e){const{iScale:i,vScale:s}=e,n="x"===i.axis?"x":"y",o="x"===s.axis?"x":"y",a=Object.keys(t),r=new Array(a.length);let l,h,c;for(l=0,h=a.length;l<h;++l)c=a[l],r[l]={[n]:c,[o]:t[c]};return r}(e,t)}else if(i!==e){if(i){rt(i,this);const t=this._cachedMeta;Ws(t),t._parsed=[]}e&&Object.isExtensible(e)&&at(e,this),this._syncList=[],this._data=e}}addElements(){const t=this._cachedMeta;this._dataCheck(),this.datasetElementType&&(t.dataset=new this.datasetElementType)}buildOrUpdateElements(t){const e=this._cachedMeta,i=this.getDataset();let s=!1;this._dataCheck();const n=e._stacked;e._stacked=Is(e.vScale,e),e.stack!==i.stack&&(s=!0,Ws(e),e.stack=i.stack),this._resyncElements(t),(s||n!==e._stacked)&&(Vs(this,e._parsed),e._stacked=Is(e.vScale,e))}configure(){const t=this.chart.config,e=t.datasetScopeKeys(this._type),i=t.getOptionScopes(this.getDataset(),e,!0);this.options=t.createResolver(i,this.getContext()),this._parsing=this.options.parsing,this._cachedDataOpts={}}parse(t,e){const{_cachedMeta:i,_data:s}=this,{iScale:a,_stacked:r}=i,l=a.axis;let h,c,d,u=0===t&&e===s.length||i._sorted,f=t>0&&i._parsed[t-1];if(!1===this._parsing)i._parsed=s,i._sorted=!0,d=s;else{d=n(s[t])?this.parseArrayData(i,s,t,e):o(s[t])?this.parseObjectData(i,s,t,e):this.parsePrimitiveData(i,s,t,e);const a=()=>null===c[l]||f&&c[l]<f[l];for(h=0;h<e;++h)i._parsed[h+t]=c=d[h],u&&(a()&&(u=!1),f=c);i._sorted=u}r&&Vs(this,d)}parsePrimitiveData(t,e,i,s){const{iScale:n,vScale:o}=t,a=n.axis,r=o.axis,l=n.getLabels(),h=n===o,c=new Array(s);let d,u,f;for(d=0,u=s;d<u;++d)f=d+i,c[d]={[a]:h||n.parse(l[f],f),[r]:o.parse(e[f],f)};return c}parseArrayData(t,e,i,s){const{xScale:n,yScale:o}=t,a=new Array(s);let r,l,h,c;for(r=0,l=s;r<l;++r)h=r+i,c=e[h],a[r]={x:n.parse(c[0],h),y:o.parse(c[1],h)};return a}parseObjectData(t,e,i,s){const{xScale:n,yScale:o}=t,{xAxisKey:a="x",yAxisKey:r="y"}=this._parsing,l=new Array(s);let h,c,d,u;for(h=0,c=s;h<c;++h)d=h+i,u=e[d],l[h]={x:n.parse(M(u,a),d),y:o.parse(M(u,r),d)};return l}getParsed(t){return this._cachedMeta._parsed[t]}getDataElement(t){return this._cachedMeta.data[t]}applyStack(t,e,i){const s=this.chart,n=this._cachedMeta,o=e[t.axis];return Rs({keys:Es(s,!0),values:e._stacks[t.axis]._visualValues},o,n.index,{mode:i})}updateRangeFromParsed(t,e,i,s){const n=i[e.axis];let o=null===n?NaN:n;const a=s&&i._stacks[e.axis];s&&a&&(s.values=a,o=Rs(s,n,this._cachedMeta.index)),t.min=Math.min(t.min,o),t.max=Math.max(t.max,o)}getMinMax(t,e){const i=this._cachedMeta,s=i._parsed,n=i._sorted&&t===i.iScale,o=s.length,r=this._getOtherScale(t),l=((t,e,i)=>t&&!e.hidden&&e._stacked&&{keys:Es(i,!0),values:null})(e,i,this.chart),h={min:Number.POSITIVE_INFINITY,max:Number.NEGATIVE_INFINITY},{min:c,max:d}=function(t){const{min:e,max:i,minDefined:s,maxDefined:n}=t.getUserBounds();return{min:s?e:Number.NEGATIVE_INFINITY,max:n?i:Number.POSITIVE_INFINITY}}(r);let u,f;function g(){f=s[u];const e=f[r.axis];return!a(f[t.axis])||c>e||d<e}for(u=0;u<o&&(g()||(this.updateRangeFromParsed(h,t,f,l),!n));++u);if(n)for(u=o-1;u>=0;--u)if(!g()){this.updateRangeFromParsed(h,t,f,l);break}return h}getAllParsedValues(t){const e=this._cachedMeta._parsed,i=[];let s,n,o;for(s=0,n=e.length;s<n;++s)o=e[s][t.axis],a(o)&&i.push(o);return i}getMaxOverflow(){return!1}getLabelAndValue(t){const e=this._cachedMeta,i=e.iScale,s=e.vScale,n=this.getParsed(t);return{label:i?""+i.getLabelForValue(n[i.axis]):"",value:s?""+s.getLabelForValue(n[s.axis]):""}}_update(t){const e=this._cachedMeta;this.update(t||"default"),e._clip=function(t){let e,i,s,n;return o(t)?(e=t.top,i=t.right,s=t.bottom,n=t.left):e=i=s=n=t,{top:e,right:i,bottom:s,left:n,disabled:!1===t}}(l(this.options.clip,function(t,e,i){if(!1===i)return!1;const s=Ls(t,i),n=Ls(e,i);return{top:n.end,right:s.end,bottom:n.start,left:s.start}}(e.xScale,e.yScale,this.getMaxOverflow())))}update(t){}draw(){const t=this._ctx,e=this.chart,i=this._cachedMeta,s=i.data||[],n=e.chartArea,o=[],a=this._drawStart||0,r=this._drawCount||s.length-a,l=this.options.drawActiveElementsOnTop;let h;for(i.dataset&&i.dataset.draw(t,n,a,r),h=a;h<a+r;++h){const e=s[h];e.hidden||(e.active&&l?o.push(e):e.draw(t,n))}for(h=0;h<o.length;++h)o[h].draw(t,n)}getStyle(t,e){const i=e?"active":"default";return void 0===t&&this._cachedMeta.dataset?this.resolveDatasetElementOptions(i):this.resolveDataElementOptions(t||0,i)}getContext(t,e,i){const s=this.getDataset();let n;if(t>=0&&t<this._cachedMeta.data.length){const e=this._cachedMeta.data[t];n=e.$context||(e.$context=function(t,e,i){return Ci(t,{active:!1,dataIndex:e,parsed:void 0,raw:void 0,element:i,index:e,mode:"default",type:"data"})}(this.getContext(),t,e)),n.parsed=this.getParsed(t),n.raw=s.data[t],n.index=n.dataIndex=t}else n=this.$context||(this.$context=function(t,e){return Ci(t,{active:!1,dataset:void 0,datasetIndex:e,index:e,mode:"default",type:"dataset"})}(this.chart.getContext(),this.index)),n.dataset=s,n.index=n.datasetIndex=this.index;return n.active=!!e,n.mode=i,n}resolveDatasetElementOptions(t){return this._resolveElementOptions(this.datasetElementType.id,t)}resolveDataElementOptions(t,e){return this._resolveElementOptions(this.dataElementType.id,e,t)}_resolveElementOptions(t,e="default",i){const s="active"===e,n=this._cachedDataOpts,o=t+"-"+e,a=n[o],r=this.enableOptionSharing&&k(i);if(a)return Hs(a,r);const l=this.chart.config,h=l.datasetElementScopeKeys(this._type,t),c=s?[`${t}Hover`,"hover",t,""]:[t,""],d=l.getOptionScopes(this.getDataset(),h),u=Object.keys(ue.elements[t]),f=l.resolveNamedOptions(d,u,(()=>this.getContext(i,s,e)),c);return f.$shared&&(f.$shared=r,n[o]=Object.freeze(Hs(f,r))),f}_resolveAnimations(t,e,i){const s=this.chart,n=this._cachedDataOpts,o=`animation-${e}`,a=n[o];if(a)return a;let r;if(!1!==s.options.animation){const s=this.chart.config,n=s.datasetAnimationScopeKeys(this._type,e),o=s.getOptionScopes(this.getDataset(),n);r=s.createResolver(o,this.getContext(t,i,e))}const l=new Ts(s,r&&r.animations);return r&&r._cacheable&&(n[o]=Object.freeze(l)),l}getSharedOptions(t){if(t.$shared)return this._sharedOptions||(this._sharedOptions=Object.assign({},t))}includeOptions(t,e){return!e||Ns(t)||this.chart._animationsDisabled}_getSharedOptions(t,e){const i=this.resolveDataElementOptions(t,e),s=this._sharedOptions,n=this.getSharedOptions(i),o=this.includeOptions(e,n)||n!==s;return this.updateSharedOptions(n,e,i),{sharedOptions:n,includeOptions:o}}updateElement(t,e,i,s){Ns(s)?Object.assign(t,i):this._resolveAnimations(e,s).update(t,i)}updateSharedOptions(t,e,i){t&&!Ns(e)&&this._resolveAnimations(void 0,e).update(t,i)}_setStyle(t,e,i,s){t.active=s;const n=this.getStyle(e,s);this._resolveAnimations(e,i,s).update(t,{options:!s&&this.getSharedOptions(n)||n})}removeHoverStyle(t,e,i){this._setStyle(t,i,"active",!1)}setHoverStyle(t,e,i){this._setStyle(t,i,"active",!0)}_removeDatasetHoverStyle(){const t=this._cachedMeta.dataset;t&&this._setStyle(t,void 0,"active",!1)}_setDatasetHoverStyle(){const t=this._cachedMeta.dataset;t&&this._setStyle(t,void 0,"active",!0)}_resyncElements(t){const e=this._data,i=this._cachedMeta.data;for(const[t,e,i]of this._syncList)this[t](e,i);this._syncList=[];const s=i.length,n=e.length,o=Math.min(n,s);o&&this.parse(0,o),n>s?this._insertElements(s,n-s,t):n<s&&this._removeElements(n,s-n)}_insertElements(t,e,i=!0){const s=this._cachedMeta,n=s.data,o=t+e;let a;const r=t=>{for(t.length+=e,a=t.length-1;a>=o;a--)t[a]=t[a-e]};for(r(n),a=t;a<o;++a)n[a]=new this.dataElementType;this._parsing&&r(s._parsed),this.parse(t,e),i&&this.updateElements(n,t,e,"reset")}updateElements(t,e,i,s){}_removeElements(t,e){const i=this._cachedMeta;if(this._parsing){const s=i._parsed.splice(t,e);i._stacked&&Ws(i,s)}i.data.splice(t,e)}_sync(t){if(this._parsing)this._syncList.push(t);else{const[e,i,s]=t;this[e](i,s)}this.chart._dataChanges.push([this.index,...t])}_onDataPush(){const t=arguments.length;this._sync(["_insertElements",this.getDataset().data.length-t,t])}_onDataPop(){this._sync(["_removeElements",this._cachedMeta.data.length-1,1])}_onDataShift(){this._sync(["_removeElements",0,1])}_onDataSplice(t,e){e&&this._sync(["_removeElements",t,e]);const i=arguments.length-2;i&&this._sync(["_insertElements",t,i])}_onDataUnshift(){this._sync(["_insertElements",0,arguments.length])}}class $s{static defaults={};static defaultRoutes=void 0;x;y;active=!1;options;$animations;tooltipPosition(t){const{x:e,y:i}=this.getProps(["x","y"],t);return{x:e,y:i}}hasValue(){return N(this.x)&&N(this.y)}getProps(t,e){const i=this.$animations;if(!e||!i)return this;const s={};return t.forEach((t=>{s[t]=i[t]&&i[t].active()?i[t]._to:this[t]})),s}}function Ys(t,e){const i=t.options.ticks,n=function(t){const e=t.options.offset,i=t._tickSize(),s=t._length/i+(e?0:1),n=t._maxLength/i;return Math.floor(Math.min(s,n))}(t),o=Math.min(i.maxTicksLimit||n,n),a=i.major.enabled?function(t){const e=[];let i,s;for(i=0,s=t.length;i<s;i++)t[i].major&&e.push(i);return e}(e):[],r=a.length,l=a[0],h=a[r-1],c=[];if(r>o)return function(t,e,i,s){let n,o=0,a=i[0];for(s=Math.ceil(s),n=0;n<t.length;n++)n===a&&(e.push(t[n]),o++,a=i[o*s])}(e,c,a,r/o),c;const d=function(t,e,i){const s=function(t){const e=t.length;let i,s;if(e<2)return!1;for(s=t[0],i=1;i<e;++i)if(t[i]-t[i-1]!==s)return!1;return s}(t),n=e.length/i;if(!s)return Math.max(n,1);const o=W(s);for(let t=0,e=o.length-1;t<e;t++){const e=o[t];if(e>n)return e}return Math.max(n,1)}(a,e,o);if(r>0){let t,i;const n=r>1?Math.round((h-l)/(r-1)):null;for(Us(e,c,d,s(n)?0:l-n,l),t=0,i=r-1;t<i;t++)Us(e,c,d,a[t],a[t+1]);return Us(e,c,d,h,s(n)?e.length:h+n),c}return Us(e,c,d),c}function Us(t,e,i,s,n){const o=l(s,0),a=Math.min(l(n,t.length),t.length);let r,h,c,d=0;for(i=Math.ceil(i),n&&(r=n-s,i=r/Math.floor(r/i)),c=o;c<0;)d++,c=Math.round(o+d*i);for(h=Math.max(o,0);h<a;h++)h===c&&(e.push(t[h]),d++,c=Math.round(o+d*i))}const Xs=(t,e,i)=>"top"===e||"left"===e?t[e]+i:t[e]-i,qs=(t,e)=>Math.min(e||t,t);function Ks(t,e){const i=[],s=t.length/e,n=t.length;let o=0;for(;o<n;o+=s)i.push(t[Math.floor(o)]);return i}function Gs(t,e,i){const s=t.ticks.length,n=Math.min(e,s-1),o=t._startPixel,a=t._endPixel,r=1e-6;let l,h=t.getPixelForTick(n);if(!(i&&(l=1===s?Math.max(h-o,a-h):0===e?(t.getPixelForTick(1)-h)/2:(h-t.getPixelForTick(n-1))/2,h+=n<e?l:-l,h<o-r||h>a+r)))return h}function Js(t){return t.drawTicks?t.tickLength:0}function Zs(t,e){if(!t.display)return 0;const i=Si(t.font,e),s=ki(t.padding);return(n(t.text)?t.text.length:1)*i.lineHeight+s.height}function Qs(t,e,i){let s=ut(t);return(i&&"right"!==e||!i&&"right"===e)&&(s=(t=>"left"===t?"right":"right"===t?"left":t)(s)),s}class tn extends $s{constructor(t){super(),this.id=t.id,this.type=t.type,this.options=void 0,this.ctx=t.ctx,this.chart=t.chart,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.width=void 0,this.height=void 0,this._margins={left:0,right:0,top:0,bottom:0},this.maxWidth=void 0,this.maxHeight=void 0,this.paddingTop=void 0,this.paddingBottom=void 0,this.paddingLeft=void 0,this.paddingRight=void 0,this.axis=void 0,this.labelRotation=void 0,this.min=void 0,this.max=void 0,this._range=void 0,this.ticks=[],this._gridLineItems=null,this._labelItems=null,this._labelSizes=null,this._length=0,this._maxLength=0,this._longestTextCache={},this._startPixel=void 0,this._endPixel=void 0,this._reversePixels=!1,this._userMax=void 0,this._userMin=void 0,this._suggestedMax=void 0,this._suggestedMin=void 0,this._ticksLength=0,this._borderValue=0,this._cache={},this._dataLimitsCached=!1,this.$context=void 0}init(t){this.options=t.setContext(this.getContext()),this.axis=t.axis,this._userMin=this.parse(t.min),this._userMax=this.parse(t.max),this._suggestedMin=this.parse(t.suggestedMin),this._suggestedMax=this.parse(t.suggestedMax)}parse(t,e){return t}getUserBounds(){let{_userMin:t,_userMax:e,_suggestedMin:i,_suggestedMax:s}=this;return t=r(t,Number.POSITIVE_INFINITY),e=r(e,Number.NEGATIVE_INFINITY),i=r(i,Number.POSITIVE_INFINITY),s=r(s,Number.NEGATIVE_INFINITY),{min:r(t,i),max:r(e,s),minDefined:a(t),maxDefined:a(e)}}getMinMax(t){let e,{min:i,max:s,minDefined:n,maxDefined:o}=this.getUserBounds();if(n&&o)return{min:i,max:s};const a=this.getMatchingVisibleMetas();for(let r=0,l=a.length;r<l;++r)e=a[r].controller.getMinMax(this,t),n||(i=Math.min(i,e.min)),o||(s=Math.max(s,e.max));return i=o&&i>s?s:i,s=n&&i>s?i:s,{min:r(i,r(s,i)),max:r(s,r(i,s))}}getPadding(){return{left:this.paddingLeft||0,top:this.paddingTop||0,right:this.paddingRight||0,bottom:this.paddingBottom||0}}getTicks(){return this.ticks}getLabels(){const t=this.chart.data;return this.options.labels||(this.isHorizontal()?t.xLabels:t.yLabels)||t.labels||[]}getLabelItems(t=this.chart.chartArea){return this._labelItems||(this._labelItems=this._computeLabelItems(t))}beforeLayout(){this._cache={},this._dataLimitsCached=!1}beforeUpdate(){d(this.options.beforeUpdate,[this])}update(t,e,i){const{beginAtZero:s,grace:n,ticks:o}=this.options,a=o.sampleSize;this.beforeUpdate(),this.maxWidth=t,this.maxHeight=e,this._margins=i=Object.assign({left:0,right:0,top:0,bottom:0},i),this.ticks=null,this._labelSizes=null,this._gridLineItems=null,this._labelItems=null,this.beforeSetDimensions(),this.setDimensions(),this.afterSetDimensions(),this._maxLength=this.isHorizontal()?this.width+i.left+i.right:this.height+i.top+i.bottom,this._dataLimitsCached||(this.beforeDataLimits(),this.determineDataLimits(),this.afterDataLimits(),this._range=Di(this,n,s),this._dataLimitsCached=!0),this.beforeBuildTicks(),this.ticks=this.buildTicks()||[],this.afterBuildTicks();const r=a<this.ticks.length;this._convertTicksToLabels(r?Ks(this.ticks,a):this.ticks),this.configure(),this.beforeCalculateLabelRotation(),this.calculateLabelRotation(),this.afterCalculateLabelRotation(),o.display&&(o.autoSkip||"auto"===o.source)&&(this.ticks=Ys(this,this.ticks),this._labelSizes=null,this.afterAutoSkip()),r&&this._convertTicksToLabels(this.ticks),this.beforeFit(),this.fit(),this.afterFit(),this.afterUpdate()}configure(){let t,e,i=this.options.reverse;this.isHorizontal()?(t=this.left,e=this.right):(t=this.top,e=this.bottom,i=!i),this._startPixel=t,this._endPixel=e,this._reversePixels=i,this._length=e-t,this._alignToPixels=this.options.alignToPixels}afterUpdate(){d(this.options.afterUpdate,[this])}beforeSetDimensions(){d(this.options.beforeSetDimensions,[this])}setDimensions(){this.isHorizontal()?(this.width=this.maxWidth,this.left=0,this.right=this.width):(this.height=this.maxHeight,this.top=0,this.bottom=this.height),this.paddingLeft=0,this.paddingTop=0,this.paddingRight=0,this.paddingBottom=0}afterSetDimensions(){d(this.options.afterSetDimensions,[this])}_callHooks(t){this.chart.notifyPlugins(t,this.getContext()),d(this.options[t],[this])}beforeDataLimits(){this._callHooks("beforeDataLimits")}determineDataLimits(){}afterDataLimits(){this._callHooks("afterDataLimits")}beforeBuildTicks(){this._callHooks("beforeBuildTicks")}buildTicks(){return[]}afterBuildTicks(){this._callHooks("afterBuildTicks")}beforeTickToLabelConversion(){d(this.options.beforeTickToLabelConversion,[this])}generateTickLabels(t){const e=this.options.ticks;let i,s,n;for(i=0,s=t.length;i<s;i++)n=t[i],n.label=d(e.callback,[n.value,i,t],this)}afterTickToLabelConversion(){d(this.options.afterTickToLabelConversion,[this])}beforeCalculateLabelRotation(){d(this.options.beforeCalculateLabelRotation,[this])}calculateLabelRotation(){const t=this.options,e=t.ticks,i=qs(this.ticks.length,t.ticks.maxTicksLimit),s=e.minRotation||0,n=e.maxRotation;let o,a,r,l=s;if(!this._isVisible()||!e.display||s>=n||i<=1||!this.isHorizontal())return void(this.labelRotation=s);const h=this._getLabelSizes(),c=h.widest.width,d=h.highest.height,u=Z(this.chart.width-c,0,this.maxWidth);o=t.offset?this.maxWidth/i:u/(i-1),c+6>o&&(o=u/(i-(t.offset?.5:1)),a=this.maxHeight-Js(t.grid)-e.padding-Zs(t.title,this.chart.options.font),r=Math.sqrt(c*c+d*d),l=Y(Math.min(Math.asin(Z((h.highest.height+6)/o,-1,1)),Math.asin(Z(a/r,-1,1))-Math.asin(Z(d/r,-1,1)))),l=Math.max(s,Math.min(n,l))),this.labelRotation=l}afterCalculateLabelRotation(){d(this.options.afterCalculateLabelRotation,[this])}afterAutoSkip(){}beforeFit(){d(this.options.beforeFit,[this])}fit(){const t={width:0,height:0},{chart:e,options:{ticks:i,title:s,grid:n}}=this,o=this._isVisible(),a=this.isHorizontal();if(o){const o=Zs(s,e.options.font);if(a?(t.width=this.maxWidth,t.height=Js(n)+o):(t.height=this.maxHeight,t.width=Js(n)+o),i.display&&this.ticks.length){const{first:e,last:s,widest:n,highest:o}=this._getLabelSizes(),r=2*i.padding,l=$(this.labelRotation),h=Math.cos(l),c=Math.sin(l);if(a){const e=i.mirror?0:c*n.width+h*o.height;t.height=Math.min(this.maxHeight,t.height+e+r)}else{const e=i.mirror?0:h*n.width+c*o.height;t.width=Math.min(this.maxWidth,t.width+e+r)}this._calculatePadding(e,s,c,h)}}this._handleMargins(),a?(this.width=this._length=e.width-this._margins.left-this._margins.right,this.height=t.height):(this.width=t.width,this.height=this._length=e.height-this._margins.top-this._margins.bottom)}_calculatePadding(t,e,i,s){const{ticks:{align:n,padding:o},position:a}=this.options,r=0!==this.labelRotation,l="top"!==a&&"x"===this.axis;if(this.isHorizontal()){const a=this.getPixelForTick(0)-this.left,h=this.right-this.getPixelForTick(this.ticks.length-1);let c=0,d=0;r?l?(c=s*t.width,d=i*e.height):(c=i*t.height,d=s*e.width):"start"===n?d=e.width:"end"===n?c=t.width:"inner"!==n&&(c=t.width/2,d=e.width/2),this.paddingLeft=Math.max((c-a+o)*this.width/(this.width-a),0),this.paddingRight=Math.max((d-h+o)*this.width/(this.width-h),0)}else{let i=e.height/2,s=t.height/2;"start"===n?(i=0,s=t.height):"end"===n&&(i=e.height,s=0),this.paddingTop=i+o,this.paddingBottom=s+o}}_handleMargins(){this._margins&&(this._margins.left=Math.max(this.paddingLeft,this._margins.left),this._margins.top=Math.max(this.paddingTop,this._margins.top),this._margins.right=Math.max(this.paddingRight,this._margins.right),this._margins.bottom=Math.max(this.paddingBottom,this._margins.bottom))}afterFit(){d(this.options.afterFit,[this])}isHorizontal(){const{axis:t,position:e}=this.options;return"top"===e||"bottom"===e||"x"===t}isFullSize(){return this.options.fullSize}_convertTicksToLabels(t){let e,i;for(this.beforeTickToLabelConversion(),this.generateTickLabels(t),e=0,i=t.length;e<i;e++)s(t[e].label)&&(t.splice(e,1),i--,e--);this.afterTickToLabelConversion()}_getLabelSizes(){let t=this._labelSizes;if(!t){const e=this.options.ticks.sampleSize;let i=this.ticks;e<i.length&&(i=Ks(i,e)),this._labelSizes=t=this._computeLabelSizes(i,i.length,this.options.ticks.maxTicksLimit)}return t}_computeLabelSizes(t,e,i){const{ctx:o,_longestTextCache:a}=this,r=[],l=[],h=Math.floor(e/qs(e,i));let c,d,f,g,p,m,x,b,_,y,v,M=0,w=0;for(c=0;c<e;c+=h){if(g=t[c].label,p=this._resolveTickFontOptions(c),o.font=m=p.string,x=a[m]=a[m]||{data:{},gc:[]},b=p.lineHeight,_=y=0,s(g)||n(g)){if(n(g))for(d=0,f=g.length;d<f;++d)v=g[d],s(v)||n(v)||(_=Ce(o,x.data,x.gc,_,v),y+=b)}else _=Ce(o,x.data,x.gc,_,g),y=b;r.push(_),l.push(y),M=Math.max(_,M),w=Math.max(y,w)}!function(t,e){u(t,(t=>{const i=t.gc,s=i.length/2;let n;if(s>e){for(n=0;n<s;++n)delete t.data[i[n]];i.splice(0,s)}}))}(a,e);const k=r.indexOf(M),S=l.indexOf(w),P=t=>({width:r[t]||0,height:l[t]||0});return{first:P(0),last:P(e-1),widest:P(k),highest:P(S),widths:r,heights:l}}getLabelForValue(t){return t}getPixelForValue(t,e){return NaN}getValueForPixel(t){}getPixelForTick(t){const e=this.ticks;return t<0||t>e.length-1?null:this.getPixelForValue(e[t].value)}getPixelForDecimal(t){this._reversePixels&&(t=1-t);const e=this._startPixel+t*this._length;return Q(this._alignToPixels?Ae(this.chart,e,0):e)}getDecimalForPixel(t){const e=(t-this._startPixel)/this._length;return this._reversePixels?1-e:e}getBasePixel(){return this.getPixelForValue(this.getBaseValue())}getBaseValue(){const{min:t,max:e}=this;return t<0&&e<0?e:t>0&&e>0?t:0}getContext(t){const e=this.ticks||[];if(t>=0&&t<e.length){const i=e[t];return i.$context||(i.$context=function(t,e,i){return Ci(t,{tick:i,index:e,type:"tick"})}(this.getContext(),t,i))}return this.$context||(this.$context=Ci(this.chart.getContext(),{scale:this,type:"scale"}))}_tickSize(){const t=this.options.ticks,e=$(this.labelRotation),i=Math.abs(Math.cos(e)),s=Math.abs(Math.sin(e)),n=this._getLabelSizes(),o=t.autoSkipPadding||0,a=n?n.widest.width+o:0,r=n?n.highest.height+o:0;return this.isHorizontal()?r*i>a*s?a/i:r/s:r*s<a*i?r/i:a/s}_isVisible(){const t=this.options.display;return"auto"!==t?!!t:this.getMatchingVisibleMetas().length>0}_computeGridLineItems(t){const e=this.axis,i=this.chart,s=this.options,{grid:n,position:a,border:r}=s,h=n.offset,c=this.isHorizontal(),d=this.ticks.length+(h?1:0),u=Js(n),f=[],g=r.setContext(this.getContext()),p=g.display?g.width:0,m=p/2,x=function(t){return Ae(i,t,p)};let b,_,y,v,M,w,k,S,P,D,C,O;if("top"===a)b=x(this.bottom),w=this.bottom-u,S=b-m,D=x(t.top)+m,O=t.bottom;else if("bottom"===a)b=x(this.top),D=t.top,O=x(t.bottom)-m,w=b+m,S=this.top+u;else if("left"===a)b=x(this.right),M=this.right-u,k=b-m,P=x(t.left)+m,C=t.right;else if("right"===a)b=x(this.left),P=t.left,C=x(t.right)-m,M=b+m,k=this.left+u;else if("x"===e){if("center"===a)b=x((t.top+t.bottom)/2+.5);else if(o(a)){const t=Object.keys(a)[0],e=a[t];b=x(this.chart.scales[t].getPixelForValue(e))}D=t.top,O=t.bottom,w=b+m,S=w+u}else if("y"===e){if("center"===a)b=x((t.left+t.right)/2);else if(o(a)){const t=Object.keys(a)[0],e=a[t];b=x(this.chart.scales[t].getPixelForValue(e))}M=b-m,k=M-u,P=t.left,C=t.right}const A=l(s.ticks.maxTicksLimit,d),T=Math.max(1,Math.ceil(d/A));for(_=0;_<d;_+=T){const t=this.getContext(_),e=n.setContext(t),s=r.setContext(t),o=e.lineWidth,a=e.color,l=s.dash||[],d=s.dashOffset,u=e.tickWidth,g=e.tickColor,p=e.tickBorderDash||[],m=e.tickBorderDashOffset;y=Gs(this,_,h),void 0!==y&&(v=Ae(i,y,o),c?M=k=P=C=v:w=S=D=O=v,f.push({tx1:M,ty1:w,tx2:k,ty2:S,x1:P,y1:D,x2:C,y2:O,width:o,color:a,borderDash:l,borderDashOffset:d,tickWidth:u,tickColor:g,tickBorderDash:p,tickBorderDashOffset:m}))}return this._ticksLength=d,this._borderValue=b,f}_computeLabelItems(t){const e=this.axis,i=this.options,{position:s,ticks:a}=i,r=this.isHorizontal(),l=this.ticks,{align:h,crossAlign:c,padding:d,mirror:u}=a,f=Js(i.grid),g=f+d,p=u?-d:g,m=-$(this.labelRotation),x=[];let b,_,y,v,M,w,k,S,P,D,C,O,A="middle";if("top"===s)w=this.bottom-p,k=this._getXAxisLabelAlignment();else if("bottom"===s)w=this.top+p,k=this._getXAxisLabelAlignment();else if("left"===s){const t=this._getYAxisLabelAlignment(f);k=t.textAlign,M=t.x}else if("right"===s){const t=this._getYAxisLabelAlignment(f);k=t.textAlign,M=t.x}else if("x"===e){if("center"===s)w=(t.top+t.bottom)/2+g;else if(o(s)){const t=Object.keys(s)[0],e=s[t];w=this.chart.scales[t].getPixelForValue(e)+g}k=this._getXAxisLabelAlignment()}else if("y"===e){if("center"===s)M=(t.left+t.right)/2-g;else if(o(s)){const t=Object.keys(s)[0],e=s[t];M=this.chart.scales[t].getPixelForValue(e)}k=this._getYAxisLabelAlignment(f).textAlign}"y"===e&&("start"===h?A="top":"end"===h&&(A="bottom"));const T=this._getLabelSizes();for(b=0,_=l.length;b<_;++b){y=l[b],v=y.label;const t=a.setContext(this.getContext(b));S=this.getPixelForTick(b)+a.labelOffset,P=this._resolveTickFontOptions(b),D=P.lineHeight,C=n(v)?v.length:1;const e=C/2,i=t.color,o=t.textStrokeColor,h=t.textStrokeWidth;let d,f=k;if(r?(M=S,"inner"===k&&(f=b===_-1?this.options.reverse?"left":"right":0===b?this.options.reverse?"right":"left":"center"),O="top"===s?"near"===c||0!==m?-C*D+D/2:"center"===c?-T.highest.height/2-e*D+D:-T.highest.height+D/2:"near"===c||0!==m?D/2:"center"===c?T.highest.height/2-e*D:T.highest.height-C*D,u&&(O*=-1),0===m||t.showLabelBackdrop||(M+=D/2*Math.sin(m))):(w=S,O=(1-C)*D/2),t.showLabelBackdrop){const e=ki(t.backdropPadding),i=T.heights[b],s=T.widths[b];let n=O-e.top,o=0-e.left;switch(A){case"middle":n-=i/2;break;case"bottom":n-=i}switch(k){case"center":o-=s/2;break;case"right":o-=s;break;case"inner":b===_-1?o-=s:b>0&&(o-=s/2)}d={left:o,top:n,width:s+e.width,height:i+e.height,color:t.backdropColor}}x.push({label:v,font:P,textOffset:O,options:{rotation:m,color:i,strokeColor:o,strokeWidth:h,textAlign:f,textBaseline:A,translation:[M,w],backdrop:d}})}return x}_getXAxisLabelAlignment(){const{position:t,ticks:e}=this.options;if(-$(this.labelRotation))return"top"===t?"left":"right";let i="center";return"start"===e.align?i="left":"end"===e.align?i="right":"inner"===e.align&&(i="inner"),i}_getYAxisLabelAlignment(t){const{position:e,ticks:{crossAlign:i,mirror:s,padding:n}}=this.options,o=t+n,a=this._getLabelSizes().widest.width;let r,l;return"left"===e?s?(l=this.right+n,"near"===i?r="left":"center"===i?(r="center",l+=a/2):(r="right",l+=a)):(l=this.right-o,"near"===i?r="right":"center"===i?(r="center",l-=a/2):(r="left",l=this.left)):"right"===e?s?(l=this.left+n,"near"===i?r="right":"center"===i?(r="center",l-=a/2):(r="left",l-=a)):(l=this.left+o,"near"===i?r="left":"center"===i?(r="center",l+=a/2):(r="right",l=this.right)):r="right",{textAlign:r,x:l}}_computeLabelArea(){if(this.options.ticks.mirror)return;const t=this.chart,e=this.options.position;return"left"===e||"right"===e?{top:0,left:this.left,bottom:t.height,right:this.right}:"top"===e||"bottom"===e?{top:this.top,left:0,bottom:this.bottom,right:t.width}:void 0}drawBackground(){const{ctx:t,options:{backgroundColor:e},left:i,top:s,width:n,height:o}=this;e&&(t.save(),t.fillStyle=e,t.fillRect(i,s,n,o),t.restore())}getLineWidthForValue(t){const e=this.options.grid;if(!this._isVisible()||!e.display)return 0;const i=this.ticks.findIndex((e=>e.value===t));if(i>=0){return e.setContext(this.getContext(i)).lineWidth}return 0}drawGrid(t){const e=this.options.grid,i=this.ctx,s=this._gridLineItems||(this._gridLineItems=this._computeGridLineItems(t));let n,o;const a=(t,e,s)=>{s.width&&s.color&&(i.save(),i.lineWidth=s.width,i.strokeStyle=s.color,i.setLineDash(s.borderDash||[]),i.lineDashOffset=s.borderDashOffset,i.beginPath(),i.moveTo(t.x,t.y),i.lineTo(e.x,e.y),i.stroke(),i.restore())};if(e.display)for(n=0,o=s.length;n<o;++n){const t=s[n];e.drawOnChartArea&&a({x:t.x1,y:t.y1},{x:t.x2,y:t.y2},t),e.drawTicks&&a({x:t.tx1,y:t.ty1},{x:t.tx2,y:t.ty2},{color:t.tickColor,width:t.tickWidth,borderDash:t.tickBorderDash,borderDashOffset:t.tickBorderDashOffset})}}drawBorder(){const{chart:t,ctx:e,options:{border:i,grid:s}}=this,n=i.setContext(this.getContext()),o=i.display?n.width:0;if(!o)return;const a=s.setContext(this.getContext(0)).lineWidth,r=this._borderValue;let l,h,c,d;this.isHorizontal()?(l=Ae(t,this.left,o)-o/2,h=Ae(t,this.right,a)+a/2,c=d=r):(c=Ae(t,this.top,o)-o/2,d=Ae(t,this.bottom,a)+a/2,l=h=r),e.save(),e.lineWidth=n.width,e.strokeStyle=n.color,e.beginPath(),e.moveTo(l,c),e.lineTo(h,d),e.stroke(),e.restore()}drawLabels(t){if(!this.options.ticks.display)return;const e=this.ctx,i=this._computeLabelArea();i&&Ie(e,i);const s=this.getLabelItems(t);for(const t of s){const i=t.options,s=t.font;Ne(e,t.label,0,t.textOffset,s,i)}i&&ze(e)}drawTitle(){const{ctx:t,options:{position:e,title:i,reverse:s}}=this;if(!i.display)return;const a=Si(i.font),r=ki(i.padding),l=i.align;let h=a.lineHeight/2;"bottom"===e||"center"===e||o(e)?(h+=r.bottom,n(i.text)&&(h+=a.lineHeight*(i.text.length-1))):h+=r.top;const{titleX:c,titleY:d,maxWidth:u,rotation:f}=function(t,e,i,s){const{top:n,left:a,bottom:r,right:l,chart:h}=t,{chartArea:c,scales:d}=h;let u,f,g,p=0;const m=r-n,x=l-a;if(t.isHorizontal()){if(f=ft(s,a,l),o(i)){const t=Object.keys(i)[0],s=i[t];g=d[t].getPixelForValue(s)+m-e}else g="center"===i?(c.bottom+c.top)/2+m-e:Xs(t,i,e);u=l-a}else{if(o(i)){const t=Object.keys(i)[0],s=i[t];f=d[t].getPixelForValue(s)-x+e}else f="center"===i?(c.left+c.right)/2-x+e:Xs(t,i,e);g=ft(s,r,n),p="left"===i?-E:E}return{titleX:f,titleY:g,maxWidth:u,rotation:p}}(this,h,e,l);Ne(t,i.text,0,0,a,{color:i.color,maxWidth:u,rotation:f,textAlign:Qs(l,e,s),textBaseline:"middle",translation:[c,d]})}draw(t){this._isVisible()&&(this.drawBackground(),this.drawGrid(t),this.drawBorder(),this.drawTitle(),this.drawLabels(t))}_layers(){const t=this.options,e=t.ticks&&t.ticks.z||0,i=l(t.grid&&t.grid.z,-1),s=l(t.border&&t.border.z,0);return this._isVisible()&&this.draw===tn.prototype.draw?[{z:i,draw:t=>{this.drawBackground(),this.drawGrid(t),this.drawTitle()}},{z:s,draw:()=>{this.drawBorder()}},{z:e,draw:t=>{this.drawLabels(t)}}]:[{z:e,draw:t=>{this.draw(t)}}]}getMatchingVisibleMetas(t){const e=this.chart.getSortedVisibleDatasetMetas(),i=this.axis+"AxisID",s=[];let n,o;for(n=0,o=e.length;n<o;++n){const o=e[n];o[i]!==this.id||t&&o.type!==t||s.push(o)}return s}_resolveTickFontOptions(t){return Si(this.options.ticks.setContext(this.getContext(t)).font)}_maxDigits(){const t=this._resolveTickFontOptions(0).lineHeight;return(this.isHorizontal()?this.width:this.height)/t}}class en{constructor(t,e,i){this.type=t,this.scope=e,this.override=i,this.items=Object.create(null)}isForType(t){return Object.prototype.isPrototypeOf.call(this.type.prototype,t.prototype)}register(t){const e=Object.getPrototypeOf(t);let i;(function(t){return"id"in t&&"defaults"in t})(e)&&(i=this.register(e));const s=this.items,n=t.id,o=this.scope+"."+n;if(!n)throw new Error("class does not have id: "+t);return n in s||(s[n]=t,function(t,e,i){const s=x(Object.create(null),[i?ue.get(i):{},ue.get(e),t.defaults]);ue.set(e,s),t.defaultRoutes&&function(t,e){Object.keys(e).forEach((i=>{const s=i.split("."),n=s.pop(),o=[t].concat(s).join("."),a=e[i].split("."),r=a.pop(),l=a.join(".");ue.route(o,n,l,r)}))}(e,t.defaultRoutes);t.descriptors&&ue.describe(e,t.descriptors)}(t,o,i),this.override&&ue.override(t.id,t.overrides)),o}get(t){return this.items[t]}unregister(t){const e=this.items,i=t.id,s=this.scope;i in e&&delete e[i],s&&i in ue[s]&&(delete ue[s][i],this.override&&delete re[i])}}class sn{constructor(){this.controllers=new en(js,"datasets",!0),this.elements=new en($s,"elements"),this.plugins=new en(Object,"plugins"),this.scales=new en(tn,"scales"),this._typedRegistries=[this.controllers,this.scales,this.elements]}add(...t){this._each("register",t)}remove(...t){this._each("unregister",t)}addControllers(...t){this._each("register",t,this.controllers)}addElements(...t){this._each("register",t,this.elements)}addPlugins(...t){this._each("register",t,this.plugins)}addScales(...t){this._each("register",t,this.scales)}getController(t){return this._get(t,this.controllers,"controller")}getElement(t){return this._get(t,this.elements,"element")}getPlugin(t){return this._get(t,this.plugins,"plugin")}getScale(t){return this._get(t,this.scales,"scale")}removeControllers(...t){this._each("unregister",t,this.controllers)}removeElements(...t){this._each("unregister",t,this.elements)}removePlugins(...t){this._each("unregister",t,this.plugins)}removeScales(...t){this._each("unregister",t,this.scales)}_each(t,e,i){[...e].forEach((e=>{const s=i||this._getRegistryForType(e);i||s.isForType(e)||s===this.plugins&&e.id?this._exec(t,s,e):u(e,(e=>{const s=i||this._getRegistryForType(e);this._exec(t,s,e)}))}))}_exec(t,e,i){const s=w(t);d(i["before"+s],[],i),e[t](i),d(i["after"+s],[],i)}_getRegistryForType(t){for(let e=0;e<this._typedRegistries.length;e++){const i=this._typedRegistries[e];if(i.isForType(t))return i}return this.plugins}_get(t,e,i){const s=e.get(t);if(void 0===s)throw new Error('"'+t+'" is not a registered '+i+".");return s}}var nn=new sn;class on{constructor(){this._init=void 0}notify(t,e,i,s){if("beforeInit"===e&&(this._init=this._createDescriptors(t,!0),this._notify(this._init,t,"install")),void 0===this._init)return;const n=s?this._descriptors(t).filter(s):this._descriptors(t),o=this._notify(n,t,e,i);return"afterDestroy"===e&&(this._notify(n,t,"stop"),this._notify(this._init,t,"uninstall"),this._init=void 0),o}_notify(t,e,i,s){s=s||{};for(const n of t){const t=n.plugin;if(!1===d(t[i],[e,s,n.options],t)&&s.cancelable)return!1}return!0}invalidate(){s(this._cache)||(this._oldCache=this._cache,this._cache=void 0)}_descriptors(t){if(this._cache)return this._cache;const e=this._cache=this._createDescriptors(t);return this._notifyStateChanges(t),e}_createDescriptors(t,e){const i=t&&t.config,s=l(i.options&&i.options.plugins,{}),n=function(t){const e={},i=[],s=Object.keys(nn.plugins.items);for(let t=0;t<s.length;t++)i.push(nn.getPlugin(s[t]));const n=t.plugins||[];for(let t=0;t<n.length;t++){const s=n[t];-1===i.indexOf(s)&&(i.push(s),e[s.id]=!0)}return{plugins:i,localIds:e}}(i);return!1!==s||e?function(t,{plugins:e,localIds:i},s,n){const o=[],a=t.getContext();for(const r of e){const e=r.id,l=an(s[e],n);null!==l&&o.push({plugin:r,options:rn(t.config,{plugin:r,local:i[e]},l,a)})}return o}(t,n,s,e):[]}_notifyStateChanges(t){const e=this._oldCache||[],i=this._cache,s=(t,e)=>t.filter((t=>!e.some((e=>t.plugin.id===e.plugin.id))));this._notify(s(e,i),t,"stop"),this._notify(s(i,e),t,"start")}}function an(t,e){return e||!1!==t?!0===t?{}:t:null}function rn(t,{plugin:e,local:i},s,n){const o=t.pluginScopeKeys(e),a=t.getOptionScopes(s,o);return i&&e.defaults&&a.push(e.defaults),t.createResolver(a,n,[""],{scriptable:!1,indexable:!1,allKeys:!0})}function ln(t,e){const i=ue.datasets[t]||{};return((e.datasets||{})[t]||{}).indexAxis||e.indexAxis||i.indexAxis||"x"}function hn(t){if("x"===t||"y"===t||"r"===t)return t}function cn(t,...e){if(hn(t))return t;for(const s of e){const e=s.axis||("top"===(i=s.position)||"bottom"===i?"x":"left"===i||"right"===i?"y":void 0)||t.length>1&&hn(t[0].toLowerCase());if(e)return e}var i;throw new Error(`Cannot determine type of '${t}' axis. Please provide 'axis' or 'position' option.`)}function dn(t,e,i){if(i[e+"AxisID"]===t)return{axis:e}}function un(t,e){const i=re[t.type]||{scales:{}},s=e.scales||{},n=ln(t.type,e),a=Object.create(null);return Object.keys(s).forEach((e=>{const r=s[e];if(!o(r))return console.error(`Invalid scale configuration for scale: ${e}`);if(r._proxy)return console.warn(`Ignoring resolver passed as options for scale: ${e}`);const l=cn(e,r,function(t,e){if(e.data&&e.data.datasets){const i=e.data.datasets.filter((e=>e.xAxisID===t||e.yAxisID===t));if(i.length)return dn(t,"x",i[0])||dn(t,"y",i[0])}return{}}(e,t),ue.scales[r.type]),h=function(t,e){return t===e?"_index_":"_value_"}(l,n),c=i.scales||{};a[e]=b(Object.create(null),[{axis:l},r,c[l],c[h]])})),t.data.datasets.forEach((i=>{const n=i.type||t.type,o=i.indexAxis||ln(n,e),r=(re[n]||{}).scales||{};Object.keys(r).forEach((t=>{const e=function(t,e){let i=t;return"_index_"===t?i=e:"_value_"===t&&(i="x"===e?"y":"x"),i}(t,o),n=i[e+"AxisID"]||e;a[n]=a[n]||Object.create(null),b(a[n],[{axis:e},s[n],r[t]])}))})),Object.keys(a).forEach((t=>{const e=a[t];b(e,[ue.scales[e.type],ue.scale])})),a}function fn(t){const e=t.options||(t.options={});e.plugins=l(e.plugins,{}),e.scales=un(t,e)}function gn(t){return(t=t||{}).datasets=t.datasets||[],t.labels=t.labels||[],t}const pn=new Map,mn=new Set;function xn(t,e){let i=pn.get(t);return i||(i=e(),pn.set(t,i),mn.add(i)),i}const bn=(t,e,i)=>{const s=M(e,i);void 0!==s&&t.add(s)};class _n{constructor(t){this._config=function(t){return(t=t||{}).data=gn(t.data),fn(t),t}(t),this._scopeCache=new Map,this._resolverCache=new Map}get platform(){return this._config.platform}get type(){return this._config.type}set type(t){this._config.type=t}get data(){return this._config.data}set data(t){this._config.data=gn(t)}get options(){return this._config.options}set options(t){this._config.options=t}get plugins(){return this._config.plugins}update(){const t=this._config;this.clearCache(),fn(t)}clearCache(){this._scopeCache.clear(),this._resolverCache.clear()}datasetScopeKeys(t){return xn(t,(()=>[[`datasets.${t}`,""]]))}datasetAnimationScopeKeys(t,e){return xn(`${t}.transition.${e}`,(()=>[[`datasets.${t}.transitions.${e}`,`transitions.${e}`],[`datasets.${t}`,""]]))}datasetElementScopeKeys(t,e){return xn(`${t}-${e}`,(()=>[[`datasets.${t}.elements.${e}`,`datasets.${t}`,`elements.${e}`,""]]))}pluginScopeKeys(t){const e=t.id;return xn(`${this.type}-plugin-${e}`,(()=>[[`plugins.${e}`,...t.additionalOptionScopes||[]]]))}_cachedScopes(t,e){const i=this._scopeCache;let s=i.get(t);return s&&!e||(s=new Map,i.set(t,s)),s}getOptionScopes(t,e,i){const{options:s,type:n}=this,o=this._cachedScopes(t,i),a=o.get(e);if(a)return a;const r=new Set;e.forEach((e=>{t&&(r.add(t),e.forEach((e=>bn(r,t,e)))),e.forEach((t=>bn(r,s,t))),e.forEach((t=>bn(r,re[n]||{},t))),e.forEach((t=>bn(r,ue,t))),e.forEach((t=>bn(r,le,t)))}));const l=Array.from(r);return 0===l.length&&l.push(Object.create(null)),mn.has(e)&&o.set(e,l),l}chartOptionScopes(){const{options:t,type:e}=this;return[t,re[e]||{},ue.datasets[e]||{},{type:e},ue,le]}resolveNamedOptions(t,e,i,s=[""]){const o={$shared:!0},{resolver:a,subPrefixes:r}=yn(this._resolverCache,t,s);let l=a;if(function(t,e){const{isScriptable:i,isIndexable:s}=Ye(t);for(const o of e){const e=i(o),a=s(o),r=(a||e)&&t[o];if(e&&(S(r)||vn(r))||a&&n(r))return!0}return!1}(a,e)){o.$shared=!1;l=$e(a,i=S(i)?i():i,this.createResolver(t,i,r))}for(const t of e)o[t]=l[t];return o}createResolver(t,e,i=[""],s){const{resolver:n}=yn(this._resolverCache,t,i);return o(e)?$e(n,e,void 0,s):n}}function yn(t,e,i){let s=t.get(e);s||(s=new Map,t.set(e,s));const n=i.join();let o=s.get(n);if(!o){o={resolver:je(e,i),subPrefixes:i.filter((t=>!t.toLowerCase().includes("hover")))},s.set(n,o)}return o}const vn=t=>o(t)&&Object.getOwnPropertyNames(t).some((e=>S(t[e])));const Mn=["top","bottom","left","right","chartArea"];function wn(t,e){return"top"===t||"bottom"===t||-1===Mn.indexOf(t)&&"x"===e}function kn(t,e){return function(i,s){return i[t]===s[t]?i[e]-s[e]:i[t]-s[t]}}function Sn(t){const e=t.chart,i=e.options.animation;e.notifyPlugins("afterRender"),d(i&&i.onComplete,[t],e)}function Pn(t){const e=t.chart,i=e.options.animation;d(i&&i.onProgress,[t],e)}function Dn(t){return fe()&&"string"==typeof t?t=document.getElementById(t):t&&t.length&&(t=t[0]),t&&t.canvas&&(t=t.canvas),t}const Cn={},On=t=>{const e=Dn(t);return Object.values(Cn).filter((t=>t.canvas===e)).pop()};function An(t,e,i){const s=Object.keys(t);for(const n of s){const s=+n;if(s>=e){const o=t[n];delete t[n],(i>0||s>e)&&(t[s+i]=o)}}}class Tn{static defaults=ue;static instances=Cn;static overrides=re;static registry=nn;static version="4.5.1";static getChart=On;static register(...t){nn.add(...t),Ln()}static unregister(...t){nn.remove(...t),Ln()}constructor(t,e){const s=this.config=new _n(e),n=Dn(t),o=On(n);if(o)throw new Error("Canvas is already in use. Chart with ID '"+o.id+"' must be destroyed before the canvas with ID '"+o.canvas.id+"' can be reused.");const a=s.createResolver(s.chartOptionScopes(),this.getContext());this.platform=new(s.platform||Ps(n)),this.platform.updateConfig(s);const r=this.platform.acquireContext(n,a.aspectRatio),l=r&&r.canvas,h=l&&l.height,c=l&&l.width;this.id=i(),this.ctx=r,this.canvas=l,this.width=c,this.height=h,this._options=a,this._aspectRatio=this.aspectRatio,this._layers=[],this._metasets=[],this._stacks=void 0,this.boxes=[],this.currentDevicePixelRatio=void 0,this.chartArea=void 0,this._active=[],this._lastEvent=void 0,this._listeners={},this._responsiveListeners=void 0,this._sortedMetasets=[],this.scales={},this._plugins=new on,this.$proxies={},this._hiddenIndices={},this.attached=!1,this._animationsDisabled=void 0,this.$context=void 0,this._doResize=dt((t=>this.update(t)),a.resizeDelay||0),this._dataChanges=[],Cn[this.id]=this,r&&l?(bt.listen(this,"complete",Sn),bt.listen(this,"progress",Pn),this._initialize(),this.attached&&this.update()):console.error("Failed to create chart: can't acquire context from the given item")}get aspectRatio(){const{options:{aspectRatio:t,maintainAspectRatio:e},width:i,height:n,_aspectRatio:o}=this;return s(t)?e&&o?o:n?i/n:null:t}get data(){return this.config.data}set data(t){this.config.data=t}get options(){return this._options}set options(t){this.config.options=t}get registry(){return nn}_initialize(){return this.notifyPlugins("beforeInit"),this.options.responsive?this.resize():ke(this,this.options.devicePixelRatio),this.bindEvents(),this.notifyPlugins("afterInit"),this}clear(){return Te(this.canvas,this.ctx),this}stop(){return bt.stop(this),this}resize(t,e){bt.running(this)?this._resizeBeforeDraw={width:t,height:e}:this._resize(t,e)}_resize(t,e){const i=this.options,s=this.canvas,n=i.maintainAspectRatio&&this.aspectRatio,o=this.platform.getMaximumSize(s,t,e,n),a=i.devicePixelRatio||this.platform.getDevicePixelRatio(),r=this.width?"resize":"attach";this.width=o.width,this.height=o.height,this._aspectRatio=this.aspectRatio,ke(this,a,!0)&&(this.notifyPlugins("resize",{size:o}),d(i.onResize,[this,o],this),this.attached&&this._doResize(r)&&this.render())}ensureScalesHaveIDs(){u(this.options.scales||{},((t,e)=>{t.id=e}))}buildOrUpdateScales(){const t=this.options,e=t.scales,i=this.scales,s=Object.keys(i).reduce(((t,e)=>(t[e]=!1,t)),{});let n=[];e&&(n=n.concat(Object.keys(e).map((t=>{const i=e[t],s=cn(t,i),n="r"===s,o="x"===s;return{options:i,dposition:n?"chartArea":o?"bottom":"left",dtype:n?"radialLinear":o?"category":"linear"}})))),u(n,(e=>{const n=e.options,o=n.id,a=cn(o,n),r=l(n.type,e.dtype);void 0!==n.position&&wn(n.position,a)===wn(e.dposition)||(n.position=e.dposition),s[o]=!0;let h=null;if(o in i&&i[o].type===r)h=i[o];else{h=new(nn.getScale(r))({id:o,type:r,ctx:this.ctx,chart:this}),i[h.id]=h}h.init(n,t)})),u(s,((t,e)=>{t||delete i[e]})),u(i,(t=>{ls.configure(this,t,t.options),ls.addBox(this,t)}))}_updateMetasets(){const t=this._metasets,e=this.data.datasets.length,i=t.length;if(t.sort(((t,e)=>t.index-e.index)),i>e){for(let t=e;t<i;++t)this._destroyDatasetMeta(t);t.splice(e,i-e)}this._sortedMetasets=t.slice(0).sort(kn("order","index"))}_removeUnreferencedMetasets(){const{_metasets:t,data:{datasets:e}}=this;t.length>e.length&&delete this._stacks,t.forEach(((t,i)=>{0===e.filter((e=>e===t._dataset)).length&&this._destroyDatasetMeta(i)}))}buildOrUpdateControllers(){const t=[],e=this.data.datasets;let i,s;for(this._removeUnreferencedMetasets(),i=0,s=e.length;i<s;i++){const s=e[i];let n=this.getDatasetMeta(i);const o=s.type||this.config.type;if(n.type&&n.type!==o&&(this._destroyDatasetMeta(i),n=this.getDatasetMeta(i)),n.type=o,n.indexAxis=s.indexAxis||ln(o,this.options),n.order=s.order||0,n.index=i,n.label=""+s.label,n.visible=this.isDatasetVisible(i),n.controller)n.controller.updateIndex(i),n.controller.linkScales();else{const e=nn.getController(o),{datasetElementType:s,dataElementType:a}=ue.datasets[o];Object.assign(e,{dataElementType:nn.getElement(a),datasetElementType:s&&nn.getElement(s)}),n.controller=new e(this,i),t.push(n.controller)}}return this._updateMetasets(),t}_resetElements(){u(this.data.datasets,((t,e)=>{this.getDatasetMeta(e).controller.reset()}),this)}reset(){this._resetElements(),this.notifyPlugins("reset")}update(t){const e=this.config;e.update();const i=this._options=e.createResolver(e.chartOptionScopes(),this.getContext()),s=this._animationsDisabled=!i.animation;if(this._updateScales(),this._checkEventBindings(),this._updateHiddenIndices(),this._plugins.invalidate(),!1===this.notifyPlugins("beforeUpdate",{mode:t,cancelable:!0}))return;const n=this.buildOrUpdateControllers();this.notifyPlugins("beforeElementsUpdate");let o=0;for(let t=0,e=this.data.datasets.length;t<e;t++){const{controller:e}=this.getDatasetMeta(t),i=!s&&-1===n.indexOf(e);e.buildOrUpdateElements(i),o=Math.max(+e.getMaxOverflow(),o)}o=this._minPadding=i.layout.autoPadding?o:0,this._updateLayout(o),s||u(n,(t=>{t.reset()})),this._updateDatasets(t),this.notifyPlugins("afterUpdate",{mode:t}),this._layers.sort(kn("z","_idx"));const{_active:a,_lastEvent:r}=this;r?this._eventHandler(r,!0):a.length&&this._updateHoverStyles(a,a,!0),this.render()}_updateScales(){u(this.scales,(t=>{ls.removeBox(this,t)})),this.ensureScalesHaveIDs(),this.buildOrUpdateScales()}_checkEventBindings(){const t=this.options,e=new Set(Object.keys(this._listeners)),i=new Set(t.events);P(e,i)&&!!this._responsiveListeners===t.responsive||(this.unbindEvents(),this.bindEvents())}_updateHiddenIndices(){const{_hiddenIndices:t}=this,e=this._getUniformDataChanges()||[];for(const{method:i,start:s,count:n}of e){An(t,s,"_removeElements"===i?-n:n)}}_getUniformDataChanges(){const t=this._dataChanges;if(!t||!t.length)return;this._dataChanges=[];const e=this.data.datasets.length,i=e=>new Set(t.filter((t=>t[0]===e)).map(((t,e)=>e+","+t.splice(1).join(",")))),s=i(0);for(let t=1;t<e;t++)if(!P(s,i(t)))return;return Array.from(s).map((t=>t.split(","))).map((t=>({method:t[1],start:+t[2],count:+t[3]})))}_updateLayout(t){if(!1===this.notifyPlugins("beforeLayout",{cancelable:!0}))return;ls.update(this,this.width,this.height,t);const e=this.chartArea,i=e.width<=0||e.height<=0;this._layers=[],u(this.boxes,(t=>{i&&"chartArea"===t.position||(t.configure&&t.configure(),this._layers.push(...t._layers()))}),this),this._layers.forEach(((t,e)=>{t._idx=e})),this.notifyPlugins("afterLayout")}_updateDatasets(t){if(!1!==this.notifyPlugins("beforeDatasetsUpdate",{mode:t,cancelable:!0})){for(let t=0,e=this.data.datasets.length;t<e;++t)this.getDatasetMeta(t).controller.configure();for(let e=0,i=this.data.datasets.length;e<i;++e)this._updateDataset(e,S(t)?t({datasetIndex:e}):t);this.notifyPlugins("afterDatasetsUpdate",{mode:t})}}_updateDataset(t,e){const i=this.getDatasetMeta(t),s={meta:i,index:t,mode:e,cancelable:!0};!1!==this.notifyPlugins("beforeDatasetUpdate",s)&&(i.controller._update(e),s.cancelable=!1,this.notifyPlugins("afterDatasetUpdate",s))}render(){!1!==this.notifyPlugins("beforeRender",{cancelable:!0})&&(bt.has(this)?this.attached&&!bt.running(this)&&bt.start(this):(this.draw(),Sn({chart:this})))}draw(){let t;if(this._resizeBeforeDraw){const{width:t,height:e}=this._resizeBeforeDraw;this._resizeBeforeDraw=null,this._resize(t,e)}if(this.clear(),this.width<=0||this.height<=0)return;if(!1===this.notifyPlugins("beforeDraw",{cancelable:!0}))return;const e=this._layers;for(t=0;t<e.length&&e[t].z<=0;++t)e[t].draw(this.chartArea);for(this._drawDatasets();t<e.length;++t)e[t].draw(this.chartArea);this.notifyPlugins("afterDraw")}_getSortedDatasetMetas(t){const e=this._sortedMetasets,i=[];let s,n;for(s=0,n=e.length;s<n;++s){const n=e[s];t&&!n.visible||i.push(n)}return i}getSortedVisibleDatasetMetas(){return this._getSortedDatasetMetas(!0)}_drawDatasets(){if(!1===this.notifyPlugins("beforeDatasetsDraw",{cancelable:!0}))return;const t=this.getSortedVisibleDatasetMetas();for(let e=t.length-1;e>=0;--e)this._drawDataset(t[e]);this.notifyPlugins("afterDatasetsDraw")}_drawDataset(t){const e=this.ctx,i={meta:t,index:t.index,cancelable:!0},s=Ni(this,t);!1!==this.notifyPlugins("beforeDatasetDraw",i)&&(s&&Ie(e,s),t.controller.draw(),s&&ze(e),i.cancelable=!1,this.notifyPlugins("afterDatasetDraw",i))}isPointInArea(t){return Re(t,this.chartArea,this._minPadding)}getElementsAtEventForMode(t,e,i,s){const n=Ki.modes[e];return"function"==typeof n?n(this,t,i,s):[]}getDatasetMeta(t){const e=this.data.datasets[t],i=this._metasets;let s=i.filter((t=>t&&t._dataset===e)).pop();return s||(s={type:null,data:[],dataset:null,controller:null,hidden:null,xAxisID:null,yAxisID:null,order:e&&e.order||0,index:t,_dataset:e,_parsed:[],_sorted:!1},i.push(s)),s}getContext(){return this.$context||(this.$context=Ci(null,{chart:this,type:"chart"}))}getVisibleDatasetCount(){return this.getSortedVisibleDatasetMetas().length}isDatasetVisible(t){const e=this.data.datasets[t];if(!e)return!1;const i=this.getDatasetMeta(t);return"boolean"==typeof i.hidden?!i.hidden:!e.hidden}setDatasetVisibility(t,e){this.getDatasetMeta(t).hidden=!e}toggleDataVisibility(t){this._hiddenIndices[t]=!this._hiddenIndices[t]}getDataVisibility(t){return!this._hiddenIndices[t]}_updateVisibility(t,e,i){const s=i?"show":"hide",n=this.getDatasetMeta(t),o=n.controller._resolveAnimations(void 0,s);k(e)?(n.data[e].hidden=!i,this.update()):(this.setDatasetVisibility(t,i),o.update(n,{visible:i}),this.update((e=>e.datasetIndex===t?s:void 0)))}hide(t,e){this._updateVisibility(t,e,!1)}show(t,e){this._updateVisibility(t,e,!0)}_destroyDatasetMeta(t){const e=this._metasets[t];e&&e.controller&&e.controller._destroy(),delete this._metasets[t]}_stop(){let t,e;for(this.stop(),bt.remove(this),t=0,e=this.data.datasets.length;t<e;++t)this._destroyDatasetMeta(t)}destroy(){this.notifyPlugins("beforeDestroy");const{canvas:t,ctx:e}=this;this._stop(),this.config.clearCache(),t&&(this.unbindEvents(),Te(t,e),this.platform.releaseContext(e),this.canvas=null,this.ctx=null),delete Cn[this.id],this.notifyPlugins("afterDestroy")}toBase64Image(...t){return this.canvas.toDataURL(...t)}bindEvents(){this.bindUserEvents(),this.options.responsive?this.bindResponsiveEvents():this.attached=!0}bindUserEvents(){const t=this._listeners,e=this.platform,i=(i,s)=>{e.addEventListener(this,i,s),t[i]=s},s=(t,e,i)=>{t.offsetX=e,t.offsetY=i,this._eventHandler(t)};u(this.options.events,(t=>i(t,s)))}bindResponsiveEvents(){this._responsiveListeners||(this._responsiveListeners={});const t=this._responsiveListeners,e=this.platform,i=(i,s)=>{e.addEventListener(this,i,s),t[i]=s},s=(i,s)=>{t[i]&&(e.removeEventListener(this,i,s),delete t[i])},n=(t,e)=>{this.canvas&&this.resize(t,e)};let o;const a=()=>{s("attach",a),this.attached=!0,this.resize(),i("resize",n),i("detach",o)};o=()=>{this.attached=!1,s("resize",n),this._stop(),this._resize(0,0),i("attach",a)},e.isAttached(this.canvas)?a():o()}unbindEvents(){u(this._listeners,((t,e)=>{this.platform.removeEventListener(this,e,t)})),this._listeners={},u(this._responsiveListeners,((t,e)=>{this.platform.removeEventListener(this,e,t)})),this._responsiveListeners=void 0}updateHoverStyle(t,e,i){const s=i?"set":"remove";let n,o,a,r;for("dataset"===e&&(n=this.getDatasetMeta(t[0].datasetIndex),n.controller["_"+s+"DatasetHoverStyle"]()),a=0,r=t.length;a<r;++a){o=t[a];const e=o&&this.getDatasetMeta(o.datasetIndex).controller;e&&e[s+"HoverStyle"](o.element,o.datasetIndex,o.index)}}getActiveElements(){return this._active||[]}setActiveElements(t){const e=this._active||[],i=t.map((({datasetIndex:t,index:e})=>{const i=this.getDatasetMeta(t);if(!i)throw new Error("No dataset found at index "+t);return{datasetIndex:t,element:i.data[e],index:e}}));!f(i,e)&&(this._active=i,this._lastEvent=null,this._updateHoverStyles(i,e))}notifyPlugins(t,e,i){return this._plugins.notify(this,t,e,i)}isPluginEnabled(t){return 1===this._plugins._cache.filter((e=>e.plugin.id===t)).length}_updateHoverStyles(t,e,i){const s=this.options.hover,n=(t,e)=>t.filter((t=>!e.some((e=>t.datasetIndex===e.datasetIndex&&t.index===e.index)))),o=n(e,t),a=i?t:n(t,e);o.length&&this.updateHoverStyle(o,s.mode,!1),a.length&&s.mode&&this.updateHoverStyle(a,s.mode,!0)}_eventHandler(t,e){const i={event:t,replay:e,cancelable:!0,inChartArea:this.isPointInArea(t)},s=e=>(e.options.events||this.options.events).includes(t.native.type);if(!1===this.notifyPlugins("beforeEvent",i,s))return;const n=this._handleEvent(t,e,i.inChartArea);return i.cancelable=!1,this.notifyPlugins("afterEvent",i,s),(n||i.changed)&&this.render(),this}_handleEvent(t,e,i){const{_active:s=[],options:n}=this,o=e,a=this._getActiveElements(t,s,i,o),r=D(t),l=function(t,e,i,s){return i&&"mouseout"!==t.type?s?e:t:null}(t,this._lastEvent,i,r);i&&(this._lastEvent=null,d(n.onHover,[t,a,this],this),r&&d(n.onClick,[t,a,this],this));const h=!f(a,s);return(h||e)&&(this._active=a,this._updateHoverStyles(a,s,e)),this._lastEvent=l,h}_getActiveElements(t,e,i,s){if("mouseout"===t.type)return[];if(!i)return e;const n=this.options.hover;return this.getElementsAtEventForMode(t,n.mode,n,s)}}function Ln(){return u(Tn.instances,(t=>t._plugins.invalidate()))}function En(){throw new Error("This method is not implemented: Check that a complete date adapter is provided.")}class Rn{static override(t){Object.assign(Rn.prototype,t)}options;constructor(t){this.options=t||{}}init(){}formats(){return En()}parse(){return En()}format(){return En()}add(){return En()}diff(){return En()}startOf(){return En()}endOf(){return En()}}var In={_date:Rn};function zn(t){const e=t.iScale,i=function(t,e){if(!t._cache.$bar){const i=t.getMatchingVisibleMetas(e);let s=[];for(let e=0,n=i.length;e<n;e++)s=s.concat(i[e].controller.getAllParsedValues(t));t._cache.$bar=lt(s.sort(((t,e)=>t-e)))}return t._cache.$bar}(e,t.type);let s,n,o,a,r=e._length;const l=()=>{32767!==o&&-32768!==o&&(k(a)&&(r=Math.min(r,Math.abs(o-a)||r)),a=o)};for(s=0,n=i.length;s<n;++s)o=e.getPixelForValue(i[s]),l();for(a=void 0,s=0,n=e.ticks.length;s<n;++s)o=e.getPixelForTick(s),l();return r}function Fn(t,e,i,s){return n(t)?function(t,e,i,s){const n=i.parse(t[0],s),o=i.parse(t[1],s),a=Math.min(n,o),r=Math.max(n,o);let l=a,h=r;Math.abs(a)>Math.abs(r)&&(l=r,h=a),e[i.axis]=h,e._custom={barStart:l,barEnd:h,start:n,end:o,min:a,max:r}}(t,e,i,s):e[i.axis]=i.parse(t,s),e}function Vn(t,e,i,s){const n=t.iScale,o=t.vScale,a=n.getLabels(),r=n===o,l=[];let h,c,d,u;for(h=i,c=i+s;h<c;++h)u=e[h],d={},d[n.axis]=r||n.parse(a[h],h),l.push(Fn(u,d,o,h));return l}function Bn(t){return t&&void 0!==t.barStart&&void 0!==t.barEnd}function Wn(t,e,i,s){let n=e.borderSkipped;const o={};if(!n)return void(t.borderSkipped=o);if(!0===n)return void(t.borderSkipped={top:!0,right:!0,bottom:!0,left:!0});const{start:a,end:r,reverse:l,top:h,bottom:c}=function(t){let e,i,s,n,o;return t.horizontal?(e=t.base>t.x,i="left",s="right"):(e=t.base<t.y,i="bottom",s="top"),e?(n="end",o="start"):(n="start",o="end"),{start:i,end:s,reverse:e,top:n,bottom:o}}(t);"middle"===n&&i&&(t.enableBorderRadius=!0,(i._top||0)===s?n=h:(i._bottom||0)===s?n=c:(o[Nn(c,a,r,l)]=!0,n=h)),o[Nn(n,a,r,l)]=!0,t.borderSkipped=o}function Nn(t,e,i,s){var n,o,a;return s?(a=i,t=Hn(t=(n=t)===(o=e)?a:n===a?o:n,i,e)):t=Hn(t,e,i),t}function Hn(t,e,i){return"start"===t?e:"end"===t?i:t}function jn(t,{inflateAmount:e},i){t.inflateAmount="auto"===e?1===i?.33:0:e}class $n extends js{static id="doughnut";static defaults={datasetElementType:!1,dataElementType:"arc",animation:{animateRotate:!0,animateScale:!1},animations:{numbers:{type:"number",properties:["circumference","endAngle","innerRadius","outerRadius","startAngle","x","y","offset","borderWidth","spacing"]}},cutout:"50%",rotation:0,circumference:360,radius:"100%",spacing:0,indexAxis:"r"};static descriptors={_scriptable:t=>"spacing"!==t,_indexable:t=>"spacing"!==t&&!t.startsWith("borderDash")&&!t.startsWith("hoverBorderDash")};static overrides={aspectRatio:1,plugins:{legend:{labels:{generateLabels(t){const e=t.data,{labels:{pointStyle:i,textAlign:s,color:n,useBorderRadius:o,borderRadius:a}}=t.legend.options;return e.labels.length&&e.datasets.length?e.labels.map(((e,r)=>{const l=t.getDatasetMeta(0).controller.getStyle(r);return{text:e,fillStyle:l.backgroundColor,fontColor:n,hidden:!t.getDataVisibility(r),lineDash:l.borderDash,lineDashOffset:l.borderDashOffset,lineJoin:l.borderJoinStyle,lineWidth:l.borderWidth,strokeStyle:l.borderColor,textAlign:s,pointStyle:i,borderRadius:o&&(a||l.borderRadius),index:r}})):[]}},onClick(t,e,i){i.chart.toggleDataVisibility(e.index),i.chart.update()}}}};constructor(t,e){super(t,e),this.enableOptionSharing=!0,this.innerRadius=void 0,this.outerRadius=void 0,this.offsetX=void 0,this.offsetY=void 0}linkScales(){}parse(t,e){const i=this.getDataset().data,s=this._cachedMeta;if(!1===this._parsing)s._parsed=i;else{let n,a,r=t=>+i[t];if(o(i[t])){const{key:t="value"}=this._parsing;r=e=>+M(i[e],t)}for(n=t,a=t+e;n<a;++n)s._parsed[n]=r(n)}}_getRotation(){return $(this.options.rotation-90)}_getCircumference(){return $(this.options.circumference)}_getRotationExtents(){let t=O,e=-O;for(let i=0;i<this.chart.data.datasets.length;++i)if(this.chart.isDatasetVisible(i)&&this.chart.getDatasetMeta(i).type===this._type){const s=this.chart.getDatasetMeta(i).controller,n=s._getRotation(),o=s._getCircumference();t=Math.min(t,n),e=Math.max(e,n+o)}return{rotation:t,circumference:e-t}}update(t){const e=this.chart,{chartArea:i}=e,s=this._cachedMeta,n=s.data,o=this.getMaxBorderWidth()+this.getMaxOffset(n)+this.options.spacing,a=Math.max((Math.min(i.width,i.height)-o)/2,0),r=Math.min(h(this.options.cutout,a),1),l=this._getRingWeight(this.index),{circumference:d,rotation:u}=this._getRotationExtents(),{ratioX:f,ratioY:g,offsetX:p,offsetY:m}=function(t,e,i){let s=1,n=1,o=0,a=0;if(e<O){const r=t,l=r+e,h=Math.cos(r),c=Math.sin(r),d=Math.cos(l),u=Math.sin(l),f=(t,e,s)=>J(t,r,l,!0)?1:Math.max(e,e*i,s,s*i),g=(t,e,s)=>J(t,r,l,!0)?-1:Math.min(e,e*i,s,s*i),p=f(0,h,d),m=f(E,c,u),x=g(C,h,d),b=g(C+E,c,u);s=(p-x)/2,n=(m-b)/2,o=-(p+x)/2,a=-(m+b)/2}return{ratioX:s,ratioY:n,offsetX:o,offsetY:a}}(u,d,r),x=(i.width-o)/f,b=(i.height-o)/g,_=Math.max(Math.min(x,b)/2,0),y=c(this.options.radius,_),v=(y-Math.max(y*r,0))/this._getVisibleDatasetWeightTotal();this.offsetX=p*y,this.offsetY=m*y,s.total=this.calculateTotal(),this.outerRadius=y-v*this._getRingWeightOffset(this.index),this.innerRadius=Math.max(this.outerRadius-v*l,0),this.updateElements(n,0,n.length,t)}_circumference(t,e){const i=this.options,s=this._cachedMeta,n=this._getCircumference();return e&&i.animation.animateRotate||!this.chart.getDataVisibility(t)||null===s._parsed[t]||s.data[t].hidden?0:this.calculateCircumference(s._parsed[t]*n/O)}updateElements(t,e,i,s){const n="reset"===s,o=this.chart,a=o.chartArea,r=o.options.animation,l=(a.left+a.right)/2,h=(a.top+a.bottom)/2,c=n&&r.animateScale,d=c?0:this.innerRadius,u=c?0:this.outerRadius,{sharedOptions:f,includeOptions:g}=this._getSharedOptions(e,s);let p,m=this._getRotation();for(p=0;p<e;++p)m+=this._circumference(p,n);for(p=e;p<e+i;++p){const e=this._circumference(p,n),i=t[p],o={x:l+this.offsetX,y:h+this.offsetY,startAngle:m,endAngle:m+e,circumference:e,outerRadius:u,innerRadius:d};g&&(o.options=f||this.resolveDataElementOptions(p,i.active?"active":s)),m+=e,this.updateElement(i,p,o,s)}}calculateTotal(){const t=this._cachedMeta,e=t.data;let i,s=0;for(i=0;i<e.length;i++){const n=t._parsed[i];null===n||isNaN(n)||!this.chart.getDataVisibility(i)||e[i].hidden||(s+=Math.abs(n))}return s}calculateCircumference(t){const e=this._cachedMeta.total;return e>0&&!isNaN(t)?O*(Math.abs(t)/e):0}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart,s=i.data.labels||[],n=ne(e._parsed[t],i.options.locale);return{label:s[t]||"",value:n}}getMaxBorderWidth(t){let e=0;const i=this.chart;let s,n,o,a,r;if(!t)for(s=0,n=i.data.datasets.length;s<n;++s)if(i.isDatasetVisible(s)){o=i.getDatasetMeta(s),t=o.data,a=o.controller;break}if(!t)return 0;for(s=0,n=t.length;s<n;++s)r=a.resolveDataElementOptions(s),"inner"!==r.borderAlign&&(e=Math.max(e,r.borderWidth||0,r.hoverBorderWidth||0));return e}getMaxOffset(t){let e=0;for(let i=0,s=t.length;i<s;++i){const t=this.resolveDataElementOptions(i);e=Math.max(e,t.offset||0,t.hoverOffset||0)}return e}_getRingWeightOffset(t){let e=0;for(let i=0;i<t;++i)this.chart.isDatasetVisible(i)&&(e+=this._getRingWeight(i));return e}_getRingWeight(t){return Math.max(l(this.chart.data.datasets[t].weight,1),0)}_getVisibleDatasetWeightTotal(){return this._getRingWeightOffset(this.chart.data.datasets.length)||1}}class Yn extends js{static id="polarArea";static defaults={dataElementType:"arc",animation:{animateRotate:!0,animateScale:!0},animations:{numbers:{type:"number",properties:["x","y","startAngle","endAngle","innerRadius","outerRadius"]}},indexAxis:"r",startAngle:0};static overrides={aspectRatio:1,plugins:{legend:{labels:{generateLabels(t){const e=t.data;if(e.labels.length&&e.datasets.length){const{labels:{pointStyle:i,color:s}}=t.legend.options;return e.labels.map(((e,n)=>{const o=t.getDatasetMeta(0).controller.getStyle(n);return{text:e,fillStyle:o.backgroundColor,strokeStyle:o.borderColor,fontColor:s,lineWidth:o.borderWidth,pointStyle:i,hidden:!t.getDataVisibility(n),index:n}}))}return[]}},onClick(t,e,i){i.chart.toggleDataVisibility(e.index),i.chart.update()}}},scales:{r:{type:"radialLinear",angleLines:{display:!1},beginAtZero:!0,grid:{circular:!0},pointLabels:{display:!1},startAngle:0}}};constructor(t,e){super(t,e),this.innerRadius=void 0,this.outerRadius=void 0}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart,s=i.data.labels||[],n=ne(e._parsed[t].r,i.options.locale);return{label:s[t]||"",value:n}}parseObjectData(t,e,i,s){return ii.bind(this)(t,e,i,s)}update(t){const e=this._cachedMeta.data;this._updateRadius(),this.updateElements(e,0,e.length,t)}getMinMax(){const t=this._cachedMeta,e={min:Number.POSITIVE_INFINITY,max:Number.NEGATIVE_INFINITY};return t.data.forEach(((t,i)=>{const s=this.getParsed(i).r;!isNaN(s)&&this.chart.getDataVisibility(i)&&(s<e.min&&(e.min=s),s>e.max&&(e.max=s))})),e}_updateRadius(){const t=this.chart,e=t.chartArea,i=t.options,s=Math.min(e.right-e.left,e.bottom-e.top),n=Math.max(s/2,0),o=(n-Math.max(i.cutoutPercentage?n/100*i.cutoutPercentage:1,0))/t.getVisibleDatasetCount();this.outerRadius=n-o*this.index,this.innerRadius=this.outerRadius-o}updateElements(t,e,i,s){const n="reset"===s,o=this.chart,a=o.options.animation,r=this._cachedMeta.rScale,l=r.xCenter,h=r.yCenter,c=r.getIndexAngle(0)-.5*C;let d,u=c;const f=360/this.countVisibleElements();for(d=0;d<e;++d)u+=this._computeAngle(d,s,f);for(d=e;d<e+i;d++){const e=t[d];let i=u,g=u+this._computeAngle(d,s,f),p=o.getDataVisibility(d)?r.getDistanceFromCenterForValue(this.getParsed(d).r):0;u=g,n&&(a.animateScale&&(p=0),a.animateRotate&&(i=g=c));const m={x:l,y:h,innerRadius:0,outerRadius:p,startAngle:i,endAngle:g,options:this.resolveDataElementOptions(d,e.active?"active":s)};this.updateElement(e,d,m,s)}}countVisibleElements(){const t=this._cachedMeta;let e=0;return t.data.forEach(((t,i)=>{!isNaN(this.getParsed(i).r)&&this.chart.getDataVisibility(i)&&e++})),e}_computeAngle(t,e,i){return this.chart.getDataVisibility(t)?$(this.resolveDataElementOptions(t,e).angle||i):0}}var Un=Object.freeze({__proto__:null,BarController:class extends js{static id="bar";static defaults={datasetElementType:!1,dataElementType:"bar",categoryPercentage:.8,barPercentage:.9,grouped:!0,animations:{numbers:{type:"number",properties:["x","y","base","width","height"]}}};static overrides={scales:{_index_:{type:"category",offset:!0,grid:{offset:!0}},_value_:{type:"linear",beginAtZero:!0}}};parsePrimitiveData(t,e,i,s){return Vn(t,e,i,s)}parseArrayData(t,e,i,s){return Vn(t,e,i,s)}parseObjectData(t,e,i,s){const{iScale:n,vScale:o}=t,{xAxisKey:a="x",yAxisKey:r="y"}=this._parsing,l="x"===n.axis?a:r,h="x"===o.axis?a:r,c=[];let d,u,f,g;for(d=i,u=i+s;d<u;++d)g=e[d],f={},f[n.axis]=n.parse(M(g,l),d),c.push(Fn(M(g,h),f,o,d));return c}updateRangeFromParsed(t,e,i,s){super.updateRangeFromParsed(t,e,i,s);const n=i._custom;n&&e===this._cachedMeta.vScale&&(t.min=Math.min(t.min,n.min),t.max=Math.max(t.max,n.max))}getMaxOverflow(){return 0}getLabelAndValue(t){const e=this._cachedMeta,{iScale:i,vScale:s}=e,n=this.getParsed(t),o=n._custom,a=Bn(o)?"["+o.start+", "+o.end+"]":""+s.getLabelForValue(n[s.axis]);return{label:""+i.getLabelForValue(n[i.axis]),value:a}}initialize(){this.enableOptionSharing=!0,super.initialize();this._cachedMeta.stack=this.getDataset().stack}update(t){const e=this._cachedMeta;this.updateElements(e.data,0,e.data.length,t)}updateElements(t,e,i,n){const o="reset"===n,{index:a,_cachedMeta:{vScale:r}}=this,l=r.getBasePixel(),h=r.isHorizontal(),c=this._getRuler(),{sharedOptions:d,includeOptions:u}=this._getSharedOptions(e,n);for(let f=e;f<e+i;f++){const e=this.getParsed(f),i=o||s(e[r.axis])?{base:l,head:l}:this._calculateBarValuePixels(f),g=this._calculateBarIndexPixels(f,c),p=(e._stacks||{})[r.axis],m={horizontal:h,base:i.base,enableBorderRadius:!p||Bn(e._custom)||a===p._top||a===p._bottom,x:h?i.head:g.center,y:h?g.center:i.head,height:h?g.size:Math.abs(i.size),width:h?Math.abs(i.size):g.size};u&&(m.options=d||this.resolveDataElementOptions(f,t[f].active?"active":n));const x=m.options||t[f].options;Wn(m,x,p,a),jn(m,x,c.ratio),this.updateElement(t[f],f,m,n)}}_getStacks(t,e){const{iScale:i}=this._cachedMeta,n=i.getMatchingVisibleMetas(this._type).filter((t=>t.controller.options.grouped)),o=i.options.stacked,a=[],r=this._cachedMeta.controller.getParsed(e),l=r&&r[i.axis],h=t=>{const e=t._parsed.find((t=>t[i.axis]===l)),n=e&&e[t.vScale.axis];if(s(n)||isNaN(n))return!0};for(const i of n)if((void 0===e||!h(i))&&((!1===o||-1===a.indexOf(i.stack)||void 0===o&&void 0===i.stack)&&a.push(i.stack),i.index===t))break;return a.length||a.push(void 0),a}_getStackCount(t){return this._getStacks(void 0,t).length}_getAxisCount(){return this._getAxis().length}getFirstScaleIdForIndexAxis(){const t=this.chart.scales,e=this.chart.options.indexAxis;return Object.keys(t).filter((i=>t[i].axis===e)).shift()}_getAxis(){const t={},e=this.getFirstScaleIdForIndexAxis();for(const i of this.chart.data.datasets)t[l("x"===this.chart.options.indexAxis?i.xAxisID:i.yAxisID,e)]=!0;return Object.keys(t)}_getStackIndex(t,e,i){const s=this._getStacks(t,i),n=void 0!==e?s.indexOf(e):-1;return-1===n?s.length-1:n}_getRuler(){const t=this.options,e=this._cachedMeta,i=e.iScale,s=[];let n,o;for(n=0,o=e.data.length;n<o;++n)s.push(i.getPixelForValue(this.getParsed(n)[i.axis],n));const a=t.barThickness;return{min:a||zn(e),pixels:s,start:i._startPixel,end:i._endPixel,stackCount:this._getStackCount(),scale:i,grouped:t.grouped,ratio:a?1:t.categoryPercentage*t.barPercentage}}_calculateBarValuePixels(t){const{_cachedMeta:{vScale:e,_stacked:i,index:n},options:{base:o,minBarLength:a}}=this,r=o||0,l=this.getParsed(t),h=l._custom,c=Bn(h);let d,u,f=l[e.axis],g=0,p=i?this.applyStack(e,l,i):f;p!==f&&(g=p-f,p=f),c&&(f=h.barStart,p=h.barEnd-h.barStart,0!==f&&F(f)!==F(h.barEnd)&&(g=0),g+=f);const m=s(o)||c?g:o;let x=e.getPixelForValue(m);if(d=this.chart.getDataVisibility(t)?e.getPixelForValue(g+p):x,u=d-x,Math.abs(u)<a){u=function(t,e,i){return 0!==t?F(t):(e.isHorizontal()?1:-1)*(e.min>=i?1:-1)}(u,e,r)*a,f===r&&(x-=u/2);const t=e.getPixelForDecimal(0),s=e.getPixelForDecimal(1),o=Math.min(t,s),h=Math.max(t,s);x=Math.max(Math.min(x,h),o),d=x+u,i&&!c&&(l._stacks[e.axis]._visualValues[n]=e.getValueForPixel(d)-e.getValueForPixel(x))}if(x===e.getPixelForValue(r)){const t=F(u)*e.getLineWidthForValue(r)/2;x+=t,u-=t}return{size:u,base:x,head:d,center:d+u/2}}_calculateBarIndexPixels(t,e){const i=e.scale,n=this.options,o=n.skipNull,a=l(n.maxBarThickness,1/0);let r,h;const c=this._getAxisCount();if(e.grouped){const i=o?this._getStackCount(t):e.stackCount,d="flex"===n.barThickness?function(t,e,i,s){const n=e.pixels,o=n[t];let a=t>0?n[t-1]:null,r=t<n.length-1?n[t+1]:null;const l=i.categoryPercentage;null===a&&(a=o-(null===r?e.end-e.start:r-o)),null===r&&(r=o+o-a);const h=o-(o-Math.min(a,r))/2*l;return{chunk:Math.abs(r-a)/2*l/s,ratio:i.barPercentage,start:h}}(t,e,n,i*c):function(t,e,i,n){const o=i.barThickness;let a,r;return s(o)?(a=e.min*i.categoryPercentage,r=i.barPercentage):(a=o*n,r=1),{chunk:a/n,ratio:r,start:e.pixels[t]-a/2}}(t,e,n,i*c),u="x"===this.chart.options.indexAxis?this.getDataset().xAxisID:this.getDataset().yAxisID,f=this._getAxis().indexOf(l(u,this.getFirstScaleIdForIndexAxis())),g=this._getStackIndex(this.index,this._cachedMeta.stack,o?t:void 0)+f;r=d.start+d.chunk*g+d.chunk/2,h=Math.min(a,d.chunk*d.ratio)}else r=i.getPixelForValue(this.getParsed(t)[i.axis],t),h=Math.min(a,e.min*e.ratio);return{base:r-h/2,head:r+h/2,center:r,size:h}}draw(){const t=this._cachedMeta,e=t.vScale,i=t.data,s=i.length;let n=0;for(;n<s;++n)null===this.getParsed(n)[e.axis]||i[n].hidden||i[n].draw(this._ctx)}},BubbleController:class extends js{static id="bubble";static defaults={datasetElementType:!1,dataElementType:"point",animations:{numbers:{type:"number",properties:["x","y","borderWidth","radius"]}}};static overrides={scales:{x:{type:"linear"},y:{type:"linear"}}};initialize(){this.enableOptionSharing=!0,super.initialize()}parsePrimitiveData(t,e,i,s){const n=super.parsePrimitiveData(t,e,i,s);for(let t=0;t<n.length;t++)n[t]._custom=this.resolveDataElementOptions(t+i).radius;return n}parseArrayData(t,e,i,s){const n=super.parseArrayData(t,e,i,s);for(let t=0;t<n.length;t++){const s=e[i+t];n[t]._custom=l(s[2],this.resolveDataElementOptions(t+i).radius)}return n}parseObjectData(t,e,i,s){const n=super.parseObjectData(t,e,i,s);for(let t=0;t<n.length;t++){const s=e[i+t];n[t]._custom=l(s&&s.r&&+s.r,this.resolveDataElementOptions(t+i).radius)}return n}getMaxOverflow(){const t=this._cachedMeta.data;let e=0;for(let i=t.length-1;i>=0;--i)e=Math.max(e,t[i].size(this.resolveDataElementOptions(i))/2);return e>0&&e}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart.data.labels||[],{xScale:s,yScale:n}=e,o=this.getParsed(t),a=s.getLabelForValue(o.x),r=n.getLabelForValue(o.y),l=o._custom;return{label:i[t]||"",value:"("+a+", "+r+(l?", "+l:"")+")"}}update(t){const e=this._cachedMeta.data;this.updateElements(e,0,e.length,t)}updateElements(t,e,i,s){const n="reset"===s,{iScale:o,vScale:a}=this._cachedMeta,{sharedOptions:r,includeOptions:l}=this._getSharedOptions(e,s),h=o.axis,c=a.axis;for(let d=e;d<e+i;d++){const e=t[d],i=!n&&this.getParsed(d),u={},f=u[h]=n?o.getPixelForDecimal(.5):o.getPixelForValue(i[h]),g=u[c]=n?a.getBasePixel():a.getPixelForValue(i[c]);u.skip=isNaN(f)||isNaN(g),l&&(u.options=r||this.resolveDataElementOptions(d,e.active?"active":s),n&&(u.options.radius=0)),this.updateElement(e,d,u,s)}}resolveDataElementOptions(t,e){const i=this.getParsed(t);let s=super.resolveDataElementOptions(t,e);s.$shared&&(s=Object.assign({},s,{$shared:!1}));const n=s.radius;return"active"!==e&&(s.radius=0),s.radius+=l(i&&i._custom,n),s}},DoughnutController:$n,LineController:class extends js{static id="line";static defaults={datasetElementType:"line",dataElementType:"point",showLine:!0,spanGaps:!1};static overrides={scales:{_index_:{type:"category"},_value_:{type:"linear"}}};initialize(){this.enableOptionSharing=!0,this.supportsDecimation=!0,super.initialize()}update(t){const e=this._cachedMeta,{dataset:i,data:s=[],_dataset:n}=e,o=this.chart._animationsDisabled;let{start:a,count:r}=pt(e,s,o);this._drawStart=a,this._drawCount=r,mt(e)&&(a=0,r=s.length),i._chart=this.chart,i._datasetIndex=this.index,i._decimated=!!n._decimated,i.points=s;const l=this.resolveDatasetElementOptions(t);this.options.showLine||(l.borderWidth=0),l.segment=this.options.segment,this.updateElement(i,void 0,{animated:!o,options:l},t),this.updateElements(s,a,r,t)}updateElements(t,e,i,n){const o="reset"===n,{iScale:a,vScale:r,_stacked:l,_dataset:h}=this._cachedMeta,{sharedOptions:c,includeOptions:d}=this._getSharedOptions(e,n),u=a.axis,f=r.axis,{spanGaps:g,segment:p}=this.options,m=N(g)?g:Number.POSITIVE_INFINITY,x=this.chart._animationsDisabled||o||"none"===n,b=e+i,_=t.length;let y=e>0&&this.getParsed(e-1);for(let i=0;i<_;++i){const g=t[i],_=x?g:{};if(i<e||i>=b){_.skip=!0;continue}const v=this.getParsed(i),M=s(v[f]),w=_[u]=a.getPixelForValue(v[u],i),k=_[f]=o||M?r.getBasePixel():r.getPixelForValue(l?this.applyStack(r,v,l):v[f],i);_.skip=isNaN(w)||isNaN(k)||M,_.stop=i>0&&Math.abs(v[u]-y[u])>m,p&&(_.parsed=v,_.raw=h.data[i]),d&&(_.options=c||this.resolveDataElementOptions(i,g.active?"active":n)),x||this.updateElement(g,i,_,n),y=v}}getMaxOverflow(){const t=this._cachedMeta,e=t.dataset,i=e.options&&e.options.borderWidth||0,s=t.data||[];if(!s.length)return i;const n=s[0].size(this.resolveDataElementOptions(0)),o=s[s.length-1].size(this.resolveDataElementOptions(s.length-1));return Math.max(i,n,o)/2}draw(){const t=this._cachedMeta;t.dataset.updateControlPoints(this.chart.chartArea,t.iScale.axis),super.draw()}},PieController:class extends $n{static id="pie";static defaults={cutout:0,rotation:0,circumference:360,radius:"100%"}},PolarAreaController:Yn,RadarController:class extends js{static id="radar";static defaults={datasetElementType:"line",dataElementType:"point",indexAxis:"r",showLine:!0,elements:{line:{fill:"start"}}};static overrides={aspectRatio:1,scales:{r:{type:"radialLinear"}}};getLabelAndValue(t){const e=this._cachedMeta.vScale,i=this.getParsed(t);return{label:e.getLabels()[t],value:""+e.getLabelForValue(i[e.axis])}}parseObjectData(t,e,i,s){return ii.bind(this)(t,e,i,s)}update(t){const e=this._cachedMeta,i=e.dataset,s=e.data||[],n=e.iScale.getLabels();if(i.points=s,"resize"!==t){const e=this.resolveDatasetElementOptions(t);this.options.showLine||(e.borderWidth=0);const o={_loop:!0,_fullLoop:n.length===s.length,options:e};this.updateElement(i,void 0,o,t)}this.updateElements(s,0,s.length,t)}updateElements(t,e,i,s){const n=this._cachedMeta.rScale,o="reset"===s;for(let a=e;a<e+i;a++){const e=t[a],i=this.resolveDataElementOptions(a,e.active?"active":s),r=n.getPointPositionForValue(a,this.getParsed(a).r),l=o?n.xCenter:r.x,h=o?n.yCenter:r.y,c={x:l,y:h,angle:r.angle,skip:isNaN(l)||isNaN(h),options:i};this.updateElement(e,a,c,s)}}},ScatterController:class extends js{static id="scatter";static defaults={datasetElementType:!1,dataElementType:"point",showLine:!1,fill:!1};static overrides={interaction:{mode:"point"},scales:{x:{type:"linear"},y:{type:"linear"}}};getLabelAndValue(t){const e=this._cachedMeta,i=this.chart.data.labels||[],{xScale:s,yScale:n}=e,o=this.getParsed(t),a=s.getLabelForValue(o.x),r=n.getLabelForValue(o.y);return{label:i[t]||"",value:"("+a+", "+r+")"}}update(t){const e=this._cachedMeta,{data:i=[]}=e,s=this.chart._animationsDisabled;let{start:n,count:o}=pt(e,i,s);if(this._drawStart=n,this._drawCount=o,mt(e)&&(n=0,o=i.length),this.options.showLine){this.datasetElementType||this.addElements();const{dataset:n,_dataset:o}=e;n._chart=this.chart,n._datasetIndex=this.index,n._decimated=!!o._decimated,n.points=i;const a=this.resolveDatasetElementOptions(t);a.segment=this.options.segment,this.updateElement(n,void 0,{animated:!s,options:a},t)}else this.datasetElementType&&(delete e.dataset,this.datasetElementType=!1);this.updateElements(i,n,o,t)}addElements(){const{showLine:t}=this.options;!this.datasetElementType&&t&&(this.datasetElementType=this.chart.registry.getElement("line")),super.addElements()}updateElements(t,e,i,n){const o="reset"===n,{iScale:a,vScale:r,_stacked:l,_dataset:h}=this._cachedMeta,c=this.resolveDataElementOptions(e,n),d=this.getSharedOptions(c),u=this.includeOptions(n,d),f=a.axis,g=r.axis,{spanGaps:p,segment:m}=this.options,x=N(p)?p:Number.POSITIVE_INFINITY,b=this.chart._animationsDisabled||o||"none"===n;let _=e>0&&this.getParsed(e-1);for(let c=e;c<e+i;++c){const e=t[c],i=this.getParsed(c),p=b?e:{},y=s(i[g]),v=p[f]=a.getPixelForValue(i[f],c),M=p[g]=o||y?r.getBasePixel():r.getPixelForValue(l?this.applyStack(r,i,l):i[g],c);p.skip=isNaN(v)||isNaN(M)||y,p.stop=c>0&&Math.abs(i[f]-_[f])>x,m&&(p.parsed=i,p.raw=h.data[c]),u&&(p.options=d||this.resolveDataElementOptions(c,e.active?"active":n)),b||this.updateElement(e,c,p,n),_=i}this.updateSharedOptions(d,n,c)}getMaxOverflow(){const t=this._cachedMeta,e=t.data||[];if(!this.options.showLine){let t=0;for(let i=e.length-1;i>=0;--i)t=Math.max(t,e[i].size(this.resolveDataElementOptions(i))/2);return t>0&&t}const i=t.dataset,s=i.options&&i.options.borderWidth||0;if(!e.length)return s;const n=e[0].size(this.resolveDataElementOptions(0)),o=e[e.length-1].size(this.resolveDataElementOptions(e.length-1));return Math.max(s,n,o)/2}}});function Xn(t,e,i,s){const n=vi(t.options.borderRadius,["outerStart","outerEnd","innerStart","innerEnd"]);const o=(i-e)/2,a=Math.min(o,s*e/2),r=t=>{const e=(i-Math.min(o,t))*s/2;return Z(t,0,Math.min(o,e))};return{outerStart:r(n.outerStart),outerEnd:r(n.outerEnd),innerStart:Z(n.innerStart,0,a),innerEnd:Z(n.innerEnd,0,a)}}function qn(t,e,i,s){return{x:i+t*Math.cos(e),y:s+t*Math.sin(e)}}function Kn(t,e,i,s,n,o){const{x:a,y:r,startAngle:l,pixelMargin:h,innerRadius:c}=e,d=Math.max(e.outerRadius+s+i-h,0),u=c>0?c+s+i+h:0;let f=0;const g=n-l;if(s){const t=((c>0?c-s:0)+(d>0?d-s:0))/2;f=(g-(0!==t?g*t/(t+s):g))/2}const p=(g-Math.max(.001,g*d-i/C)/d)/2,m=l+p+f,x=n-p-f,{outerStart:b,outerEnd:_,innerStart:y,innerEnd:v}=Xn(e,u,d,x-m),M=d-b,w=d-_,k=m+b/M,S=x-_/w,P=u+y,D=u+v,O=m+y/P,A=x-v/D;if(t.beginPath(),o){const e=(k+S)/2;if(t.arc(a,r,d,k,e),t.arc(a,r,d,e,S),_>0){const e=qn(w,S,a,r);t.arc(e.x,e.y,_,S,x+E)}const i=qn(D,x,a,r);if(t.lineTo(i.x,i.y),v>0){const e=qn(D,A,a,r);t.arc(e.x,e.y,v,x+E,A+Math.PI)}const s=(x-v/u+(m+y/u))/2;if(t.arc(a,r,u,x-v/u,s,!0),t.arc(a,r,u,s,m+y/u,!0),y>0){const e=qn(P,O,a,r);t.arc(e.x,e.y,y,O+Math.PI,m-E)}const n=qn(M,m,a,r);if(t.lineTo(n.x,n.y),b>0){const e=qn(M,k,a,r);t.arc(e.x,e.y,b,m-E,k)}}else{t.moveTo(a,r);const e=Math.cos(k)*d+a,i=Math.sin(k)*d+r;t.lineTo(e,i);const s=Math.cos(S)*d+a,n=Math.sin(S)*d+r;t.lineTo(s,n)}t.closePath()}function Gn(t,e,i,s,n){const{fullCircles:o,startAngle:a,circumference:r,options:l}=e,{borderWidth:h,borderJoinStyle:c,borderDash:d,borderDashOffset:u,borderRadius:f}=l,g="inner"===l.borderAlign;if(!h)return;t.setLineDash(d||[]),t.lineDashOffset=u,g?(t.lineWidth=2*h,t.lineJoin=c||"round"):(t.lineWidth=h,t.lineJoin=c||"bevel");let p=e.endAngle;if(o){Kn(t,e,i,s,p,n);for(let e=0;e<o;++e)t.stroke();isNaN(r)||(p=a+(r%O||O))}g&&function(t,e,i){const{startAngle:s,pixelMargin:n,x:o,y:a,outerRadius:r,innerRadius:l}=e;let h=n/r;t.beginPath(),t.arc(o,a,r,s-h,i+h),l>n?(h=n/l,t.arc(o,a,l,i+h,s-h,!0)):t.arc(o,a,n,i+E,s-E),t.closePath(),t.clip()}(t,e,p),l.selfJoin&&p-a>=C&&0===f&&"miter"!==c&&function(t,e,i){const{startAngle:s,x:n,y:o,outerRadius:a,innerRadius:r,options:l}=e,{borderWidth:h,borderJoinStyle:c}=l,d=Math.min(h/a,G(s-i));if(t.beginPath(),t.arc(n,o,a-h/2,s+d/2,i-d/2),r>0){const e=Math.min(h/r,G(s-i));t.arc(n,o,r+h/2,i-e/2,s+e/2,!0)}else{const e=Math.min(h/2,a*G(s-i));if("round"===c)t.arc(n,o,e,i-C/2,s+C/2,!0);else if("bevel"===c){const a=2*e*e,r=-a*Math.cos(i+C/2)+n,l=-a*Math.sin(i+C/2)+o,h=a*Math.cos(s+C/2)+n,c=a*Math.sin(s+C/2)+o;t.lineTo(r,l),t.lineTo(h,c)}}t.closePath(),t.moveTo(0,0),t.rect(0,0,t.canvas.width,t.canvas.height),t.clip("evenodd")}(t,e,p),o||(Kn(t,e,i,s,p,n),t.stroke())}function Jn(t,e,i=e){t.lineCap=l(i.borderCapStyle,e.borderCapStyle),t.setLineDash(l(i.borderDash,e.borderDash)),t.lineDashOffset=l(i.borderDashOffset,e.borderDashOffset),t.lineJoin=l(i.borderJoinStyle,e.borderJoinStyle),t.lineWidth=l(i.borderWidth,e.borderWidth),t.strokeStyle=l(i.borderColor,e.borderColor)}function Zn(t,e,i){t.lineTo(i.x,i.y)}function Qn(t,e,i={}){const s=t.length,{start:n=0,end:o=s-1}=i,{start:a,end:r}=e,l=Math.max(n,a),h=Math.min(o,r),c=n<a&&o<a||n>r&&o>r;return{count:s,start:l,loop:e.loop,ilen:h<l&&!c?s+h-l:h-l}}function to(t,e,i,s){const{points:n,options:o}=e,{count:a,start:r,loop:l,ilen:h}=Qn(n,i,s),c=function(t){return t.stepped?Fe:t.tension||"monotone"===t.cubicInterpolationMode?Ve:Zn}(o);let d,u,f,{move:g=!0,reverse:p}=s||{};for(d=0;d<=h;++d)u=n[(r+(p?h-d:d))%a],u.skip||(g?(t.moveTo(u.x,u.y),g=!1):c(t,f,u,p,o.stepped),f=u);return l&&(u=n[(r+(p?h:0))%a],c(t,f,u,p,o.stepped)),!!l}function eo(t,e,i,s){const n=e.points,{count:o,start:a,ilen:r}=Qn(n,i,s),{move:l=!0,reverse:h}=s||{};let c,d,u,f,g,p,m=0,x=0;const b=t=>(a+(h?r-t:t))%o,_=()=>{f!==g&&(t.lineTo(m,g),t.lineTo(m,f),t.lineTo(m,p))};for(l&&(d=n[b(0)],t.moveTo(d.x,d.y)),c=0;c<=r;++c){if(d=n[b(c)],d.skip)continue;const e=d.x,i=d.y,s=0|e;s===u?(i<f?f=i:i>g&&(g=i),m=(x*m+e)/++x):(_(),t.lineTo(e,i),u=s,x=0,f=g=i),p=i}_()}function io(t){const e=t.options,i=e.borderDash&&e.borderDash.length;return!(t._decimated||t._loop||e.tension||"monotone"===e.cubicInterpolationMode||e.stepped||i)?eo:to}const so="function"==typeof Path2D;function no(t,e,i,s){so&&!e.options.segment?function(t,e,i,s){let n=e._path;n||(n=e._path=new Path2D,e.path(n,i,s)&&n.closePath()),Jn(t,e.options),t.stroke(n)}(t,e,i,s):function(t,e,i,s){const{segments:n,options:o}=e,a=io(e);for(const r of n)Jn(t,o,r.style),t.beginPath(),a(t,e,r,{start:i,end:i+s-1})&&t.closePath(),t.stroke()}(t,e,i,s)}class oo extends $s{static id="line";static defaults={borderCapStyle:"butt",borderDash:[],borderDashOffset:0,borderJoinStyle:"miter",borderWidth:3,capBezierPoints:!0,cubicInterpolationMode:"default",fill:!1,spanGaps:!1,stepped:!1,tension:0};static defaultRoutes={backgroundColor:"backgroundColor",borderColor:"borderColor"};static descriptors={_scriptable:!0,_indexable:t=>"borderDash"!==t&&"fill"!==t};constructor(t){super(),this.animated=!0,this.options=void 0,this._chart=void 0,this._loop=void 0,this._fullLoop=void 0,this._path=void 0,this._points=void 0,this._segments=void 0,this._decimated=!1,this._pointsUpdated=!1,this._datasetIndex=void 0,t&&Object.assign(this,t)}updateControlPoints(t,e){const i=this.options;if((i.tension||"monotone"===i.cubicInterpolationMode)&&!i.stepped&&!this._pointsUpdated){const s=i.spanGaps?this._loop:this._fullLoop;hi(this._points,i,t,s,e),this._pointsUpdated=!0}}set points(t){this._points=t,delete this._segments,delete this._path,this._pointsUpdated=!1}get points(){return this._points}get segments(){return this._segments||(this._segments=zi(this,this.options.segment))}first(){const t=this.segments,e=this.points;return t.length&&e[t[0].start]}last(){const t=this.segments,e=this.points,i=t.length;return i&&e[t[i-1].end]}interpolate(t,e){const i=this.options,s=t[e],n=this.points,o=Ii(this,{property:e,start:s,end:s});if(!o.length)return;const a=[],r=function(t){return t.stepped?pi:t.tension||"monotone"===t.cubicInterpolationMode?mi:gi}(i);let l,h;for(l=0,h=o.length;l<h;++l){const{start:h,end:c}=o[l],d=n[h],u=n[c];if(d===u){a.push(d);continue}const f=r(d,u,Math.abs((s-d[e])/(u[e]-d[e])),i.stepped);f[e]=t[e],a.push(f)}return 1===a.length?a[0]:a}pathSegment(t,e,i){return io(this)(t,this,e,i)}path(t,e,i){const s=this.segments,n=io(this);let o=this._loop;e=e||0,i=i||this.points.length-e;for(const a of s)o&=n(t,this,a,{start:e,end:e+i-1});return!!o}draw(t,e,i,s){const n=this.options||{};(this.points||[]).length&&n.borderWidth&&(t.save(),no(t,this,i,s),t.restore()),this.animated&&(this._pointsUpdated=!1,this._path=void 0)}}function ao(t,e,i,s){const n=t.options,{[i]:o}=t.getProps([i],s);return Math.abs(e-o)<n.radius+n.hitRadius}function ro(t,e){const{x:i,y:s,base:n,width:o,height:a}=t.getProps(["x","y","base","width","height"],e);let r,l,h,c,d;return t.horizontal?(d=a/2,r=Math.min(i,n),l=Math.max(i,n),h=s-d,c=s+d):(d=o/2,r=i-d,l=i+d,h=Math.min(s,n),c=Math.max(s,n)),{left:r,top:h,right:l,bottom:c}}function lo(t,e,i,s){return t?0:Z(e,i,s)}function ho(t){const e=ro(t),i=e.right-e.left,s=e.bottom-e.top,n=function(t,e,i){const s=t.options.borderWidth,n=t.borderSkipped,o=Mi(s);return{t:lo(n.top,o.top,0,i),r:lo(n.right,o.right,0,e),b:lo(n.bottom,o.bottom,0,i),l:lo(n.left,o.left,0,e)}}(t,i/2,s/2),a=function(t,e,i){const{enableBorderRadius:s}=t.getProps(["enableBorderRadius"]),n=t.options.borderRadius,a=wi(n),r=Math.min(e,i),l=t.borderSkipped,h=s||o(n);return{topLeft:lo(!h||l.top||l.left,a.topLeft,0,r),topRight:lo(!h||l.top||l.right,a.topRight,0,r),bottomLeft:lo(!h||l.bottom||l.left,a.bottomLeft,0,r),bottomRight:lo(!h||l.bottom||l.right,a.bottomRight,0,r)}}(t,i/2,s/2);return{outer:{x:e.left,y:e.top,w:i,h:s,radius:a},inner:{x:e.left+n.l,y:e.top+n.t,w:i-n.l-n.r,h:s-n.t-n.b,radius:{topLeft:Math.max(0,a.topLeft-Math.max(n.t,n.l)),topRight:Math.max(0,a.topRight-Math.max(n.t,n.r)),bottomLeft:Math.max(0,a.bottomLeft-Math.max(n.b,n.l)),bottomRight:Math.max(0,a.bottomRight-Math.max(n.b,n.r))}}}}function co(t,e,i,s){const n=null===e,o=null===i,a=t&&!(n&&o)&&ro(t,s);return a&&(n||tt(e,a.left,a.right))&&(o||tt(i,a.top,a.bottom))}function uo(t,e){t.rect(e.x,e.y,e.w,e.h)}function fo(t,e,i={}){const s=t.x!==i.x?-e:0,n=t.y!==i.y?-e:0,o=(t.x+t.w!==i.x+i.w?e:0)-s,a=(t.y+t.h!==i.y+i.h?e:0)-n;return{x:t.x+s,y:t.y+n,w:t.w+o,h:t.h+a,radius:t.radius}}var go=Object.freeze({__proto__:null,ArcElement:class extends $s{static id="arc";static defaults={borderAlign:"center",borderColor:"#fff",borderDash:[],borderDashOffset:0,borderJoinStyle:void 0,borderRadius:0,borderWidth:2,offset:0,spacing:0,angle:void 0,circular:!0,selfJoin:!1};static defaultRoutes={backgroundColor:"backgroundColor"};static descriptors={_scriptable:!0,_indexable:t=>"borderDash"!==t};circumference;endAngle;fullCircles;innerRadius;outerRadius;pixelMargin;startAngle;constructor(t){super(),this.options=void 0,this.circumference=void 0,this.startAngle=void 0,this.endAngle=void 0,this.innerRadius=void 0,this.outerRadius=void 0,this.pixelMargin=0,this.fullCircles=0,t&&Object.assign(this,t)}inRange(t,e,i){const s=this.getProps(["x","y"],i),{angle:n,distance:o}=X(s,{x:t,y:e}),{startAngle:a,endAngle:r,innerRadius:h,outerRadius:c,circumference:d}=this.getProps(["startAngle","endAngle","innerRadius","outerRadius","circumference"],i),u=(this.options.spacing+this.options.borderWidth)/2,f=l(d,r-a),g=J(n,a,r)&&a!==r,p=f>=O||g,m=tt(o,h+u,c+u);return p&&m}getCenterPoint(t){const{x:e,y:i,startAngle:s,endAngle:n,innerRadius:o,outerRadius:a}=this.getProps(["x","y","startAngle","endAngle","innerRadius","outerRadius"],t),{offset:r,spacing:l}=this.options,h=(s+n)/2,c=(o+a+l+r)/2;return{x:e+Math.cos(h)*c,y:i+Math.sin(h)*c}}tooltipPosition(t){return this.getCenterPoint(t)}draw(t){const{options:e,circumference:i}=this,s=(e.offset||0)/4,n=(e.spacing||0)/2,o=e.circular;if(this.pixelMargin="inner"===e.borderAlign?.33:0,this.fullCircles=i>O?Math.floor(i/O):0,0===i||this.innerRadius<0||this.outerRadius<0)return;t.save();const a=(this.startAngle+this.endAngle)/2;t.translate(Math.cos(a)*s,Math.sin(a)*s);const r=s*(1-Math.sin(Math.min(C,i||0)));t.fillStyle=e.backgroundColor,t.strokeStyle=e.borderColor,function(t,e,i,s,n){const{fullCircles:o,startAngle:a,circumference:r}=e;let l=e.endAngle;if(o){Kn(t,e,i,s,l,n);for(let e=0;e<o;++e)t.fill();isNaN(r)||(l=a+(r%O||O))}Kn(t,e,i,s,l,n),t.fill()}(t,this,r,n,o),Gn(t,this,r,n,o),t.restore()}},BarElement:class extends $s{static id="bar";static defaults={borderSkipped:"start",borderWidth:0,borderRadius:0,inflateAmount:"auto",pointStyle:void 0};static defaultRoutes={backgroundColor:"backgroundColor",borderColor:"borderColor"};constructor(t){super(),this.options=void 0,this.horizontal=void 0,this.base=void 0,this.width=void 0,this.height=void 0,this.inflateAmount=void 0,t&&Object.assign(this,t)}draw(t){const{inflateAmount:e,options:{borderColor:i,backgroundColor:s}}=this,{inner:n,outer:o}=ho(this),a=(r=o.radius).topLeft||r.topRight||r.bottomLeft||r.bottomRight?He:uo;var r;t.save(),o.w===n.w&&o.h===n.h||(t.beginPath(),a(t,fo(o,e,n)),t.clip(),a(t,fo(n,-e,o)),t.fillStyle=i,t.fill("evenodd")),t.beginPath(),a(t,fo(n,e)),t.fillStyle=s,t.fill(),t.restore()}inRange(t,e,i){return co(this,t,e,i)}inXRange(t,e){return co(this,t,null,e)}inYRange(t,e){return co(this,null,t,e)}getCenterPoint(t){const{x:e,y:i,base:s,horizontal:n}=this.getProps(["x","y","base","horizontal"],t);return{x:n?(e+s)/2:e,y:n?i:(i+s)/2}}getRange(t){return"x"===t?this.width/2:this.height/2}},LineElement:oo,PointElement:class extends $s{static id="point";parsed;skip;stop;static defaults={borderWidth:1,hitRadius:1,hoverBorderWidth:1,hoverRadius:4,pointStyle:"circle",radius:3,rotation:0};static defaultRoutes={backgroundColor:"backgroundColor",borderColor:"borderColor"};constructor(t){super(),this.options=void 0,this.parsed=void 0,this.skip=void 0,this.stop=void 0,t&&Object.assign(this,t)}inRange(t,e,i){const s=this.options,{x:n,y:o}=this.getProps(["x","y"],i);return Math.pow(t-n,2)+Math.pow(e-o,2)<Math.pow(s.hitRadius+s.radius,2)}inXRange(t,e){return ao(this,t,"x",e)}inYRange(t,e){return ao(this,t,"y",e)}getCenterPoint(t){const{x:e,y:i}=this.getProps(["x","y"],t);return{x:e,y:i}}size(t){let e=(t=t||this.options||{}).radius||0;e=Math.max(e,e&&t.hoverRadius||0);return 2*(e+(e&&t.borderWidth||0))}draw(t,e){const i=this.options;this.skip||i.radius<.1||!Re(this,e,this.size(i)/2)||(t.strokeStyle=i.borderColor,t.lineWidth=i.borderWidth,t.fillStyle=i.backgroundColor,Le(t,i,this.x,this.y))}getRange(){const t=this.options||{};return t.radius+t.hitRadius}}});function po(t,e,i,s){const n=t.indexOf(e);if(-1===n)return((t,e,i,s)=>("string"==typeof e?(i=t.push(e)-1,s.unshift({index:i,label:e})):isNaN(e)&&(i=null),i))(t,e,i,s);return n!==t.lastIndexOf(e)?i:n}function mo(t){const e=this.getLabels();return t>=0&&t<e.length?e[t]:t}function xo(t,e,{horizontal:i,minRotation:s}){const n=$(s),o=(i?Math.sin(n):Math.cos(n))||.001,a=.75*e*(""+t).length;return Math.min(e/o,a)}class bo extends tn{constructor(t){super(t),this.start=void 0,this.end=void 0,this._startValue=void 0,this._endValue=void 0,this._valueRange=0}parse(t,e){return s(t)||("number"==typeof t||t instanceof Number)&&!isFinite(+t)?null:+t}handleTickRangeOptions(){const{beginAtZero:t}=this.options,{minDefined:e,maxDefined:i}=this.getUserBounds();let{min:s,max:n}=this;const o=t=>s=e?s:t,a=t=>n=i?n:t;if(t){const t=F(s),e=F(n);t<0&&e<0?a(0):t>0&&e>0&&o(0)}if(s===n){let e=0===n?1:Math.abs(.05*n);a(n+e),t||o(s-e)}this.min=s,this.max=n}getTickLimit(){const t=this.options.ticks;let e,{maxTicksLimit:i,stepSize:s}=t;return s?(e=Math.ceil(this.max/s)-Math.floor(this.min/s)+1,e>1e3&&(console.warn(`scales.${this.id}.ticks.stepSize: ${s} would result generating up to ${e} ticks. Limiting to 1000.`),e=1e3)):(e=this.computeTickLimit(),i=i||11),i&&(e=Math.min(i,e)),e}computeTickLimit(){return Number.POSITIVE_INFINITY}buildTicks(){const t=this.options,e=t.ticks;let i=this.getTickLimit();i=Math.max(2,i);const n=function(t,e){const i=[],{bounds:n,step:o,min:a,max:r,precision:l,count:h,maxTicks:c,maxDigits:d,includeBounds:u}=t,f=o||1,g=c-1,{min:p,max:m}=e,x=!s(a),b=!s(r),_=!s(h),y=(m-p)/(d+1);let v,M,w,k,S=B((m-p)/g/f)*f;if(S<1e-14&&!x&&!b)return[{value:p},{value:m}];k=Math.ceil(m/S)-Math.floor(p/S),k>g&&(S=B(k*S/g/f)*f),s(l)||(v=Math.pow(10,l),S=Math.ceil(S*v)/v),"ticks"===n?(M=Math.floor(p/S)*S,w=Math.ceil(m/S)*S):(M=p,w=m),x&&b&&o&&H((r-a)/o,S/1e3)?(k=Math.round(Math.min((r-a)/S,c)),S=(r-a)/k,M=a,w=r):_?(M=x?a:M,w=b?r:w,k=h-1,S=(w-M)/k):(k=(w-M)/S,k=V(k,Math.round(k),S/1e3)?Math.round(k):Math.ceil(k));const P=Math.max(U(S),U(M));v=Math.pow(10,s(l)?P:l),M=Math.round(M*v)/v,w=Math.round(w*v)/v;let D=0;for(x&&(u&&M!==a?(i.push({value:a}),M<a&&D++,V(Math.round((M+D*S)*v)/v,a,xo(a,y,t))&&D++):M<a&&D++);D<k;++D){const t=Math.round((M+D*S)*v)/v;if(b&&t>r)break;i.push({value:t})}return b&&u&&w!==r?i.length&&V(i[i.length-1].value,r,xo(r,y,t))?i[i.length-1].value=r:i.push({value:r}):b&&w!==r||i.push({value:w}),i}({maxTicks:i,bounds:t.bounds,min:t.min,max:t.max,precision:e.precision,step:e.stepSize,count:e.count,maxDigits:this._maxDigits(),horizontal:this.isHorizontal(),minRotation:e.minRotation||0,includeBounds:!1!==e.includeBounds},this._range||this);return"ticks"===t.bounds&&j(n,this,"value"),t.reverse?(n.reverse(),this.start=this.max,this.end=this.min):(this.start=this.min,this.end=this.max),n}configure(){const t=this.ticks;let e=this.min,i=this.max;if(super.configure(),this.options.offset&&t.length){const s=(i-e)/Math.max(t.length-1,1)/2;e-=s,i+=s}this._startValue=e,this._endValue=i,this._valueRange=i-e}getLabelForValue(t){return ne(t,this.chart.options.locale,this.options.ticks.format)}}class _o extends bo{static id="linear";static defaults={ticks:{callback:ae.formatters.numeric}};determineDataLimits(){const{min:t,max:e}=this.getMinMax(!0);this.min=a(t)?t:0,this.max=a(e)?e:1,this.handleTickRangeOptions()}computeTickLimit(){const t=this.isHorizontal(),e=t?this.width:this.height,i=$(this.options.ticks.minRotation),s=(t?Math.sin(i):Math.cos(i))||.001,n=this._resolveTickFontOptions(0);return Math.ceil(e/Math.min(40,n.lineHeight/s))}getPixelForValue(t){return null===t?NaN:this.getPixelForDecimal((t-this._startValue)/this._valueRange)}getValueForPixel(t){return this._startValue+this.getDecimalForPixel(t)*this._valueRange}}const yo=t=>Math.floor(z(t)),vo=(t,e)=>Math.pow(10,yo(t)+e);function Mo(t){return 1===t/Math.pow(10,yo(t))}function wo(t,e,i){const s=Math.pow(10,i),n=Math.floor(t/s);return Math.ceil(e/s)-n}function ko(t,{min:e,max:i}){e=r(t.min,e);const s=[],n=yo(e);let o=function(t,e){let i=yo(e-t);for(;wo(t,e,i)>10;)i++;for(;wo(t,e,i)<10;)i--;return Math.min(i,yo(t))}(e,i),a=o<0?Math.pow(10,Math.abs(o)):1;const l=Math.pow(10,o),h=n>o?Math.pow(10,n):0,c=Math.round((e-h)*a)/a,d=Math.floor((e-h)/l/10)*l*10;let u=Math.floor((c-d)/Math.pow(10,o)),f=r(t.min,Math.round((h+d+u*Math.pow(10,o))*a)/a);for(;f<i;)s.push({value:f,major:Mo(f),significand:u}),u>=10?u=u<15?15:20:u++,u>=20&&(o++,u=2,a=o>=0?1:a),f=Math.round((h+d+u*Math.pow(10,o))*a)/a;const g=r(t.max,f);return s.push({value:g,major:Mo(g),significand:u}),s}class So extends tn{static id="logarithmic";static defaults={ticks:{callback:ae.formatters.logarithmic,major:{enabled:!0}}};constructor(t){super(t),this.start=void 0,this.end=void 0,this._startValue=void 0,this._valueRange=0}parse(t,e){const i=bo.prototype.parse.apply(this,[t,e]);if(0!==i)return a(i)&&i>0?i:null;this._zero=!0}determineDataLimits(){const{min:t,max:e}=this.getMinMax(!0);this.min=a(t)?Math.max(0,t):null,this.max=a(e)?Math.max(0,e):null,this.options.beginAtZero&&(this._zero=!0),this._zero&&this.min!==this._suggestedMin&&!a(this._userMin)&&(this.min=t===vo(this.min,0)?vo(this.min,-1):vo(this.min,0)),this.handleTickRangeOptions()}handleTickRangeOptions(){const{minDefined:t,maxDefined:e}=this.getUserBounds();let i=this.min,s=this.max;const n=e=>i=t?i:e,o=t=>s=e?s:t;i===s&&(i<=0?(n(1),o(10)):(n(vo(i,-1)),o(vo(s,1)))),i<=0&&n(vo(s,-1)),s<=0&&o(vo(i,1)),this.min=i,this.max=s}buildTicks(){const t=this.options,e=ko({min:this._userMin,max:this._userMax},this);return"ticks"===t.bounds&&j(e,this,"value"),t.reverse?(e.reverse(),this.start=this.max,this.end=this.min):(this.start=this.min,this.end=this.max),e}getLabelForValue(t){return void 0===t?"0":ne(t,this.chart.options.locale,this.options.ticks.format)}configure(){const t=this.min;super.configure(),this._startValue=z(t),this._valueRange=z(this.max)-z(t)}getPixelForValue(t){return void 0!==t&&0!==t||(t=this.min),null===t||isNaN(t)?NaN:this.getPixelForDecimal(t===this.min?0:(z(t)-this._startValue)/this._valueRange)}getValueForPixel(t){const e=this.getDecimalForPixel(t);return Math.pow(10,this._startValue+e*this._valueRange)}}function Po(t){const e=t.ticks;if(e.display&&t.display){const t=ki(e.backdropPadding);return l(e.font&&e.font.size,ue.font.size)+t.height}return 0}function Do(t,e,i,s,n){return t===s||t===n?{start:e-i/2,end:e+i/2}:t<s||t>n?{start:e-i,end:e}:{start:e,end:e+i}}function Co(t){const e={l:t.left+t._padding.left,r:t.right-t._padding.right,t:t.top+t._padding.top,b:t.bottom-t._padding.bottom},i=Object.assign({},e),s=[],o=[],a=t._pointLabels.length,r=t.options.pointLabels,l=r.centerPointLabels?C/a:0;for(let u=0;u<a;u++){const a=r.setContext(t.getPointLabelContext(u));o[u]=a.padding;const f=t.getPointPosition(u,t.drawingArea+o[u],l),g=Si(a.font),p=(h=t.ctx,c=g,d=n(d=t._pointLabels[u])?d:[d],{w:Oe(h,c.string,d),h:d.length*c.lineHeight});s[u]=p;const m=G(t.getIndexAngle(u)+l),x=Math.round(Y(m));Oo(i,e,m,Do(x,f.x,p.w,0,180),Do(x,f.y,p.h,90,270))}var h,c,d;t.setCenterPoint(e.l-i.l,i.r-e.r,e.t-i.t,i.b-e.b),t._pointLabelItems=function(t,e,i){const s=[],n=t._pointLabels.length,o=t.options,{centerPointLabels:a,display:r}=o.pointLabels,l={extra:Po(o)/2,additionalAngle:a?C/n:0};let h;for(let o=0;o<n;o++){l.padding=i[o],l.size=e[o];const n=Ao(t,o,l);s.push(n),"auto"===r&&(n.visible=To(n,h),n.visible&&(h=n))}return s}(t,s,o)}function Oo(t,e,i,s,n){const o=Math.abs(Math.sin(i)),a=Math.abs(Math.cos(i));let r=0,l=0;s.start<e.l?(r=(e.l-s.start)/o,t.l=Math.min(t.l,e.l-r)):s.end>e.r&&(r=(s.end-e.r)/o,t.r=Math.max(t.r,e.r+r)),n.start<e.t?(l=(e.t-n.start)/a,t.t=Math.min(t.t,e.t-l)):n.end>e.b&&(l=(n.end-e.b)/a,t.b=Math.max(t.b,e.b+l))}function Ao(t,e,i){const s=t.drawingArea,{extra:n,additionalAngle:o,padding:a,size:r}=i,l=t.getPointPosition(e,s+n+a,o),h=Math.round(Y(G(l.angle+E))),c=function(t,e,i){90===i||270===i?t-=e/2:(i>270||i<90)&&(t-=e);return t}(l.y,r.h,h),d=function(t){if(0===t||180===t)return"center";if(t<180)return"left";return"right"}(h),u=function(t,e,i){"right"===i?t-=e:"center"===i&&(t-=e/2);return t}(l.x,r.w,d);return{visible:!0,x:l.x,y:c,textAlign:d,left:u,top:c,right:u+r.w,bottom:c+r.h}}function To(t,e){if(!e)return!0;const{left:i,top:s,right:n,bottom:o}=t;return!(Re({x:i,y:s},e)||Re({x:i,y:o},e)||Re({x:n,y:s},e)||Re({x:n,y:o},e))}function Lo(t,e,i){const{left:n,top:o,right:a,bottom:r}=i,{backdropColor:l}=e;if(!s(l)){const i=wi(e.borderRadius),s=ki(e.backdropPadding);t.fillStyle=l;const h=n-s.left,c=o-s.top,d=a-n+s.width,u=r-o+s.height;Object.values(i).some((t=>0!==t))?(t.beginPath(),He(t,{x:h,y:c,w:d,h:u,radius:i}),t.fill()):t.fillRect(h,c,d,u)}}function Eo(t,e,i,s){const{ctx:n}=t;if(i)n.arc(t.xCenter,t.yCenter,e,0,O);else{let i=t.getPointPosition(0,e);n.moveTo(i.x,i.y);for(let o=1;o<s;o++)i=t.getPointPosition(o,e),n.lineTo(i.x,i.y)}}class Ro extends bo{static id="radialLinear";static defaults={display:!0,animate:!0,position:"chartArea",angleLines:{display:!0,lineWidth:1,borderDash:[],borderDashOffset:0},grid:{circular:!1},startAngle:0,ticks:{showLabelBackdrop:!0,callback:ae.formatters.numeric},pointLabels:{backdropColor:void 0,backdropPadding:2,display:!0,font:{size:10},callback:t=>t,padding:5,centerPointLabels:!1}};static defaultRoutes={"angleLines.color":"borderColor","pointLabels.color":"color","ticks.color":"color"};static descriptors={angleLines:{_fallback:"grid"}};constructor(t){super(t),this.xCenter=void 0,this.yCenter=void 0,this.drawingArea=void 0,this._pointLabels=[],this._pointLabelItems=[]}setDimensions(){const t=this._padding=ki(Po(this.options)/2),e=this.width=this.maxWidth-t.width,i=this.height=this.maxHeight-t.height;this.xCenter=Math.floor(this.left+e/2+t.left),this.yCenter=Math.floor(this.top+i/2+t.top),this.drawingArea=Math.floor(Math.min(e,i)/2)}determineDataLimits(){const{min:t,max:e}=this.getMinMax(!1);this.min=a(t)&&!isNaN(t)?t:0,this.max=a(e)&&!isNaN(e)?e:0,this.handleTickRangeOptions()}computeTickLimit(){return Math.ceil(this.drawingArea/Po(this.options))}generateTickLabels(t){bo.prototype.generateTickLabels.call(this,t),this._pointLabels=this.getLabels().map(((t,e)=>{const i=d(this.options.pointLabels.callback,[t,e],this);return i||0===i?i:""})).filter(((t,e)=>this.chart.getDataVisibility(e)))}fit(){const t=this.options;t.display&&t.pointLabels.display?Co(this):this.setCenterPoint(0,0,0,0)}setCenterPoint(t,e,i,s){this.xCenter+=Math.floor((t-e)/2),this.yCenter+=Math.floor((i-s)/2),this.drawingArea-=Math.min(this.drawingArea/2,Math.max(t,e,i,s))}getIndexAngle(t){return G(t*(O/(this._pointLabels.length||1))+$(this.options.startAngle||0))}getDistanceFromCenterForValue(t){if(s(t))return NaN;const e=this.drawingArea/(this.max-this.min);return this.options.reverse?(this.max-t)*e:(t-this.min)*e}getValueForDistanceFromCenter(t){if(s(t))return NaN;const e=t/(this.drawingArea/(this.max-this.min));return this.options.reverse?this.max-e:this.min+e}getPointLabelContext(t){const e=this._pointLabels||[];if(t>=0&&t<e.length){const i=e[t];return function(t,e,i){return Ci(t,{label:i,index:e,type:"pointLabel"})}(this.getContext(),t,i)}}getPointPosition(t,e,i=0){const s=this.getIndexAngle(t)-E+i;return{x:Math.cos(s)*e+this.xCenter,y:Math.sin(s)*e+this.yCenter,angle:s}}getPointPositionForValue(t,e){return this.getPointPosition(t,this.getDistanceFromCenterForValue(e))}getBasePosition(t){return this.getPointPositionForValue(t||0,this.getBaseValue())}getPointLabelPosition(t){const{left:e,top:i,right:s,bottom:n}=this._pointLabelItems[t];return{left:e,top:i,right:s,bottom:n}}drawBackground(){const{backgroundColor:t,grid:{circular:e}}=this.options;if(t){const i=this.ctx;i.save(),i.beginPath(),Eo(this,this.getDistanceFromCenterForValue(this._endValue),e,this._pointLabels.length),i.closePath(),i.fillStyle=t,i.fill(),i.restore()}}drawGrid(){const t=this.ctx,e=this.options,{angleLines:i,grid:s,border:n}=e,o=this._pointLabels.length;let a,r,l;if(e.pointLabels.display&&function(t,e){const{ctx:i,options:{pointLabels:s}}=t;for(let n=e-1;n>=0;n--){const e=t._pointLabelItems[n];if(!e.visible)continue;const o=s.setContext(t.getPointLabelContext(n));Lo(i,o,e);const a=Si(o.font),{x:r,y:l,textAlign:h}=e;Ne(i,t._pointLabels[n],r,l+a.lineHeight/2,a,{color:o.color,textAlign:h,textBaseline:"middle"})}}(this,o),s.display&&this.ticks.forEach(((t,e)=>{if(0!==e||0===e&&this.min<0){r=this.getDistanceFromCenterForValue(t.value);const i=this.getContext(e),a=s.setContext(i),l=n.setContext(i);!function(t,e,i,s,n){const o=t.ctx,a=e.circular,{color:r,lineWidth:l}=e;!a&&!s||!r||!l||i<0||(o.save(),o.strokeStyle=r,o.lineWidth=l,o.setLineDash(n.dash||[]),o.lineDashOffset=n.dashOffset,o.beginPath(),Eo(t,i,a,s),o.closePath(),o.stroke(),o.restore())}(this,a,r,o,l)}})),i.display){for(t.save(),a=o-1;a>=0;a--){const s=i.setContext(this.getPointLabelContext(a)),{color:n,lineWidth:o}=s;o&&n&&(t.lineWidth=o,t.strokeStyle=n,t.setLineDash(s.borderDash),t.lineDashOffset=s.borderDashOffset,r=this.getDistanceFromCenterForValue(e.reverse?this.min:this.max),l=this.getPointPosition(a,r),t.beginPath(),t.moveTo(this.xCenter,this.yCenter),t.lineTo(l.x,l.y),t.stroke())}t.restore()}}drawBorder(){}drawLabels(){const t=this.ctx,e=this.options,i=e.ticks;if(!i.display)return;const s=this.getIndexAngle(0);let n,o;t.save(),t.translate(this.xCenter,this.yCenter),t.rotate(s),t.textAlign="center",t.textBaseline="middle",this.ticks.forEach(((s,a)=>{if(0===a&&this.min>=0&&!e.reverse)return;const r=i.setContext(this.getContext(a)),l=Si(r.font);if(n=this.getDistanceFromCenterForValue(this.ticks[a].value),r.showLabelBackdrop){t.font=l.string,o=t.measureText(s.label).width,t.fillStyle=r.backdropColor;const e=ki(r.backdropPadding);t.fillRect(-o/2-e.left,-n-l.size/2-e.top,o+e.width,l.size+e.height)}Ne(t,s.label,0,-n,l,{color:r.color,strokeColor:r.textStrokeColor,strokeWidth:r.textStrokeWidth})})),t.restore()}drawTitle(){}}const Io={millisecond:{common:!0,size:1,steps:1e3},second:{common:!0,size:1e3,steps:60},minute:{common:!0,size:6e4,steps:60},hour:{common:!0,size:36e5,steps:24},day:{common:!0,size:864e5,steps:30},week:{common:!1,size:6048e5,steps:4},month:{common:!0,size:2628e6,steps:12},quarter:{common:!1,size:7884e6,steps:4},year:{common:!0,size:3154e7}},zo=Object.keys(Io);function Fo(t,e){return t-e}function Vo(t,e){if(s(e))return null;const i=t._adapter,{parser:n,round:o,isoWeekday:r}=t._parseOpts;let l=e;return"function"==typeof n&&(l=n(l)),a(l)||(l="string"==typeof n?i.parse(l,n):i.parse(l)),null===l?null:(o&&(l="week"!==o||!N(r)&&!0!==r?i.startOf(l,o):i.startOf(l,"isoWeek",r)),+l)}function Bo(t,e,i,s){const n=zo.length;for(let o=zo.indexOf(t);o<n-1;++o){const t=Io[zo[o]],n=t.steps?t.steps:Number.MAX_SAFE_INTEGER;if(t.common&&Math.ceil((i-e)/(n*t.size))<=s)return zo[o]}return zo[n-1]}function Wo(t,e,i){if(i){if(i.length){const{lo:s,hi:n}=et(i,e);t[i[s]>=e?i[s]:i[n]]=!0}}else t[e]=!0}function No(t,e,i){const s=[],n={},o=e.length;let a,r;for(a=0;a<o;++a)r=e[a],n[r]=a,s.push({value:r,major:!1});return 0!==o&&i?function(t,e,i,s){const n=t._adapter,o=+n.startOf(e[0].value,s),a=e[e.length-1].value;let r,l;for(r=o;r<=a;r=+n.add(r,1,s))l=i[r],l>=0&&(e[l].major=!0);return e}(t,s,n,i):s}class Ho extends tn{static id="time";static defaults={bounds:"data",adapters:{},time:{parser:!1,unit:!1,round:!1,isoWeekday:!1,minUnit:"millisecond",displayFormats:{}},ticks:{source:"auto",callback:!1,major:{enabled:!1}}};constructor(t){super(t),this._cache={data:[],labels:[],all:[]},this._unit="day",this._majorUnit=void 0,this._offsets={},this._normalized=!1,this._parseOpts=void 0}init(t,e={}){const i=t.time||(t.time={}),s=this._adapter=new In._date(t.adapters.date);s.init(e),b(i.displayFormats,s.formats()),this._parseOpts={parser:i.parser,round:i.round,isoWeekday:i.isoWeekday},super.init(t),this._normalized=e.normalized}parse(t,e){return void 0===t?null:Vo(this,t)}beforeLayout(){super.beforeLayout(),this._cache={data:[],labels:[],all:[]}}determineDataLimits(){const t=this.options,e=this._adapter,i=t.time.unit||"day";let{min:s,max:n,minDefined:o,maxDefined:r}=this.getUserBounds();function l(t){o||isNaN(t.min)||(s=Math.min(s,t.min)),r||isNaN(t.max)||(n=Math.max(n,t.max))}o&&r||(l(this._getLabelBounds()),"ticks"===t.bounds&&"labels"===t.ticks.source||l(this.getMinMax(!1))),s=a(s)&&!isNaN(s)?s:+e.startOf(Date.now(),i),n=a(n)&&!isNaN(n)?n:+e.endOf(Date.now(),i)+1,this.min=Math.min(s,n-1),this.max=Math.max(s+1,n)}_getLabelBounds(){const t=this.getLabelTimestamps();let e=Number.POSITIVE_INFINITY,i=Number.NEGATIVE_INFINITY;return t.length&&(e=t[0],i=t[t.length-1]),{min:e,max:i}}buildTicks(){const t=this.options,e=t.time,i=t.ticks,s="labels"===i.source?this.getLabelTimestamps():this._generate();"ticks"===t.bounds&&s.length&&(this.min=this._userMin||s[0],this.max=this._userMax||s[s.length-1]);const n=this.min,o=nt(s,n,this.max);return this._unit=e.unit||(i.autoSkip?Bo(e.minUnit,this.min,this.max,this._getLabelCapacity(n)):function(t,e,i,s,n){for(let o=zo.length-1;o>=zo.indexOf(i);o--){const i=zo[o];if(Io[i].common&&t._adapter.diff(n,s,i)>=e-1)return i}return zo[i?zo.indexOf(i):0]}(this,o.length,e.minUnit,this.min,this.max)),this._majorUnit=i.major.enabled&&"year"!==this._unit?function(t){for(let e=zo.indexOf(t)+1,i=zo.length;e<i;++e)if(Io[zo[e]].common)return zo[e]}(this._unit):void 0,this.initOffsets(s),t.reverse&&o.reverse(),No(this,o,this._majorUnit)}afterAutoSkip(){this.options.offsetAfterAutoskip&&this.initOffsets(this.ticks.map((t=>+t.value)))}initOffsets(t=[]){let e,i,s=0,n=0;this.options.offset&&t.length&&(e=this.getDecimalForValue(t[0]),s=1===t.length?1-e:(this.getDecimalForValue(t[1])-e)/2,i=this.getDecimalForValue(t[t.length-1]),n=1===t.length?i:(i-this.getDecimalForValue(t[t.length-2]))/2);const o=t.length<3?.5:.25;s=Z(s,0,o),n=Z(n,0,o),this._offsets={start:s,end:n,factor:1/(s+1+n)}}_generate(){const t=this._adapter,e=this.min,i=this.max,s=this.options,n=s.time,o=n.unit||Bo(n.minUnit,e,i,this._getLabelCapacity(e)),a=l(s.ticks.stepSize,1),r="week"===o&&n.isoWeekday,h=N(r)||!0===r,c={};let d,u,f=e;if(h&&(f=+t.startOf(f,"isoWeek",r)),f=+t.startOf(f,h?"day":o),t.diff(i,e,o)>1e5*a)throw new Error(e+" and "+i+" are too far apart with stepSize of "+a+" "+o);const g="data"===s.ticks.source&&this.getDataTimestamps();for(d=f,u=0;d<i;d=+t.add(d,a,o),u++)Wo(c,d,g);return d!==i&&"ticks"!==s.bounds&&1!==u||Wo(c,d,g),Object.keys(c).sort(Fo).map((t=>+t))}getLabelForValue(t){const e=this._adapter,i=this.options.time;return i.tooltipFormat?e.format(t,i.tooltipFormat):e.format(t,i.displayFormats.datetime)}format(t,e){const i=this.options.time.displayFormats,s=this._unit,n=e||i[s];return this._adapter.format(t,n)}_tickFormatFunction(t,e,i,s){const n=this.options,o=n.ticks.callback;if(o)return d(o,[t,e,i],this);const a=n.time.displayFormats,r=this._unit,l=this._majorUnit,h=r&&a[r],c=l&&a[l],u=i[e],f=l&&c&&u&&u.major;return this._adapter.format(t,s||(f?c:h))}generateTickLabels(t){let e,i,s;for(e=0,i=t.length;e<i;++e)s=t[e],s.label=this._tickFormatFunction(s.value,e,t)}getDecimalForValue(t){return null===t?NaN:(t-this.min)/(this.max-this.min)}getPixelForValue(t){const e=this._offsets,i=this.getDecimalForValue(t);return this.getPixelForDecimal((e.start+i)*e.factor)}getValueForPixel(t){const e=this._offsets,i=this.getDecimalForPixel(t)/e.factor-e.end;return this.min+i*(this.max-this.min)}_getLabelSize(t){const e=this.options.ticks,i=this.ctx.measureText(t).width,s=$(this.isHorizontal()?e.maxRotation:e.minRotation),n=Math.cos(s),o=Math.sin(s),a=this._resolveTickFontOptions(0).size;return{w:i*n+a*o,h:i*o+a*n}}_getLabelCapacity(t){const e=this.options.time,i=e.displayFormats,s=i[e.unit]||i.millisecond,n=this._tickFormatFunction(t,0,No(this,[t],this._majorUnit),s),o=this._getLabelSize(n),a=Math.floor(this.isHorizontal()?this.width/o.w:this.height/o.h)-1;return a>0?a:1}getDataTimestamps(){let t,e,i=this._cache.data||[];if(i.length)return i;const s=this.getMatchingVisibleMetas();if(this._normalized&&s.length)return this._cache.data=s[0].controller.getAllParsedValues(this);for(t=0,e=s.length;t<e;++t)i=i.concat(s[t].controller.getAllParsedValues(this));return this._cache.data=this.normalize(i)}getLabelTimestamps(){const t=this._cache.labels||[];let e,i;if(t.length)return t;const s=this.getLabels();for(e=0,i=s.length;e<i;++e)t.push(Vo(this,s[e]));return this._cache.labels=this._normalized?t:this.normalize(t)}normalize(t){return lt(t.sort(Fo))}}function jo(t,e,i){let s,n,o,a,r=0,l=t.length-1;i?(e>=t[r].pos&&e<=t[l].pos&&({lo:r,hi:l}=it(t,"pos",e)),({pos:s,time:o}=t[r]),({pos:n,time:a}=t[l])):(e>=t[r].time&&e<=t[l].time&&({lo:r,hi:l}=it(t,"time",e)),({time:s,pos:o}=t[r]),({time:n,pos:a}=t[l]));const h=n-s;return h?o+(a-o)*(e-s)/h:o}var $o=Object.freeze({__proto__:null,CategoryScale:class extends tn{static id="category";static defaults={ticks:{callback:mo}};constructor(t){super(t),this._startValue=void 0,this._valueRange=0,this._addedLabels=[]}init(t){const e=this._addedLabels;if(e.length){const t=this.getLabels();for(const{index:i,label:s}of e)t[i]===s&&t.splice(i,1);this._addedLabels=[]}super.init(t)}parse(t,e){if(s(t))return null;const i=this.getLabels();return((t,e)=>null===t?null:Z(Math.round(t),0,e))(e=isFinite(e)&&i[e]===t?e:po(i,t,l(e,t),this._addedLabels),i.length-1)}determineDataLimits(){const{minDefined:t,maxDefined:e}=this.getUserBounds();let{min:i,max:s}=this.getMinMax(!0);"ticks"===this.options.bounds&&(t||(i=0),e||(s=this.getLabels().length-1)),this.min=i,this.max=s}buildTicks(){const t=this.min,e=this.max,i=this.options.offset,s=[];let n=this.getLabels();n=0===t&&e===n.length-1?n:n.slice(t,e+1),this._valueRange=Math.max(n.length-(i?0:1),1),this._startValue=this.min-(i?.5:0);for(let i=t;i<=e;i++)s.push({value:i});return s}getLabelForValue(t){return mo.call(this,t)}configure(){super.configure(),this.isHorizontal()||(this._reversePixels=!this._reversePixels)}getPixelForValue(t){return"number"!=typeof t&&(t=this.parse(t)),null===t?NaN:this.getPixelForDecimal((t-this._startValue)/this._valueRange)}getPixelForTick(t){const e=this.ticks;return t<0||t>e.length-1?null:this.getPixelForValue(e[t].value)}getValueForPixel(t){return Math.round(this._startValue+this.getDecimalForPixel(t)*this._valueRange)}getBasePixel(){return this.bottom}},LinearScale:_o,LogarithmicScale:So,RadialLinearScale:Ro,TimeScale:Ho,TimeSeriesScale:class extends Ho{static id="timeseries";static defaults=Ho.defaults;constructor(t){super(t),this._table=[],this._minPos=void 0,this._tableRange=void 0}initOffsets(){const t=this._getTimestampsForTable(),e=this._table=this.buildLookupTable(t);this._minPos=jo(e,this.min),this._tableRange=jo(e,this.max)-this._minPos,super.initOffsets(t)}buildLookupTable(t){const{min:e,max:i}=this,s=[],n=[];let o,a,r,l,h;for(o=0,a=t.length;o<a;++o)l=t[o],l>=e&&l<=i&&s.push(l);if(s.length<2)return[{time:e,pos:0},{time:i,pos:1}];for(o=0,a=s.length;o<a;++o)h=s[o+1],r=s[o-1],l=s[o],Math.round((h+r)/2)!==l&&n.push({time:l,pos:o/(a-1)});return n}_generate(){const t=this.min,e=this.max;let i=super.getDataTimestamps();return i.includes(t)&&i.length||i.splice(0,0,t),i.includes(e)&&1!==i.length||i.push(e),i.sort(((t,e)=>t-e))}_getTimestampsForTable(){let t=this._cache.all||[];if(t.length)return t;const e=this.getDataTimestamps(),i=this.getLabelTimestamps();return t=e.length&&i.length?this.normalize(e.concat(i)):e.length?e:i,t=this._cache.all=t,t}getDecimalForValue(t){return(jo(this._table,t)-this._minPos)/this._tableRange}getValueForPixel(t){const e=this._offsets,i=this.getDecimalForPixel(t)/e.factor-e.end;return jo(this._table,i*this._tableRange+this._minPos,!0)}}});const Yo=["rgb(54, 162, 235)","rgb(255, 99, 132)","rgb(255, 159, 64)","rgb(255, 205, 86)","rgb(75, 192, 192)","rgb(153, 102, 255)","rgb(201, 203, 207)"],Uo=Yo.map((t=>t.replace("rgb(","rgba(").replace(")",", 0.5)")));function Xo(t){return Yo[t%Yo.length]}function qo(t){return Uo[t%Uo.length]}function Ko(t){let e=0;return(i,s)=>{const n=t.getDatasetMeta(s).controller;n instanceof $n?e=function(t,e){return t.backgroundColor=t.data.map((()=>Xo(e++))),e}(i,e):n instanceof Yn?e=function(t,e){return t.backgroundColor=t.data.map((()=>qo(e++))),e}(i,e):n&&(e=function(t,e){return t.borderColor=Xo(e),t.backgroundColor=qo(e),++e}(i,e))}}function Go(t){let e;for(e in t)if(t[e].borderColor||t[e].backgroundColor)return!0;return!1}var Jo={id:"colors",defaults:{enabled:!0,forceOverride:!1},beforeLayout(t,e,i){if(!i.enabled)return;const{data:{datasets:s},options:n}=t.config,{elements:o}=n,a=Go(s)||(r=n)&&(r.borderColor||r.backgroundColor)||o&&Go(o)||"rgba(0,0,0,0.1)"!==ue.borderColor||"rgba(0,0,0,0.1)"!==ue.backgroundColor;var r;if(!i.forceOverride&&a)return;const l=Ko(t);s.forEach(l)}};function Zo(t){if(t._decimated){const e=t._data;delete t._decimated,delete t._data,Object.defineProperty(t,"data",{configurable:!0,enumerable:!0,writable:!0,value:e})}}function Qo(t){t.data.datasets.forEach((t=>{Zo(t)}))}var ta={id:"decimation",defaults:{algorithm:"min-max",enabled:!1},beforeElementsUpdate:(t,e,i)=>{if(!i.enabled)return void Qo(t);const n=t.width;t.data.datasets.forEach(((e,o)=>{const{_data:a,indexAxis:r}=e,l=t.getDatasetMeta(o),h=a||e.data;if("y"===Pi([r,t.options.indexAxis]))return;if(!l.controller.supportsDecimation)return;const c=t.scales[l.xAxisID];if("linear"!==c.type&&"time"!==c.type)return;if(t.options.parsing)return;let{start:d,count:u}=function(t,e){const i=e.length;let s,n=0;const{iScale:o}=t,{min:a,max:r,minDefined:l,maxDefined:h}=o.getUserBounds();return l&&(n=Z(it(e,o.axis,a).lo,0,i-1)),s=h?Z(it(e,o.axis,r).hi+1,n,i)-n:i-n,{start:n,count:s}}(l,h);if(u<=(i.threshold||4*n))return void Zo(e);let f;switch(s(a)&&(e._data=h,delete e.data,Object.defineProperty(e,"data",{configurable:!0,enumerable:!0,get:function(){return this._decimated},set:function(t){this._data=t}})),i.algorithm){case"lttb":f=function(t,e,i,s,n){const o=n.samples||s;if(o>=i)return t.slice(e,e+i);const a=[],r=(i-2)/(o-2);let l=0;const h=e+i-1;let c,d,u,f,g,p=e;for(a[l++]=t[p],c=0;c<o-2;c++){let s,n=0,o=0;const h=Math.floor((c+1)*r)+1+e,m=Math.min(Math.floor((c+2)*r)+1,i)+e,x=m-h;for(s=h;s<m;s++)n+=t[s].x,o+=t[s].y;n/=x,o/=x;const b=Math.floor(c*r)+1+e,_=Math.min(Math.floor((c+1)*r)+1,i)+e,{x:y,y:v}=t[p];for(u=f=-1,s=b;s<_;s++)f=.5*Math.abs((y-n)*(t[s].y-v)-(y-t[s].x)*(o-v)),f>u&&(u=f,d=t[s],g=s);a[l++]=d,p=g}return a[l++]=t[h],a}(h,d,u,n,i);break;case"min-max":f=function(t,e,i,n){let o,a,r,l,h,c,d,u,f,g,p=0,m=0;const x=[],b=e+i-1,_=t[e].x,y=t[b].x-_;for(o=e;o<e+i;++o){a=t[o],r=(a.x-_)/y*n,l=a.y;const e=0|r;if(e===h)l<f?(f=l,c=o):l>g&&(g=l,d=o),p=(m*p+a.x)/++m;else{const i=o-1;if(!s(c)&&!s(d)){const e=Math.min(c,d),s=Math.max(c,d);e!==u&&e!==i&&x.push({...t[e],x:p}),s!==u&&s!==i&&x.push({...t[s],x:p})}o>0&&i!==u&&x.push(t[i]),x.push(a),h=e,m=0,f=g=l,c=d=u=o}}return x}(h,d,u,n);break;default:throw new Error(`Unsupported decimation algorithm '${i.algorithm}'`)}e._decimated=f}))},destroy(t){Qo(t)}};function ea(t,e,i,s){if(s)return;let n=e[t],o=i[t];return"angle"===t&&(n=G(n),o=G(o)),{property:t,start:n,end:o}}function ia(t,e,i){for(;e>t;e--){const t=i[e];if(!isNaN(t.x)&&!isNaN(t.y))break}return e}function sa(t,e,i,s){return t&&e?s(t[i],e[i]):t?t[i]:e?e[i]:0}function na(t,e){let i=[],s=!1;return n(t)?(s=!0,i=t):i=function(t,e){const{x:i=null,y:s=null}=t||{},n=e.points,o=[];return e.segments.forEach((({start:t,end:e})=>{e=ia(t,e,n);const a=n[t],r=n[e];null!==s?(o.push({x:a.x,y:s}),o.push({x:r.x,y:s})):null!==i&&(o.push({x:i,y:a.y}),o.push({x:i,y:r.y}))})),o}(t,e),i.length?new oo({points:i,options:{tension:0},_loop:s,_fullLoop:s}):null}function oa(t){return t&&!1!==t.fill}function aa(t,e,i){let s=t[e].fill;const n=[e];let o;if(!i)return s;for(;!1!==s&&-1===n.indexOf(s);){if(!a(s))return s;if(o=t[s],!o)return!1;if(o.visible)return s;n.push(s),s=o.fill}return!1}function ra(t,e,i){const s=function(t){const e=t.options,i=e.fill;let s=l(i&&i.target,i);void 0===s&&(s=!!e.backgroundColor);if(!1===s||null===s)return!1;if(!0===s)return"origin";return s}(t);if(o(s))return!isNaN(s.value)&&s;let n=parseFloat(s);return a(n)&&Math.floor(n)===n?function(t,e,i,s){"-"!==t&&"+"!==t||(i=e+i);if(i===e||i<0||i>=s)return!1;return i}(s[0],e,n,i):["origin","start","end","stack","shape"].indexOf(s)>=0&&s}function la(t,e,i){const s=[];for(let n=0;n<i.length;n++){const o=i[n],{first:a,last:r,point:l}=ha(o,e,"x");if(!(!l||a&&r))if(a)s.unshift(l);else if(t.push(l),!r)break}t.push(...s)}function ha(t,e,i){const s=t.interpolate(e,i);if(!s)return{};const n=s[i],o=t.segments,a=t.points;let r=!1,l=!1;for(let t=0;t<o.length;t++){const e=o[t],s=a[e.start][i],h=a[e.end][i];if(tt(n,s,h)){r=n===s,l=n===h;break}}return{first:r,last:l,point:s}}class ca{constructor(t){this.x=t.x,this.y=t.y,this.radius=t.radius}pathSegment(t,e,i){const{x:s,y:n,radius:o}=this;return e=e||{start:0,end:O},t.arc(s,n,o,e.end,e.start,!0),!i.bounds}interpolate(t){const{x:e,y:i,radius:s}=this,n=t.angle;return{x:e+Math.cos(n)*s,y:i+Math.sin(n)*s,angle:n}}}function da(t){const{chart:e,fill:i,line:s}=t;if(a(i))return function(t,e){const i=t.getDatasetMeta(e),s=i&&t.isDatasetVisible(e);return s?i.dataset:null}(e,i);if("stack"===i)return function(t){const{scale:e,index:i,line:s}=t,n=[],o=s.segments,a=s.points,r=function(t,e){const i=[],s=t.getMatchingVisibleMetas("line");for(let t=0;t<s.length;t++){const n=s[t];if(n.index===e)break;n.hidden||i.unshift(n.dataset)}return i}(e,i);r.push(na({x:null,y:e.bottom},s));for(let t=0;t<o.length;t++){const e=o[t];for(let t=e.start;t<=e.end;t++)la(n,a[t],r)}return new oo({points:n,options:{}})}(t);if("shape"===i)return!0;const n=function(t){const e=t.scale||{};if(e.getPointPositionForValue)return function(t){const{scale:e,fill:i}=t,s=e.options,n=e.getLabels().length,a=s.reverse?e.max:e.min,r=function(t,e,i){let s;return s="start"===t?i:"end"===t?e.options.reverse?e.min:e.max:o(t)?t.value:e.getBaseValue(),s}(i,e,a),l=[];if(s.grid.circular){const t=e.getPointPositionForValue(0,a);return new ca({x:t.x,y:t.y,radius:e.getDistanceFromCenterForValue(r)})}for(let t=0;t<n;++t)l.push(e.getPointPositionForValue(t,r));return l}(t);return function(t){const{scale:e={},fill:i}=t,s=function(t,e){let i=null;return"start"===t?i=e.bottom:"end"===t?i=e.top:o(t)?i=e.getPixelForValue(t.value):e.getBasePixel&&(i=e.getBasePixel()),i}(i,e);if(a(s)){const t=e.isHorizontal();return{x:t?s:null,y:t?null:s}}return null}(t)}(t);return n instanceof ca?n:na(n,s)}function ua(t,e,i){const s=da(e),{chart:n,index:o,line:a,scale:r,axis:l}=e,h=a.options,c=h.fill,d=h.backgroundColor,{above:u=d,below:f=d}=c||{},g=n.getDatasetMeta(o),p=Ni(n,g);s&&a.points.length&&(Ie(t,i),function(t,e){const{line:i,target:s,above:n,below:o,area:a,scale:r,clip:l}=e,h=i._loop?"angle":e.axis;t.save();let c=o;o!==n&&("x"===h?(fa(t,s,a.top),pa(t,{line:i,target:s,color:n,scale:r,property:h,clip:l}),t.restore(),t.save(),fa(t,s,a.bottom)):"y"===h&&(ga(t,s,a.left),pa(t,{line:i,target:s,color:o,scale:r,property:h,clip:l}),t.restore(),t.save(),ga(t,s,a.right),c=n));pa(t,{line:i,target:s,color:c,scale:r,property:h,clip:l}),t.restore()}(t,{line:a,target:s,above:u,below:f,area:i,scale:r,axis:l,clip:p}),ze(t))}function fa(t,e,i){const{segments:s,points:n}=e;let o=!0,a=!1;t.beginPath();for(const r of s){const{start:s,end:l}=r,h=n[s],c=n[ia(s,l,n)];o?(t.moveTo(h.x,h.y),o=!1):(t.lineTo(h.x,i),t.lineTo(h.x,h.y)),a=!!e.pathSegment(t,r,{move:a}),a?t.closePath():t.lineTo(c.x,i)}t.lineTo(e.first().x,i),t.closePath(),t.clip()}function ga(t,e,i){const{segments:s,points:n}=e;let o=!0,a=!1;t.beginPath();for(const r of s){const{start:s,end:l}=r,h=n[s],c=n[ia(s,l,n)];o?(t.moveTo(h.x,h.y),o=!1):(t.lineTo(i,h.y),t.lineTo(h.x,h.y)),a=!!e.pathSegment(t,r,{move:a}),a?t.closePath():t.lineTo(i,c.y)}t.lineTo(i,e.first().y),t.closePath(),t.clip()}function pa(t,e){const{line:i,target:s,property:n,color:o,scale:a,clip:r}=e,l=function(t,e,i){const s=t.segments,n=t.points,o=e.points,a=[];for(const t of s){let{start:s,end:r}=t;r=ia(s,r,n);const l=ea(i,n[s],n[r],t.loop);if(!e.segments){a.push({source:t,target:l,start:n[s],end:n[r]});continue}const h=Ii(e,l);for(const e of h){const s=ea(i,o[e.start],o[e.end],e.loop),r=Ri(t,n,s);for(const t of r)a.push({source:t,target:e,start:{[i]:sa(l,s,"start",Math.max)},end:{[i]:sa(l,s,"end",Math.min)}})}}return a}(i,s,n);for(const{source:e,target:h,start:c,end:d}of l){const{style:{backgroundColor:l=o}={}}=e,u=!0!==s;t.save(),t.fillStyle=l,ma(t,a,r,u&&ea(n,c,d)),t.beginPath();const f=!!i.pathSegment(t,e);let g;if(u){f?t.closePath():xa(t,s,d,n);const e=!!s.pathSegment(t,h,{move:f,reverse:!0});g=f&&e,g||xa(t,s,c,n)}t.closePath(),t.fill(g?"evenodd":"nonzero"),t.restore()}}function ma(t,e,i,s){const n=e.chart.chartArea,{property:o,start:a,end:r}=s||{};if("x"===o||"y"===o){let e,s,l,h;"x"===o?(e=a,s=n.top,l=r,h=n.bottom):(e=n.left,s=a,l=n.right,h=r),t.beginPath(),i&&(e=Math.max(e,i.left),l=Math.min(l,i.right),s=Math.max(s,i.top),h=Math.min(h,i.bottom)),t.rect(e,s,l-e,h-s),t.clip()}}function xa(t,e,i,s){const n=e.interpolate(i,s);n&&t.lineTo(n.x,n.y)}var ba={id:"filler",afterDatasetsUpdate(t,e,i){const s=(t.data.datasets||[]).length,n=[];let o,a,r,l;for(a=0;a<s;++a)o=t.getDatasetMeta(a),r=o.dataset,l=null,r&&r.options&&r instanceof oo&&(l={visible:t.isDatasetVisible(a),index:a,fill:ra(r,a,s),chart:t,axis:o.controller.options.indexAxis,scale:o.vScale,line:r}),o.$filler=l,n.push(l);for(a=0;a<s;++a)l=n[a],l&&!1!==l.fill&&(l.fill=aa(n,a,i.propagate))},beforeDraw(t,e,i){const s="beforeDraw"===i.drawTime,n=t.getSortedVisibleDatasetMetas(),o=t.chartArea;for(let e=n.length-1;e>=0;--e){const i=n[e].$filler;i&&(i.line.updateControlPoints(o,i.axis),s&&i.fill&&ua(t.ctx,i,o))}},beforeDatasetsDraw(t,e,i){if("beforeDatasetsDraw"!==i.drawTime)return;const s=t.getSortedVisibleDatasetMetas();for(let e=s.length-1;e>=0;--e){const i=s[e].$filler;oa(i)&&ua(t.ctx,i,t.chartArea)}},beforeDatasetDraw(t,e,i){const s=e.meta.$filler;oa(s)&&"beforeDatasetDraw"===i.drawTime&&ua(t.ctx,s,t.chartArea)},defaults:{propagate:!0,drawTime:"beforeDatasetDraw"}};const _a=(t,e)=>{let{boxHeight:i=e,boxWidth:s=e}=t;return t.usePointStyle&&(i=Math.min(i,e),s=t.pointStyleWidth||Math.min(s,e)),{boxWidth:s,boxHeight:i,itemHeight:Math.max(e,i)}};class ya extends $s{constructor(t){super(),this._added=!1,this.legendHitBoxes=[],this._hoveredItem=null,this.doughnutMode=!1,this.chart=t.chart,this.options=t.options,this.ctx=t.ctx,this.legendItems=void 0,this.columnSizes=void 0,this.lineWidths=void 0,this.maxHeight=void 0,this.maxWidth=void 0,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.height=void 0,this.width=void 0,this._margins=void 0,this.position=void 0,this.weight=void 0,this.fullSize=void 0}update(t,e,i){this.maxWidth=t,this.maxHeight=e,this._margins=i,this.setDimensions(),this.buildLabels(),this.fit()}setDimensions(){this.isHorizontal()?(this.width=this.maxWidth,this.left=this._margins.left,this.right=this.width):(this.height=this.maxHeight,this.top=this._margins.top,this.bottom=this.height)}buildLabels(){const t=this.options.labels||{};let e=d(t.generateLabels,[this.chart],this)||[];t.filter&&(e=e.filter((e=>t.filter(e,this.chart.data)))),t.sort&&(e=e.sort(((e,i)=>t.sort(e,i,this.chart.data)))),this.options.reverse&&e.reverse(),this.legendItems=e}fit(){const{options:t,ctx:e}=this;if(!t.display)return void(this.width=this.height=0);const i=t.labels,s=Si(i.font),n=s.size,o=this._computeTitleHeight(),{boxWidth:a,itemHeight:r}=_a(i,n);let l,h;e.font=s.string,this.isHorizontal()?(l=this.maxWidth,h=this._fitRows(o,n,a,r)+10):(h=this.maxHeight,l=this._fitCols(o,s,a,r)+10),this.width=Math.min(l,t.maxWidth||this.maxWidth),this.height=Math.min(h,t.maxHeight||this.maxHeight)}_fitRows(t,e,i,s){const{ctx:n,maxWidth:o,options:{labels:{padding:a}}}=this,r=this.legendHitBoxes=[],l=this.lineWidths=[0],h=s+a;let c=t;n.textAlign="left",n.textBaseline="middle";let d=-1,u=-h;return this.legendItems.forEach(((t,f)=>{const g=i+e/2+n.measureText(t.text).width;(0===f||l[l.length-1]+g+2*a>o)&&(c+=h,l[l.length-(f>0?0:1)]=0,u+=h,d++),r[f]={left:0,top:u,row:d,width:g,height:s},l[l.length-1]+=g+a})),c}_fitCols(t,e,i,s){const{ctx:n,maxHeight:o,options:{labels:{padding:a}}}=this,r=this.legendHitBoxes=[],l=this.columnSizes=[],h=o-t;let c=a,d=0,u=0,f=0,g=0;return this.legendItems.forEach(((t,o)=>{const{itemWidth:p,itemHeight:m}=function(t,e,i,s,n){const o=function(t,e,i,s){let n=t.text;n&&"string"!=typeof n&&(n=n.reduce(((t,e)=>t.length>e.length?t:e)));return e+i.size/2+s.measureText(n).width}(s,t,e,i),a=function(t,e,i){let s=t;"string"!=typeof e.text&&(s=va(e,i));return s}(n,s,e.lineHeight);return{itemWidth:o,itemHeight:a}}(i,e,n,t,s);o>0&&u+m+2*a>h&&(c+=d+a,l.push({width:d,height:u}),f+=d+a,g++,d=u=0),r[o]={left:f,top:u,col:g,width:p,height:m},d=Math.max(d,p),u+=m+a})),c+=d,l.push({width:d,height:u}),c}adjustHitBoxes(){if(!this.options.display)return;const t=this._computeTitleHeight(),{legendHitBoxes:e,options:{align:i,labels:{padding:s},rtl:n}}=this,o=Oi(n,this.left,this.width);if(this.isHorizontal()){let n=0,a=ft(i,this.left+s,this.right-this.lineWidths[n]);for(const r of e)n!==r.row&&(n=r.row,a=ft(i,this.left+s,this.right-this.lineWidths[n])),r.top+=this.top+t+s,r.left=o.leftForLtr(o.x(a),r.width),a+=r.width+s}else{let n=0,a=ft(i,this.top+t+s,this.bottom-this.columnSizes[n].height);for(const r of e)r.col!==n&&(n=r.col,a=ft(i,this.top+t+s,this.bottom-this.columnSizes[n].height)),r.top=a,r.left+=this.left+s,r.left=o.leftForLtr(o.x(r.left),r.width),a+=r.height+s}}isHorizontal(){return"top"===this.options.position||"bottom"===this.options.position}draw(){if(this.options.display){const t=this.ctx;Ie(t,this),this._draw(),ze(t)}}_draw(){const{options:t,columnSizes:e,lineWidths:i,ctx:s}=this,{align:n,labels:o}=t,a=ue.color,r=Oi(t.rtl,this.left,this.width),h=Si(o.font),{padding:c}=o,d=h.size,u=d/2;let f;this.drawTitle(),s.textAlign=r.textAlign("left"),s.textBaseline="middle",s.lineWidth=.5,s.font=h.string;const{boxWidth:g,boxHeight:p,itemHeight:m}=_a(o,d),x=this.isHorizontal(),b=this._computeTitleHeight();f=x?{x:ft(n,this.left+c,this.right-i[0]),y:this.top+c+b,line:0}:{x:this.left+c,y:ft(n,this.top+b+c,this.bottom-e[0].height),line:0},Ai(this.ctx,t.textDirection);const _=m+c;this.legendItems.forEach(((y,v)=>{s.strokeStyle=y.fontColor,s.fillStyle=y.fontColor;const M=s.measureText(y.text).width,w=r.textAlign(y.textAlign||(y.textAlign=o.textAlign)),k=g+u+M;let S=f.x,P=f.y;r.setWidth(this.width),x?v>0&&S+k+c>this.right&&(P=f.y+=_,f.line++,S=f.x=ft(n,this.left+c,this.right-i[f.line])):v>0&&P+_>this.bottom&&(S=f.x=S+e[f.line].width+c,f.line++,P=f.y=ft(n,this.top+b+c,this.bottom-e[f.line].height));if(function(t,e,i){if(isNaN(g)||g<=0||isNaN(p)||p<0)return;s.save();const n=l(i.lineWidth,1);if(s.fillStyle=l(i.fillStyle,a),s.lineCap=l(i.lineCap,"butt"),s.lineDashOffset=l(i.lineDashOffset,0),s.lineJoin=l(i.lineJoin,"miter"),s.lineWidth=n,s.strokeStyle=l(i.strokeStyle,a),s.setLineDash(l(i.lineDash,[])),o.usePointStyle){const a={radius:p*Math.SQRT2/2,pointStyle:i.pointStyle,rotation:i.rotation,borderWidth:n},l=r.xPlus(t,g/2);Ee(s,a,l,e+u,o.pointStyleWidth&&g)}else{const o=e+Math.max((d-p)/2,0),a=r.leftForLtr(t,g),l=wi(i.borderRadius);s.beginPath(),Object.values(l).some((t=>0!==t))?He(s,{x:a,y:o,w:g,h:p,radius:l}):s.rect(a,o,g,p),s.fill(),0!==n&&s.stroke()}s.restore()}(r.x(S),P,y),S=gt(w,S+g+u,x?S+k:this.right,t.rtl),function(t,e,i){Ne(s,i.text,t,e+m/2,h,{strikethrough:i.hidden,textAlign:r.textAlign(i.textAlign)})}(r.x(S),P,y),x)f.x+=k+c;else if("string"!=typeof y.text){const t=h.lineHeight;f.y+=va(y,t)+c}else f.y+=_})),Ti(this.ctx,t.textDirection)}drawTitle(){const t=this.options,e=t.title,i=Si(e.font),s=ki(e.padding);if(!e.display)return;const n=Oi(t.rtl,this.left,this.width),o=this.ctx,a=e.position,r=i.size/2,l=s.top+r;let h,c=this.left,d=this.width;if(this.isHorizontal())d=Math.max(...this.lineWidths),h=this.top+l,c=ft(t.align,c,this.right-d);else{const e=this.columnSizes.reduce(((t,e)=>Math.max(t,e.height)),0);h=l+ft(t.align,this.top,this.bottom-e-t.labels.padding-this._computeTitleHeight())}const u=ft(a,c,c+d);o.textAlign=n.textAlign(ut(a)),o.textBaseline="middle",o.strokeStyle=e.color,o.fillStyle=e.color,o.font=i.string,Ne(o,e.text,u,h,i)}_computeTitleHeight(){const t=this.options.title,e=Si(t.font),i=ki(t.padding);return t.display?e.lineHeight+i.height:0}_getLegendItemAt(t,e){let i,s,n;if(tt(t,this.left,this.right)&&tt(e,this.top,this.bottom))for(n=this.legendHitBoxes,i=0;i<n.length;++i)if(s=n[i],tt(t,s.left,s.left+s.width)&&tt(e,s.top,s.top+s.height))return this.legendItems[i];return null}handleEvent(t){const e=this.options;if(!function(t,e){if(("mousemove"===t||"mouseout"===t)&&(e.onHover||e.onLeave))return!0;if(e.onClick&&("click"===t||"mouseup"===t))return!0;return!1}(t.type,e))return;const i=this._getLegendItemAt(t.x,t.y);if("mousemove"===t.type||"mouseout"===t.type){const o=this._hoveredItem,a=(n=i,null!==(s=o)&&null!==n&&s.datasetIndex===n.datasetIndex&&s.index===n.index);o&&!a&&d(e.onLeave,[t,o,this],this),this._hoveredItem=i,i&&!a&&d(e.onHover,[t,i,this],this)}else i&&d(e.onClick,[t,i,this],this);var s,n}}function va(t,e){return e*(t.text?t.text.length:0)}var Ma={id:"legend",_element:ya,start(t,e,i){const s=t.legend=new ya({ctx:t.ctx,options:i,chart:t});ls.configure(t,s,i),ls.addBox(t,s)},stop(t){ls.removeBox(t,t.legend),delete t.legend},beforeUpdate(t,e,i){const s=t.legend;ls.configure(t,s,i),s.options=i},afterUpdate(t){const e=t.legend;e.buildLabels(),e.adjustHitBoxes()},afterEvent(t,e){e.replay||t.legend.handleEvent(e.event)},defaults:{display:!0,position:"top",align:"center",fullSize:!0,reverse:!1,weight:1e3,onClick(t,e,i){const s=e.datasetIndex,n=i.chart;n.isDatasetVisible(s)?(n.hide(s),e.hidden=!0):(n.show(s),e.hidden=!1)},onHover:null,onLeave:null,labels:{color:t=>t.chart.options.color,boxWidth:40,padding:10,generateLabels(t){const e=t.data.datasets,{labels:{usePointStyle:i,pointStyle:s,textAlign:n,color:o,useBorderRadius:a,borderRadius:r}}=t.legend.options;return t._getSortedDatasetMetas().map((t=>{const l=t.controller.getStyle(i?0:void 0),h=ki(l.borderWidth);return{text:e[t.index].label,fillStyle:l.backgroundColor,fontColor:o,hidden:!t.visible,lineCap:l.borderCapStyle,lineDash:l.borderDash,lineDashOffset:l.borderDashOffset,lineJoin:l.borderJoinStyle,lineWidth:(h.width+h.height)/4,strokeStyle:l.borderColor,pointStyle:s||l.pointStyle,rotation:l.rotation,textAlign:n||l.textAlign,borderRadius:a&&(r||l.borderRadius),datasetIndex:t.index}}),this)}},title:{color:t=>t.chart.options.color,display:!1,position:"center",text:""}},descriptors:{_scriptable:t=>!t.startsWith("on"),labels:{_scriptable:t=>!["generateLabels","filter","sort"].includes(t)}}};class wa extends $s{constructor(t){super(),this.chart=t.chart,this.options=t.options,this.ctx=t.ctx,this._padding=void 0,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.width=void 0,this.height=void 0,this.position=void 0,this.weight=void 0,this.fullSize=void 0}update(t,e){const i=this.options;if(this.left=0,this.top=0,!i.display)return void(this.width=this.height=this.right=this.bottom=0);this.width=this.right=t,this.height=this.bottom=e;const s=n(i.text)?i.text.length:1;this._padding=ki(i.padding);const o=s*Si(i.font).lineHeight+this._padding.height;this.isHorizontal()?this.height=o:this.width=o}isHorizontal(){const t=this.options.position;return"top"===t||"bottom"===t}_drawArgs(t){const{top:e,left:i,bottom:s,right:n,options:o}=this,a=o.align;let r,l,h,c=0;return this.isHorizontal()?(l=ft(a,i,n),h=e+t,r=n-i):("left"===o.position?(l=i+t,h=ft(a,s,e),c=-.5*C):(l=n-t,h=ft(a,e,s),c=.5*C),r=s-e),{titleX:l,titleY:h,maxWidth:r,rotation:c}}draw(){const t=this.ctx,e=this.options;if(!e.display)return;const i=Si(e.font),s=i.lineHeight/2+this._padding.top,{titleX:n,titleY:o,maxWidth:a,rotation:r}=this._drawArgs(s);Ne(t,e.text,0,0,i,{color:e.color,maxWidth:a,rotation:r,textAlign:ut(e.align),textBaseline:"middle",translation:[n,o]})}}var ka={id:"title",_element:wa,start(t,e,i){!function(t,e){const i=new wa({ctx:t.ctx,options:e,chart:t});ls.configure(t,i,e),ls.addBox(t,i),t.titleBlock=i}(t,i)},stop(t){const e=t.titleBlock;ls.removeBox(t,e),delete t.titleBlock},beforeUpdate(t,e,i){const s=t.titleBlock;ls.configure(t,s,i),s.options=i},defaults:{align:"center",display:!1,font:{weight:"bold"},fullSize:!0,padding:10,position:"top",text:"",weight:2e3},defaultRoutes:{color:"color"},descriptors:{_scriptable:!0,_indexable:!1}};const Sa=new WeakMap;var Pa={id:"subtitle",start(t,e,i){const s=new wa({ctx:t.ctx,options:i,chart:t});ls.configure(t,s,i),ls.addBox(t,s),Sa.set(t,s)},stop(t){ls.removeBox(t,Sa.get(t)),Sa.delete(t)},beforeUpdate(t,e,i){const s=Sa.get(t);ls.configure(t,s,i),s.options=i},defaults:{align:"center",display:!1,font:{weight:"normal"},fullSize:!0,padding:0,position:"top",text:"",weight:1500},defaultRoutes:{color:"color"},descriptors:{_scriptable:!0,_indexable:!1}};const Da={average(t){if(!t.length)return!1;let e,i,s=new Set,n=0,o=0;for(e=0,i=t.length;e<i;++e){const i=t[e].element;if(i&&i.hasValue()){const t=i.tooltipPosition();s.add(t.x),n+=t.y,++o}}if(0===o||0===s.size)return!1;return{x:[...s].reduce(((t,e)=>t+e))/s.size,y:n/o}},nearest(t,e){if(!t.length)return!1;let i,s,n,o=e.x,a=e.y,r=Number.POSITIVE_INFINITY;for(i=0,s=t.length;i<s;++i){const s=t[i].element;if(s&&s.hasValue()){const t=q(e,s.getCenterPoint());t<r&&(r=t,n=s)}}if(n){const t=n.tooltipPosition();o=t.x,a=t.y}return{x:o,y:a}}};function Ca(t,e){return e&&(n(e)?Array.prototype.push.apply(t,e):t.push(e)),t}function Oa(t){return("string"==typeof t||t instanceof String)&&t.indexOf("\n")>-1?t.split("\n"):t}function Aa(t,e){const{element:i,datasetIndex:s,index:n}=e,o=t.getDatasetMeta(s).controller,{label:a,value:r}=o.getLabelAndValue(n);return{chart:t,label:a,parsed:o.getParsed(n),raw:t.data.datasets[s].data[n],formattedValue:r,dataset:o.getDataset(),dataIndex:n,datasetIndex:s,element:i}}function Ta(t,e){const i=t.chart.ctx,{body:s,footer:n,title:o}=t,{boxWidth:a,boxHeight:r}=e,l=Si(e.bodyFont),h=Si(e.titleFont),c=Si(e.footerFont),d=o.length,f=n.length,g=s.length,p=ki(e.padding);let m=p.height,x=0,b=s.reduce(((t,e)=>t+e.before.length+e.lines.length+e.after.length),0);if(b+=t.beforeBody.length+t.afterBody.length,d&&(m+=d*h.lineHeight+(d-1)*e.titleSpacing+e.titleMarginBottom),b){m+=g*(e.displayColors?Math.max(r,l.lineHeight):l.lineHeight)+(b-g)*l.lineHeight+(b-1)*e.bodySpacing}f&&(m+=e.footerMarginTop+f*c.lineHeight+(f-1)*e.footerSpacing);let _=0;const y=function(t){x=Math.max(x,i.measureText(t).width+_)};return i.save(),i.font=h.string,u(t.title,y),i.font=l.string,u(t.beforeBody.concat(t.afterBody),y),_=e.displayColors?a+2+e.boxPadding:0,u(s,(t=>{u(t.before,y),u(t.lines,y),u(t.after,y)})),_=0,i.font=c.string,u(t.footer,y),i.restore(),x+=p.width,{width:x,height:m}}function La(t,e,i,s){const{x:n,width:o}=i,{width:a,chartArea:{left:r,right:l}}=t;let h="center";return"center"===s?h=n<=(r+l)/2?"left":"right":n<=o/2?h="left":n>=a-o/2&&(h="right"),function(t,e,i,s){const{x:n,width:o}=s,a=i.caretSize+i.caretPadding;return"left"===t&&n+o+a>e.width||"right"===t&&n-o-a<0||void 0}(h,t,e,i)&&(h="center"),h}function Ea(t,e,i){const s=i.yAlign||e.yAlign||function(t,e){const{y:i,height:s}=e;return i<s/2?"top":i>t.height-s/2?"bottom":"center"}(t,i);return{xAlign:i.xAlign||e.xAlign||La(t,e,i,s),yAlign:s}}function Ra(t,e,i,s){const{caretSize:n,caretPadding:o,cornerRadius:a}=t,{xAlign:r,yAlign:l}=i,h=n+o,{topLeft:c,topRight:d,bottomLeft:u,bottomRight:f}=wi(a);let g=function(t,e){let{x:i,width:s}=t;return"right"===e?i-=s:"center"===e&&(i-=s/2),i}(e,r);const p=function(t,e,i){let{y:s,height:n}=t;return"top"===e?s+=i:s-="bottom"===e?n+i:n/2,s}(e,l,h);return"center"===l?"left"===r?g+=h:"right"===r&&(g-=h):"left"===r?g-=Math.max(c,u)+n:"right"===r&&(g+=Math.max(d,f)+n),{x:Z(g,0,s.width-e.width),y:Z(p,0,s.height-e.height)}}function Ia(t,e,i){const s=ki(i.padding);return"center"===e?t.x+t.width/2:"right"===e?t.x+t.width-s.right:t.x+s.left}function za(t){return Ca([],Oa(t))}function Fa(t,e){const i=e&&e.dataset&&e.dataset.tooltip&&e.dataset.tooltip.callbacks;return i?t.override(i):t}const Va={beforeTitle:e,title(t){if(t.length>0){const e=t[0],i=e.chart.data.labels,s=i?i.length:0;if(this&&this.options&&"dataset"===this.options.mode)return e.dataset.label||"";if(e.label)return e.label;if(s>0&&e.dataIndex<s)return i[e.dataIndex]}return""},afterTitle:e,beforeBody:e,beforeLabel:e,label(t){if(this&&this.options&&"dataset"===this.options.mode)return t.label+": "+t.formattedValue||t.formattedValue;let e=t.dataset.label||"";e&&(e+=": ");const i=t.formattedValue;return s(i)||(e+=i),e},labelColor(t){const e=t.chart.getDatasetMeta(t.datasetIndex).controller.getStyle(t.dataIndex);return{borderColor:e.borderColor,backgroundColor:e.backgroundColor,borderWidth:e.borderWidth,borderDash:e.borderDash,borderDashOffset:e.borderDashOffset,borderRadius:0}},labelTextColor(){return this.options.bodyColor},labelPointStyle(t){const e=t.chart.getDatasetMeta(t.datasetIndex).controller.getStyle(t.dataIndex);return{pointStyle:e.pointStyle,rotation:e.rotation}},afterLabel:e,afterBody:e,beforeFooter:e,footer:e,afterFooter:e};function Ba(t,e,i,s){const n=t[e].call(i,s);return void 0===n?Va[e].call(i,s):n}class Wa extends $s{static positioners=Da;constructor(t){super(),this.opacity=0,this._active=[],this._eventPosition=void 0,this._size=void 0,this._cachedAnimations=void 0,this._tooltipItems=[],this.$animations=void 0,this.$context=void 0,this.chart=t.chart,this.options=t.options,this.dataPoints=void 0,this.title=void 0,this.beforeBody=void 0,this.body=void 0,this.afterBody=void 0,this.footer=void 0,this.xAlign=void 0,this.yAlign=void 0,this.x=void 0,this.y=void 0,this.height=void 0,this.width=void 0,this.caretX=void 0,this.caretY=void 0,this.labelColors=void 0,this.labelPointStyles=void 0,this.labelTextColors=void 0}initialize(t){this.options=t,this._cachedAnimations=void 0,this.$context=void 0}_resolveAnimations(){const t=this._cachedAnimations;if(t)return t;const e=this.chart,i=this.options.setContext(this.getContext()),s=i.enabled&&e.options.animation&&i.animations,n=new Ts(this.chart,s);return s._cacheable&&(this._cachedAnimations=Object.freeze(n)),n}getContext(){return this.$context||(this.$context=(t=this.chart.getContext(),e=this,i=this._tooltipItems,Ci(t,{tooltip:e,tooltipItems:i,type:"tooltip"})));var t,e,i}getTitle(t,e){const{callbacks:i}=e,s=Ba(i,"beforeTitle",this,t),n=Ba(i,"title",this,t),o=Ba(i,"afterTitle",this,t);let a=[];return a=Ca(a,Oa(s)),a=Ca(a,Oa(n)),a=Ca(a,Oa(o)),a}getBeforeBody(t,e){return za(Ba(e.callbacks,"beforeBody",this,t))}getBody(t,e){const{callbacks:i}=e,s=[];return u(t,(t=>{const e={before:[],lines:[],after:[]},n=Fa(i,t);Ca(e.before,Oa(Ba(n,"beforeLabel",this,t))),Ca(e.lines,Ba(n,"label",this,t)),Ca(e.after,Oa(Ba(n,"afterLabel",this,t))),s.push(e)})),s}getAfterBody(t,e){return za(Ba(e.callbacks,"afterBody",this,t))}getFooter(t,e){const{callbacks:i}=e,s=Ba(i,"beforeFooter",this,t),n=Ba(i,"footer",this,t),o=Ba(i,"afterFooter",this,t);let a=[];return a=Ca(a,Oa(s)),a=Ca(a,Oa(n)),a=Ca(a,Oa(o)),a}_createItems(t){const e=this._active,i=this.chart.data,s=[],n=[],o=[];let a,r,l=[];for(a=0,r=e.length;a<r;++a)l.push(Aa(this.chart,e[a]));return t.filter&&(l=l.filter(((e,s,n)=>t.filter(e,s,n,i)))),t.itemSort&&(l=l.sort(((e,s)=>t.itemSort(e,s,i)))),u(l,(e=>{const i=Fa(t.callbacks,e);s.push(Ba(i,"labelColor",this,e)),n.push(Ba(i,"labelPointStyle",this,e)),o.push(Ba(i,"labelTextColor",this,e))})),this.labelColors=s,this.labelPointStyles=n,this.labelTextColors=o,this.dataPoints=l,l}update(t,e){const i=this.options.setContext(this.getContext()),s=this._active;let n,o=[];if(s.length){const t=Da[i.position].call(this,s,this._eventPosition);o=this._createItems(i),this.title=this.getTitle(o,i),this.beforeBody=this.getBeforeBody(o,i),this.body=this.getBody(o,i),this.afterBody=this.getAfterBody(o,i),this.footer=this.getFooter(o,i);const e=this._size=Ta(this,i),a=Object.assign({},t,e),r=Ea(this.chart,i,a),l=Ra(i,a,r,this.chart);this.xAlign=r.xAlign,this.yAlign=r.yAlign,n={opacity:1,x:l.x,y:l.y,width:e.width,height:e.height,caretX:t.x,caretY:t.y}}else 0!==this.opacity&&(n={opacity:0});this._tooltipItems=o,this.$context=void 0,n&&this._resolveAnimations().update(this,n),t&&i.external&&i.external.call(this,{chart:this.chart,tooltip:this,replay:e})}drawCaret(t,e,i,s){const n=this.getCaretPosition(t,i,s);e.lineTo(n.x1,n.y1),e.lineTo(n.x2,n.y2),e.lineTo(n.x3,n.y3)}getCaretPosition(t,e,i){const{xAlign:s,yAlign:n}=this,{caretSize:o,cornerRadius:a}=i,{topLeft:r,topRight:l,bottomLeft:h,bottomRight:c}=wi(a),{x:d,y:u}=t,{width:f,height:g}=e;let p,m,x,b,_,y;return"center"===n?(_=u+g/2,"left"===s?(p=d,m=p-o,b=_+o,y=_-o):(p=d+f,m=p+o,b=_-o,y=_+o),x=p):(m="left"===s?d+Math.max(r,h)+o:"right"===s?d+f-Math.max(l,c)-o:this.caretX,"top"===n?(b=u,_=b-o,p=m-o,x=m+o):(b=u+g,_=b+o,p=m+o,x=m-o),y=b),{x1:p,x2:m,x3:x,y1:b,y2:_,y3:y}}drawTitle(t,e,i){const s=this.title,n=s.length;let o,a,r;if(n){const l=Oi(i.rtl,this.x,this.width);for(t.x=Ia(this,i.titleAlign,i),e.textAlign=l.textAlign(i.titleAlign),e.textBaseline="middle",o=Si(i.titleFont),a=i.titleSpacing,e.fillStyle=i.titleColor,e.font=o.string,r=0;r<n;++r)e.fillText(s[r],l.x(t.x),t.y+o.lineHeight/2),t.y+=o.lineHeight+a,r+1===n&&(t.y+=i.titleMarginBottom-a)}}_drawColorBox(t,e,i,s,n){const a=this.labelColors[i],r=this.labelPointStyles[i],{boxHeight:l,boxWidth:h}=n,c=Si(n.bodyFont),d=Ia(this,"left",n),u=s.x(d),f=l<c.lineHeight?(c.lineHeight-l)/2:0,g=e.y+f;if(n.usePointStyle){const e={radius:Math.min(h,l)/2,pointStyle:r.pointStyle,rotation:r.rotation,borderWidth:1},i=s.leftForLtr(u,h)+h/2,o=g+l/2;t.strokeStyle=n.multiKeyBackground,t.fillStyle=n.multiKeyBackground,Le(t,e,i,o),t.strokeStyle=a.borderColor,t.fillStyle=a.backgroundColor,Le(t,e,i,o)}else{t.lineWidth=o(a.borderWidth)?Math.max(...Object.values(a.borderWidth)):a.borderWidth||1,t.strokeStyle=a.borderColor,t.setLineDash(a.borderDash||[]),t.lineDashOffset=a.borderDashOffset||0;const e=s.leftForLtr(u,h),i=s.leftForLtr(s.xPlus(u,1),h-2),r=wi(a.borderRadius);Object.values(r).some((t=>0!==t))?(t.beginPath(),t.fillStyle=n.multiKeyBackground,He(t,{x:e,y:g,w:h,h:l,radius:r}),t.fill(),t.stroke(),t.fillStyle=a.backgroundColor,t.beginPath(),He(t,{x:i,y:g+1,w:h-2,h:l-2,radius:r}),t.fill()):(t.fillStyle=n.multiKeyBackground,t.fillRect(e,g,h,l),t.strokeRect(e,g,h,l),t.fillStyle=a.backgroundColor,t.fillRect(i,g+1,h-2,l-2))}t.fillStyle=this.labelTextColors[i]}drawBody(t,e,i){const{body:s}=this,{bodySpacing:n,bodyAlign:o,displayColors:a,boxHeight:r,boxWidth:l,boxPadding:h}=i,c=Si(i.bodyFont);let d=c.lineHeight,f=0;const g=Oi(i.rtl,this.x,this.width),p=function(i){e.fillText(i,g.x(t.x+f),t.y+d/2),t.y+=d+n},m=g.textAlign(o);let x,b,_,y,v,M,w;for(e.textAlign=o,e.textBaseline="middle",e.font=c.string,t.x=Ia(this,m,i),e.fillStyle=i.bodyColor,u(this.beforeBody,p),f=a&&"right"!==m?"center"===o?l/2+h:l+2+h:0,y=0,M=s.length;y<M;++y){for(x=s[y],b=this.labelTextColors[y],e.fillStyle=b,u(x.before,p),_=x.lines,a&&_.length&&(this._drawColorBox(e,t,y,g,i),d=Math.max(c.lineHeight,r)),v=0,w=_.length;v<w;++v)p(_[v]),d=c.lineHeight;u(x.after,p)}f=0,d=c.lineHeight,u(this.afterBody,p),t.y-=n}drawFooter(t,e,i){const s=this.footer,n=s.length;let o,a;if(n){const r=Oi(i.rtl,this.x,this.width);for(t.x=Ia(this,i.footerAlign,i),t.y+=i.footerMarginTop,e.textAlign=r.textAlign(i.footerAlign),e.textBaseline="middle",o=Si(i.footerFont),e.fillStyle=i.footerColor,e.font=o.string,a=0;a<n;++a)e.fillText(s[a],r.x(t.x),t.y+o.lineHeight/2),t.y+=o.lineHeight+i.footerSpacing}}drawBackground(t,e,i,s){const{xAlign:n,yAlign:o}=this,{x:a,y:r}=t,{width:l,height:h}=i,{topLeft:c,topRight:d,bottomLeft:u,bottomRight:f}=wi(s.cornerRadius);e.fillStyle=s.backgroundColor,e.strokeStyle=s.borderColor,e.lineWidth=s.borderWidth,e.beginPath(),e.moveTo(a+c,r),"top"===o&&this.drawCaret(t,e,i,s),e.lineTo(a+l-d,r),e.quadraticCurveTo(a+l,r,a+l,r+d),"center"===o&&"right"===n&&this.drawCaret(t,e,i,s),e.lineTo(a+l,r+h-f),e.quadraticCurveTo(a+l,r+h,a+l-f,r+h),"bottom"===o&&this.drawCaret(t,e,i,s),e.lineTo(a+u,r+h),e.quadraticCurveTo(a,r+h,a,r+h-u),"center"===o&&"left"===n&&this.drawCaret(t,e,i,s),e.lineTo(a,r+c),e.quadraticCurveTo(a,r,a+c,r),e.closePath(),e.fill(),s.borderWidth>0&&e.stroke()}_updateAnimationTarget(t){const e=this.chart,i=this.$animations,s=i&&i.x,n=i&&i.y;if(s||n){const i=Da[t.position].call(this,this._active,this._eventPosition);if(!i)return;const o=this._size=Ta(this,t),a=Object.assign({},i,this._size),r=Ea(e,t,a),l=Ra(t,a,r,e);s._to===l.x&&n._to===l.y||(this.xAlign=r.xAlign,this.yAlign=r.yAlign,this.width=o.width,this.height=o.height,this.caretX=i.x,this.caretY=i.y,this._resolveAnimations().update(this,l))}}_willRender(){return!!this.opacity}draw(t){const e=this.options.setContext(this.getContext());let i=this.opacity;if(!i)return;this._updateAnimationTarget(e);const s={width:this.width,height:this.height},n={x:this.x,y:this.y};i=Math.abs(i)<.001?0:i;const o=ki(e.padding),a=this.title.length||this.beforeBody.length||this.body.length||this.afterBody.length||this.footer.length;e.enabled&&a&&(t.save(),t.globalAlpha=i,this.drawBackground(n,t,s,e),Ai(t,e.textDirection),n.y+=o.top,this.drawTitle(n,t,e),this.drawBody(n,t,e),this.drawFooter(n,t,e),Ti(t,e.textDirection),t.restore())}getActiveElements(){return this._active||[]}setActiveElements(t,e){const i=this._active,s=t.map((({datasetIndex:t,index:e})=>{const i=this.chart.getDatasetMeta(t);if(!i)throw new Error("Cannot find a dataset at index "+t);return{datasetIndex:t,element:i.data[e],index:e}})),n=!f(i,s),o=this._positionChanged(s,e);(n||o)&&(this._active=s,this._eventPosition=e,this._ignoreReplayEvents=!0,this.update(!0))}handleEvent(t,e,i=!0){if(e&&this._ignoreReplayEvents)return!1;this._ignoreReplayEvents=!1;const s=this.options,n=this._active||[],o=this._getActiveElements(t,n,e,i),a=this._positionChanged(o,t),r=e||!f(o,n)||a;return r&&(this._active=o,(s.enabled||s.external)&&(this._eventPosition={x:t.x,y:t.y},this.update(!0,e))),r}_getActiveElements(t,e,i,s){const n=this.options;if("mouseout"===t.type)return[];if(!s)return e.filter((t=>this.chart.data.datasets[t.datasetIndex]&&void 0!==this.chart.getDatasetMeta(t.datasetIndex).controller.getParsed(t.index)));const o=this.chart.getElementsAtEventForMode(t,n.mode,n,i);return n.reverse&&o.reverse(),o}_positionChanged(t,e){const{caretX:i,caretY:s,options:n}=this,o=Da[n.position].call(this,t,e);return!1!==o&&(i!==o.x||s!==o.y)}}var Na={id:"tooltip",_element:Wa,positioners:Da,afterInit(t,e,i){i&&(t.tooltip=new Wa({chart:t,options:i}))},beforeUpdate(t,e,i){t.tooltip&&t.tooltip.initialize(i)},reset(t,e,i){t.tooltip&&t.tooltip.initialize(i)},afterDraw(t){const e=t.tooltip;if(e&&e._willRender()){const i={tooltip:e};if(!1===t.notifyPlugins("beforeTooltipDraw",{...i,cancelable:!0}))return;e.draw(t.ctx),t.notifyPlugins("afterTooltipDraw",i)}},afterEvent(t,e){if(t.tooltip){const i=e.replay;t.tooltip.handleEvent(e.event,i,e.inChartArea)&&(e.changed=!0)}},defaults:{enabled:!0,external:null,position:"average",backgroundColor:"rgba(0,0,0,0.8)",titleColor:"#fff",titleFont:{weight:"bold"},titleSpacing:2,titleMarginBottom:6,titleAlign:"left",bodyColor:"#fff",bodySpacing:2,bodyFont:{},bodyAlign:"left",footerColor:"#fff",footerSpacing:2,footerMarginTop:6,footerFont:{weight:"bold"},footerAlign:"left",padding:6,caretPadding:2,caretSize:5,cornerRadius:6,boxHeight:(t,e)=>e.bodyFont.size,boxWidth:(t,e)=>e.bodyFont.size,multiKeyBackground:"#fff",displayColors:!0,boxPadding:0,borderColor:"rgba(0,0,0,0)",borderWidth:0,animation:{duration:400,easing:"easeOutQuart"},animations:{numbers:{type:"number",properties:["x","y","width","height","caretX","caretY"]},opacity:{easing:"linear",duration:200}},callbacks:Va},defaultRoutes:{bodyFont:"font",footerFont:"font",titleFont:"font"},descriptors:{_scriptable:t=>"filter"!==t&&"itemSort"!==t&&"external"!==t,_indexable:!1,callbacks:{_scriptable:!1,_indexable:!1},animation:{_fallback:!1},animations:{_fallback:"animation"}},additionalOptionScopes:["interaction"]};return Tn.register(Un,$o,go,t),Tn.helpers={...Hi},Tn._adapters=In,Tn.Animation=As,Tn.Animations=Ts,Tn.animator=bt,Tn.controllers=nn.controllers.items,Tn.DatasetController=js,Tn.Element=$s,Tn.elements=go,Tn.Interaction=Ki,Tn.layouts=ls,Tn.platforms=Ds,Tn.Scale=tn,Tn.Ticks=ae,Object.assign(Tn,Un,$o,go,t,Ds),Tn.Chart=Tn,"undefined"!=typeof window&&(window.Chart=Tn),Tn}));
diff --git a/static/js/searchable-select.js b/static/js/searchable-select.js
new file mode 100644
index 0000000..2ff0695
--- /dev/null
+++ b/static/js/searchable-select.js
@@ -0,0 +1,157 @@
+/*
+ * Progressive enhancement for a plain <select data-searchable> (single or
+ * `multiple`): a small typeahead combobox, a select2-alike without the
+ * dependency. Type to filter, click or Enter to pick; the hidden <select>
+ * still carries the actual value(s) the form submits, so this degrades to a
+ * normal dropdown with no JS. A `multiple` select gets removable chips for
+ * each pick instead of replacing its own value.
+ *
+ * Opt in with `data-searchable="true"` on the widget; `data-search-placeholder`
+ * sets the search input's placeholder (see management/forms.py).
+ */
+(() => {
+    function enhance(select) {
+        const isMultiple = select.multiple;
+        const options = Array.from(select.options).filter((option) => option.value !== "");
+
+        const wrapper = document.createElement("div");
+        wrapper.className = "relative";
+
+        const chips = document.createElement("div");
+        chips.className = "flex flex-wrap gap-1 empty:hidden mt-2";
+
+        const input = document.createElement("input");
+        input.type = "text";
+        input.className = "input input-bordered w-full";
+        input.placeholder = select.dataset.searchPlaceholder || "";
+        input.autocomplete = "off";
+
+        const list = document.createElement("ul");
+        list.className = "menu absolute z-10 mt-1 w-full rounded-box bg-base-100 shadow max-h-60 overflow-y-auto flex-nowrap hidden";
+
+        select.parentNode.insertBefore(wrapper, select);
+        if (isMultiple) {
+            // Chips render below the input, not above it: above meant every pick grew
+            // the block ahead of the input and shoved it (and your cursor) down --
+            // disorienting mid-search. Below, the input stays put; only the space
+            // beneath it grows, and the open dropdown (absolutely positioned right
+            // under the input) simply overlaps the chips while it's open.
+            wrapper.append(input, list, chips, select);
+        } else {
+            wrapper.append(input, list, select);
+        }
+        select.classList.add("hidden");
+
+        let highlighted = -1;
+
+        const renderChips = () => {
+            chips.innerHTML = "";
+            options.filter((option) => option.selected).forEach((option) => {
+                const chip = document.createElement("span");
+                chip.className = "badge badge-neutral gap-1";
+                chip.textContent = option.text;
+
+                const remove = document.createElement("button");
+                remove.type = "button";
+                remove.className = "opacity-70 hover:opacity-100";
+                remove.setAttribute("aria-label", "Remove");
+                remove.textContent = "×";
+                remove.addEventListener("mousedown", (event) => {
+                    // mousedown, not click: it fires before the input's blur.
+                    event.preventDefault();
+                    option.selected = false;
+                    renderChips();
+                    // Only refresh the dropdown if it was already open (actively
+                    // searching) -- removing a chip must never pop it open on its
+                    // own, with no way to close it again short of a page reload.
+                    if (!list.classList.contains("hidden")) {
+                        render(input.value);
+                    }
+                    select.dispatchEvent(new Event("change"));
+                });
+
+                chip.appendChild(remove);
+                chips.appendChild(chip);
+            });
+        };
+
+        const choose = (option) => {
+            if (isMultiple) {
+                option.selected = true;
+                renderChips();
+                input.value = "";
+                render("");
+                input.focus();
+            } else {
+                select.value = option.value;
+                input.value = option.text;
+                list.classList.add("hidden");
+            }
+            select.dispatchEvent(new Event("change"));
+        };
+
+        const render = (query) => {
+            const needle = query.trim().toLowerCase();
+            const candidates = isMultiple ? options.filter((option) => !option.selected) : options;
+            const matches = needle ? candidates.filter((option) => option.text.toLowerCase().includes(needle)) : candidates;
+
+            list.innerHTML = "";
+            matches.forEach((option) => {
+                const item = document.createElement("li");
+                const link = document.createElement("a");
+                link.textContent = option.text;
+                link.addEventListener("mousedown", (event) => {
+                    event.preventDefault();
+                    choose(option);
+                });
+                item.appendChild(link);
+                list.appendChild(item);
+            });
+
+            highlighted = -1;
+            list.classList.toggle("hidden", matches.length === 0);
+            return matches;
+        };
+
+        input.addEventListener("input", () => render(input.value));
+        input.addEventListener("focus", () => render(input.value));
+        input.addEventListener("blur", () => list.classList.add("hidden"));
+
+        input.addEventListener("keydown", (event) => {
+            const items = Array.from(list.querySelectorAll("a"));
+            if (event.key === "ArrowDown" || event.key === "ArrowUp") {
+                event.preventDefault();
+                if (!items.length) return;
+                highlighted = event.key === "ArrowDown" ? (highlighted + 1) % items.length : (highlighted - 1 + items.length) % items.length;
+                items.forEach((item, index) => item.classList.toggle("menu-active", index === highlighted));
+                items[highlighted].scrollIntoView({ block: "nearest" });
+            } else if (event.key === "Enter" && highlighted >= 0 && items[highlighted]) {
+                event.preventDefault();
+                items[highlighted].dispatchEvent(new Event("mousedown"));
+            } else if (event.key === "Escape") {
+                list.classList.add("hidden");
+            } else if (isMultiple && event.key === "Backspace" && input.value === "") {
+                // Removes the most recently added chip, matching how tag inputs
+                // elsewhere (e.g. Gmail's "To" field) treat Backspace on empty text.
+                const selected = options.filter((option) => option.selected);
+                if (selected.length) {
+                    selected[selected.length - 1].selected = false;
+                    renderChips();
+                    render("");
+                    select.dispatchEvent(new Event("change"));
+                }
+            }
+        });
+
+        if (isMultiple) {
+            renderChips();
+        } else if (select.value) {
+            // Redisplayed after a validation error elsewhere in the form: keep
+            // whatever was already chosen visible in the text input.
+            const selected = options.find((option) => option.value === select.value);
+            if (selected) input.value = selected.text;
+        }
+    }
+
+    document.querySelectorAll("select[data-searchable]").forEach(enhance);
+})();
diff --git a/teams/__init__.py b/teams/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/teams/admin.py b/teams/admin.py
new file mode 100644
index 0000000..d570912
--- /dev/null
+++ b/teams/admin.py
@@ -0,0 +1,70 @@
+from django.contrib import admin
+from django.utils.translation import gettext_lazy as _
+
+from .models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+
+class TeamMembershipInline(admin.TabularInline):
+    """Roster shown on the Team page."""
+
+    model = TeamMembership
+    extra = 0
+    raw_id_fields = ("member",)
+
+
+class StaffAssignmentInline(admin.TabularInline):
+    """Coaching / staff shown on the Team page."""
+
+    model = StaffAssignment
+    extra = 0
+    raw_id_fields = ("member",)
+
+
+class TeamPhotoInline(admin.TabularInline):
+    """One photo per season, shown on the Team page."""
+
+    model = TeamPhoto
+    extra = 0
+
+
+@admin.register(Team)
+class TeamAdmin(admin.ModelAdmin):
+    list_display = ["name", "short_name", "club"]
+    list_filter = ["club"]
+    search_fields = ["name", "short_name"]
+    inlines = [TeamMembershipInline, StaffAssignmentInline, TeamPhotoInline]
+
+
+@admin.register(TeamPhoto)
+class TeamPhotoAdmin(admin.ModelAdmin):
+    list_display = ["team", "season"]
+    list_filter = ["team__club", "season"]
+    search_fields = ["team__name"]
+
+
+@admin.register(Position)
+class PositionAdmin(admin.ModelAdmin):
+    list_display = ["name", "short_name", "club", "staff_position", "ordering"]
+    list_filter = ["club", "staff_position"]
+    search_fields = ["name", "short_name"]
+    ordering = ["ordering", "name"]
+
+
+@admin.register(TeamMembership)
+class TeamMembershipAdmin(admin.ModelAdmin):
+    list_display = ["team", "member", "season", "position", "jersey_number", "is_captain", "is_alternate_captain"]
+    list_filter = ["team", "season", "position", "is_captain"]
+    search_fields = ["team__name", "member__first_name", "member__last_name"]
+    raw_id_fields = ["member"]
+    fieldsets = [
+        [None, {"fields": ["team", "season", "member", "position"]}],
+        [_("Squad"), {"fields": ["jersey_number", "is_captain", "is_alternate_captain"]}],
+    ]
+
+
+@admin.register(StaffAssignment)
+class StaffAssignmentAdmin(admin.ModelAdmin):
+    list_display = ["team", "member", "season", "position"]
+    list_filter = ["team", "season", "position"]
+    search_fields = ["team__name", "member__first_name", "member__last_name"]
+    raw_id_fields = ["member"]
diff --git a/teams/api.py b/teams/api.py
new file mode 100644
index 0000000..6853ea7
--- /dev/null
+++ b/teams/api.py
@@ -0,0 +1,122 @@
+"""Public read-only team/roster endpoints -- see api/urls.py for how this is
+mounted. Roster building is a small helper (build_roster) rather than
+inlined in the view so it can be unit-tested without going through Ninja's
+request cycle.
+"""
+
+import uuid
+from itertools import groupby
+
+from ninja import Router, Schema
+from ninja.errors import HttpError
+
+from api.errors import require_club
+from club.services.access import current_season
+
+from .models import Team, TeamMembership, TeamPhoto
+
+router = Router(tags=["teams"])
+
+
+class TeamOut(Schema):
+    id: uuid.UUID
+    name: str
+    short_name: str
+    photo_url: str | None
+
+
+class PlayerOut(Schema):
+    id: uuid.UUID
+    first_name: str
+    last_name: str
+    jersey_number: int | None
+    is_captain: bool
+    is_alternate_captain: bool
+
+
+class PositionGroupOut(Schema):
+    position: str
+    players: list[PlayerOut]
+
+
+class StaffMemberOut(Schema):
+    id: uuid.UUID
+    first_name: str
+    last_name: str
+    position: str
+
+
+class RosterOut(Schema):
+    team: TeamOut
+    season: str | None
+    players: list[PositionGroupOut]
+    staff: list[StaffMemberOut]
+
+
+def _to_team_out(team, request, photo=None) -> TeamOut:
+    photo_url = request.build_absolute_uri(photo.image.url) if photo else None
+    return TeamOut(id=team.pk, name=team.name, short_name=team.short_name, photo_url=photo_url)
+
+
+def _to_player_out(membership) -> PlayerOut:
+    return PlayerOut(
+        id=membership.member_id,
+        first_name=membership.member.first_name,
+        last_name=membership.member.last_name,
+        jersey_number=membership.jersey_number,
+        is_captain=membership.is_captain,
+        is_alternate_captain=membership.is_alternate_captain,
+    )
+
+
+def build_roster(team, request) -> RosterOut:
+    """Current season's players -- grouped by position (so a consumer can pull
+    just e.g. "Forward" without filtering a flat list itself), each group
+    sorted by jersey number, groups themselves in Position.ordering order --
+    and staff, for `team`. No current season -> empty roster, same "nothing
+    to show, not an error" handling as management.views.MembershipListView."""
+    season = current_season(team.club)
+    if season is None:
+        return RosterOut(team=_to_team_out(team, request), season=None, players=[], staff=[])
+
+    photo = TeamPhoto.objects.filter(team=team, season=season).first()
+
+    memberships = TeamMembership.objects.filter(team=team, season=season).select_related("member", "position").order_by("position__ordering", "position__name", "jersey_number")
+    assignments = team.staff_assignments.filter(season=season).select_related("member", "position").order_by("position__ordering", "position__name", "member__last_name")
+
+    # groupby only groups consecutive runs -- relies on the queryset already
+    # being ordered by position first, which it is.
+    players = [PositionGroupOut(position=position_name, players=[_to_player_out(m) for m in members]) for position_name, members in groupby(memberships, key=lambda m: m.position.name)]
+    staff = [
+        StaffMemberOut(id=assignment.member_id, first_name=assignment.member.first_name, last_name=assignment.member.last_name, position=assignment.position.name)
+        for assignment in assignments
+    ]
+
+    return RosterOut(team=_to_team_out(team, request, photo=photo), season=season.name, players=players, staff=staff)
+
+
+@router.get("/", response=list[TeamOut], summary="List teams")
+def list_teams(request):
+    club = require_club(request)
+    teams = list(Team.objects.filter(club=club).order_by("name"))
+
+    season = current_season(club)
+    photos_by_team_id = {}
+    if season is not None and teams:
+        photos_by_team_id = {photo.team_id: photo for photo in TeamPhoto.objects.filter(team__in=teams, season=season)}
+
+    return [_to_team_out(team, request, photo=photos_by_team_id.get(team.pk)) for team in teams]
+
+
+@router.get("/{team_id}/roster/", response=RosterOut, summary="Current season's roster")
+def get_roster(request, team_id: uuid.UUID):
+    club = require_club(request)
+    team = _get_team_or_404(club, team_id)
+    return build_roster(team, request)
+
+
+def _get_team_or_404(club, team_id):
+    team = Team.objects.filter(club=club, pk=team_id).first()
+    if team is None:
+        raise HttpError(404, "No such team.")
+    return team
diff --git a/teams/apps.py b/teams/apps.py
new file mode 100644
index 0000000..2cbcff7
--- /dev/null
+++ b/teams/apps.py
@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class TeamsConfig(AppConfig):
+    name = "teams"
diff --git a/teams/migrations/0001_initial.py b/teams/migrations/0001_initial.py
new file mode 100644
index 0000000..a203854
--- /dev/null
+++ b/teams/migrations/0001_initial.py
@@ -0,0 +1,100 @@
+# Generated by Django 6.0.6 on 2026-07-12 14:43
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('club', '0008_alter_clubmembership_unique_together_and_more'),
+        ('members', '0002_alter_familymembership_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Position',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('short_name', models.CharField(max_length=255, verbose_name='short name')),
+                ('ordering', models.PositiveSmallIntegerField(default=0, verbose_name='ordering')),
+                ('staff_position', models.BooleanField(default=False, verbose_name='staff position')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'position',
+                'verbose_name_plural': 'positions',
+                'ordering': ['ordering', 'name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='Team',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('short_name', models.CharField(max_length=255, verbose_name='short name')),
+                ('club', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='%(class)ss', to='club.club')),
+            ],
+            options={
+                'verbose_name': 'team',
+                'verbose_name_plural': 'teams',
+            },
+        ),
+        migrations.CreateModel(
+            name='StaffAssignment',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='staff_assignments', to='members.member', verbose_name='member')),
+                ('position', models.ForeignKey(limit_choices_to={'staff_position': True}, on_delete=django.db.models.deletion.PROTECT, related_name='staff_assignments', to='teams.position', verbose_name='position')),
+                ('season', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='staff_assignments', to='club.season', verbose_name='season')),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='staff_assignments', to='teams.team', verbose_name='team')),
+            ],
+            options={
+                'verbose_name': 'staff assignment',
+                'verbose_name_plural': 'staff assignments',
+                'ordering': ['team', 'member__last_name', 'member__first_name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='TeamMembership',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('jersey_number', models.PositiveSmallIntegerField(blank=True, null=True, verbose_name='jersey number')),
+                ('is_captain', models.BooleanField(default=False, verbose_name='is captain')),
+                ('is_alternate_captain', models.BooleanField(default=False, verbose_name='is alternate captain')),
+                ('member', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='team_memberships', to='members.member', verbose_name='member')),
+                ('position', models.ForeignKey(limit_choices_to={'staff_position': False}, on_delete=django.db.models.deletion.PROTECT, related_name='team_memberships', to='teams.position', verbose_name='position')),
+                ('season', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='team_memberships', to='club.season', verbose_name='season')),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='roster', to='teams.team', verbose_name='team')),
+            ],
+            options={
+                'verbose_name': 'team membership',
+                'verbose_name_plural': 'team memberships',
+                'ordering': ['team', 'member__last_name', 'member__first_name'],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='position',
+            constraint=models.UniqueConstraint(fields=('club', 'name'), name='unique_position_name_per_club'),
+        ),
+        migrations.AddConstraint(
+            model_name='team',
+            constraint=models.UniqueConstraint(fields=('club', 'name'), name='unique_team_name_per_club'),
+        ),
+        migrations.AddConstraint(
+            model_name='staffassignment',
+            constraint=models.UniqueConstraint(fields=('team', 'season', 'member'), name='unique_staff_member_per_team_per_season'),
+        ),
+        migrations.AddConstraint(
+            model_name='teammembership',
+            constraint=models.UniqueConstraint(fields=('team', 'season', 'member'), name='unique_member_per_team_per_season'),
+        ),
+        migrations.AddConstraint(
+            model_name='teammembership',
+            constraint=models.UniqueConstraint(fields=('team', 'season', 'jersey_number'), name='unique_jersey_number_per_team_per_season'),
+        ),
+    ]
diff --git a/teams/migrations/0002_position_management_position.py b/teams/migrations/0002_position_management_position.py
new file mode 100644
index 0000000..ebf1f0e
--- /dev/null
+++ b/teams/migrations/0002_position_management_position.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-13 07:45
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('teams', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='position',
+            name='management_position',
+            field=models.BooleanField(default=False, verbose_name='management position'),
+        ),
+    ]
diff --git a/teams/migrations/0003_position_management_position_implies_staff_position.py b/teams/migrations/0003_position_management_position_implies_staff_position.py
new file mode 100644
index 0000000..617266e
--- /dev/null
+++ b/teams/migrations/0003_position_management_position_implies_staff_position.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-13 07:53
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0009_clubrole'),
+        ('teams', '0002_position_management_position'),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name='position',
+            constraint=models.CheckConstraint(condition=models.Q(('management_position', False), ('staff_position', True), _connector='OR'), name='management_position_implies_staff_position'),
+        ),
+    ]
diff --git a/teams/migrations/0004_position_created_position_modified_and_more.py b/teams/migrations/0004_position_created_position_modified_and_more.py
new file mode 100644
index 0000000..0b4cf51
--- /dev/null
+++ b/teams/migrations/0004_position_created_position_modified_and_more.py
@@ -0,0 +1,58 @@
+# Generated by Django 6.0.6 on 2026-07-13 22:51
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('teams', '0003_position_management_position_implies_staff_position'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='position',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566331, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='position',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='staffassignment',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566347, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='staffassignment',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='team',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566410, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='team',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+        migrations.AddField(
+            model_name='teammembership',
+            name='created',
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2026, 7, 13, 22, 51, 35, 566427, tzinfo=datetime.timezone.utc), verbose_name='created'),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='teammembership',
+            name='modified',
+            field=models.DateTimeField(auto_now=True, verbose_name='modified'),
+        ),
+    ]
diff --git a/teams/migrations/0005_alter_position_management_position_and_more.py b/teams/migrations/0005_alter_position_management_position_and_more.py
new file mode 100644
index 0000000..f5e5f5a
--- /dev/null
+++ b/teams/migrations/0005_alter_position_management_position_and_more.py
@@ -0,0 +1,23 @@
+# Generated by Django 6.0.6 on 2026-08-03 15:55
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('teams', '0004_position_created_position_modified_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='position',
+            name='management_position',
+            field=models.BooleanField(default=False, help_text='A staff position with management authority over the team (e.g. head coach) -- requires staff position to also be checked.', verbose_name='management position'),
+        ),
+        migrations.AlterField(
+            model_name='position',
+            name='staff_position',
+            field=models.BooleanField(default=False, help_text='Coach, manager, physio, ... -- assignable via a StaffAssignment rather than a team roster spot.', verbose_name='staff position'),
+        ),
+    ]
diff --git a/teams/migrations/0006_alter_position_ordering.py b/teams/migrations/0006_alter_position_ordering.py
new file mode 100644
index 0000000..3752819
--- /dev/null
+++ b/teams/migrations/0006_alter_position_ordering.py
@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-08-03 15:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('teams', '0005_alter_position_management_position_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='position',
+            name='ordering',
+            field=models.PositiveSmallIntegerField(default=0, help_text="Lower numbers are listed first (e.g. on a team's roster). Positions with the same number are ordered by name.", verbose_name='ordering'),
+        ),
+    ]
diff --git a/teams/migrations/0007_teamphoto.py b/teams/migrations/0007_teamphoto.py
new file mode 100644
index 0000000..0c2ae03
--- /dev/null
+++ b/teams/migrations/0007_teamphoto.py
@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-08-06 13:56
+
+import django.db.models.deletion
+import teams.models
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('club', '0018_club_sport_type'),
+        ('teams', '0006_alter_position_ordering'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='TeamPhoto',
+            fields=[
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('image', models.ImageField(upload_to=teams.models.team_photo_path, verbose_name='image')),
+                ('season', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='team_photos', to='club.season', verbose_name='season')),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='photos', to='teams.team', verbose_name='team')),
+            ],
+            options={
+                'verbose_name': 'team photo',
+                'verbose_name_plural': 'team photos',
+                'constraints': [models.UniqueConstraint(fields=('team', 'season'), name='unique_team_photo_per_season')],
+            },
+        ),
+    ]
diff --git a/teams/migrations/__init__.py b/teams/migrations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/teams/models.py b/teams/models.py
new file mode 100644
index 0000000..8a2e5cc
--- /dev/null
+++ b/teams/models.py
@@ -0,0 +1,118 @@
+from django.db import models
+from django.db.models import Q
+from django.utils.translation import gettext_lazy as _
+
+from club.models import Season
+from members.models import Member
+from rosterchief.base import ClubScopedModel, UUIDModel, validate_club_scope
+
+
+class Team(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    short_name = models.CharField(_("short name"), max_length=255)
+
+    class Meta:
+        verbose_name = _("team")
+        verbose_name_plural = _("teams")
+        constraints = [
+            models.UniqueConstraint(fields=["club", "name"], name="unique_team_name_per_club"),
+        ]
+
+    def __str__(self):
+        return self.name
+
+
+def team_photo_path(instance, filename):
+    return f"clubs/{instance.team.club.slug}/teams/{instance.team_id}/{instance.season.name}/{filename}"
+
+
+class TeamPhoto(UUIDModel):
+    """One team photo per season -- a team's makeup changes every season, so
+    this can't be a plain field on Team. No club FK of its own: club is
+    already reachable via team.club, same reasoning as NewsPhoto being owned
+    by News rather than club-scoped itself."""
+
+    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="photos", verbose_name=_("team"))
+    season = models.ForeignKey(Season, on_delete=models.PROTECT, related_name="team_photos", verbose_name=_("season"))
+    image = models.ImageField(_("image"), upload_to=team_photo_path)
+
+    class Meta:
+        verbose_name = _("team photo")
+        verbose_name_plural = _("team photos")
+        constraints = [
+            models.UniqueConstraint(fields=["team", "season"], name="unique_team_photo_per_season"),
+        ]
+
+    def __str__(self):
+        return f"{self.team} - {self.season}"
+
+
+class Position(ClubScopedModel):
+    name = models.CharField(_("name"), max_length=255)
+    short_name = models.CharField(_("short name"), max_length=255)
+    ordering = models.PositiveSmallIntegerField(_("ordering"), default=0, help_text=_("Lower numbers are listed first (e.g. on a team's roster). Positions with the same number are ordered by name."))
+
+    staff_position = models.BooleanField(_("staff position"), default=False, help_text=_("Coach, manager, physio, ... -- assignable via a StaffAssignment rather than a team roster spot."))
+    management_position = models.BooleanField(_("management position"), default=False, help_text=_("A staff position with management authority over the team (e.g. head coach) -- requires staff position to also be checked."))
+
+    class Meta:
+        verbose_name = _("position")
+        verbose_name_plural = _("positions")
+        constraints = [
+            models.UniqueConstraint(fields=["club", "name"], name="unique_position_name_per_club"),
+            # A management position is always a staff position.
+            models.CheckConstraint(condition=Q(management_position=False) | Q(staff_position=True), name="management_position_implies_staff_position"),
+        ]
+        ordering = ["ordering", "name"]
+
+    def __str__(self):
+        return self.name
+
+
+class TeamMembership(UUIDModel):
+    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="roster", verbose_name=_("team"))
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="team_memberships", verbose_name=_("member"))
+    season = models.ForeignKey(Season, on_delete=models.PROTECT, related_name="team_memberships", verbose_name=_("season"))
+    position = models.ForeignKey(Position, on_delete=models.PROTECT, related_name="team_memberships", verbose_name=_("position"), limit_choices_to={"staff_position": False})
+
+    jersey_number = models.PositiveSmallIntegerField(_("jersey number"), blank=True, null=True)
+    is_captain = models.BooleanField(_("is captain"), default=False)
+    is_alternate_captain = models.BooleanField(_("is alternate captain"), default=False)
+
+    class Meta:
+        verbose_name = _("team membership")
+        verbose_name_plural = _("team memberships")
+        ordering = ["team", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["team", "season", "member"], name="unique_member_per_team_per_season"),
+            models.UniqueConstraint(fields=["team", "season", "jersey_number"], name="unique_jersey_number_per_team_per_season"),
+        ]
+
+    def __str__(self):
+        return f"{self.team} - {self.member}"
+
+    def clean(self):
+        club_id = self.team.club_id if self.team_id else None
+        validate_club_scope(self, club_id, same_club_fields=("season", "position"))
+
+
+class StaffAssignment(UUIDModel):
+    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="staff_assignments", verbose_name=_("team"))
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="staff_assignments", verbose_name=_("member"))
+    season = models.ForeignKey(Season, on_delete=models.PROTECT, related_name="staff_assignments", verbose_name=_("season"))
+    position = models.ForeignKey(Position, on_delete=models.PROTECT, related_name="staff_assignments", verbose_name=_("position"), limit_choices_to={"staff_position": True})
+
+    class Meta:
+        verbose_name = _("staff assignment")
+        verbose_name_plural = _("staff assignments")
+        ordering = ["team", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["team", "season", "member"], name="unique_staff_member_per_team_per_season"),
+        ]
+
+    def __str__(self):
+        return f"{self.team} - {self.member}"
+
+    def clean(self):
+        club_id = self.team.club_id if self.team_id else None
+        validate_club_scope(self, club_id, same_club_fields=("season", "position"))
diff --git a/teams/tests.py b/teams/tests.py
new file mode 100644
index 0000000..08f4bdb
--- /dev/null
+++ b/teams/tests.py
@@ -0,0 +1,190 @@
+import datetime
+
+from django.core.exceptions import ValidationError
+from django.db import IntegrityError
+from django.db.models import ProtectedError
+from django.test import TestCase
+
+from club.models import Club, Season
+from members.models import Member
+
+from .models import Position, StaffAssignment, Team, TeamMembership, TeamPhoto
+
+
+class TeamsTestCase(TestCase):
+    def setUp(self):
+        self.club = Club.objects.create(name="Ajax United", slug="ajax-united")
+        self.season = Season.objects.create(
+            club=self.club,
+            start_date=datetime.date(2026, 8, 1),
+            end_date=datetime.date(2027, 5, 31),
+        )
+        self.team = Team.objects.create(club=self.club, name="First Team", short_name="1st")
+        self.forward = Position.objects.create(club=self.club, name="Forward", short_name="FW")
+        self.coach = Position.objects.create(club=self.club, name="Head Coach", short_name="HC", staff_position=True)
+        self.member = Member.objects.create(first_name="Jane", last_name="Doe")
+
+
+class TeamModelTests(TeamsTestCase):
+    def test_str_returns_name(self):
+        self.assertEqual(str(self.team), "First Team")
+
+    def test_team_name_is_unique_per_club(self):
+        with self.assertRaises(IntegrityError):
+            Team.objects.create(club=self.club, name="First Team", short_name="dup")
+
+    def test_same_team_name_allowed_in_other_club(self):
+        other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        Team.objects.create(club=other, name="First Team", short_name="1st")
+
+        self.assertEqual(Team.objects.filter(name="First Team").count(), 2)
+
+
+class PositionModelTests(TeamsTestCase):
+    def test_str_returns_name(self):
+        self.assertEqual(str(self.forward), "Forward")
+
+    def test_defaults(self):
+        self.assertFalse(self.forward.staff_position)
+        self.assertEqual(self.forward.ordering, 0)
+
+    def test_positions_ordered_by_ordering_then_name(self):
+        keeper = Position.objects.create(club=self.club, name="Keeper", short_name="GK", ordering=1)
+
+        ordered = list(Position.objects.filter(club=self.club).values_list("name", flat=True))
+        # ordering=0 entries first (alphabetical), then ordering=1.
+        self.assertEqual(ordered, ["Forward", "Head Coach", "Keeper"])
+        self.assertEqual(keeper.ordering, 1)
+
+    def test_position_name_is_unique_per_club(self):
+        with self.assertRaises(IntegrityError):
+            Position.objects.create(club=self.club, name="Forward", short_name="dup")
+
+    def test_management_position_must_also_be_a_staff_position(self):
+        with self.assertRaises(IntegrityError):
+            Position.objects.create(club=self.club, name="Bogus", short_name="BG", staff_position=False, management_position=True)
+
+    def test_management_staff_position_is_allowed(self):
+        position = Position.objects.create(club=self.club, name="Manager", short_name="MG", staff_position=True, management_position=True)
+
+        self.assertTrue(position.management_position)
+
+
+class TeamMembershipModelTests(TeamsTestCase):
+    def test_can_create_roster_entry(self):
+        entry = TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward, jersey_number=9)
+
+        self.assertEqual(entry.position, self.forward)
+        self.assertFalse(entry.is_captain)
+        self.assertEqual(str(entry), "First Team - Jane Doe")
+        self.assertEqual(list(self.team.roster.all()), [entry])
+
+    def test_member_is_unique_per_team_and_season(self):
+        TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward, jersey_number=9)
+
+        with self.assertRaises(IntegrityError):
+            TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward, jersey_number=10)
+
+    def test_jersey_number_is_unique_per_team_and_season(self):
+        TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward, jersey_number=9)
+        other = Member.objects.create(first_name="John", last_name="Smith")
+
+        with self.assertRaises(IntegrityError):
+            TeamMembership.objects.create(team=self.team, member=other, season=self.season, position=self.forward, jersey_number=9)
+
+    def test_season_is_protected_while_referenced(self):
+        TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward)
+
+        with self.assertRaises(ProtectedError):
+            self.season.delete()
+
+
+class StaffAssignmentModelTests(TeamsTestCase):
+    def test_can_assign_staff(self):
+        assignment = StaffAssignment.objects.create(team=self.team, member=self.member, season=self.season, position=self.coach)
+
+        self.assertEqual(assignment.position, self.coach)
+        self.assertEqual(str(assignment), "First Team - Jane Doe")
+        self.assertEqual(list(self.team.staff_assignments.all()), [assignment])
+
+    def test_member_is_unique_per_team_and_season(self):
+        StaffAssignment.objects.create(team=self.team, member=self.member, season=self.season, position=self.coach)
+
+        with self.assertRaises(IntegrityError):
+            StaffAssignment.objects.create(team=self.team, member=self.member, season=self.season, position=self.coach)
+
+    def test_roster_and_staff_use_separate_reverse_accessors(self):
+        TeamMembership.objects.create(team=self.team, member=self.member, season=self.season, position=self.forward)
+        coach_member = Member.objects.create(first_name="Coach", last_name="Carter")
+        StaffAssignment.objects.create(team=self.team, member=coach_member, season=self.season, position=self.coach)
+
+        self.assertEqual(self.forward.team_memberships.count(), 1)
+        self.assertEqual(self.coach.staff_assignments.count(), 1)
+
+
+class RosterCleanTests(TeamsTestCase):
+    def setUp(self):
+        super().setUp()
+        self.other = Club.objects.create(name="Rival FC", slug="rival-fc")
+        self.other_season = Season.objects.create(club=self.other, start_date=datetime.date(2026, 8, 1), end_date=datetime.date(2027, 5, 31))
+        self.other_position = Position.objects.create(club=self.other, name="Forward", short_name="FW")
+        self.other_coach = Position.objects.create(club=self.other, name="Coach", short_name="C", staff_position=True)
+
+    def test_teammembership_rejects_cross_club_season(self):
+        entry = TeamMembership(team=self.team, member=self.member, season=self.other_season, position=self.forward)
+        with self.assertRaises(ValidationError) as ctx:
+            entry.full_clean()
+        self.assertIn("season", ctx.exception.error_dict)
+
+    def test_teammembership_rejects_cross_club_position(self):
+        entry = TeamMembership(team=self.team, member=self.member, season=self.season, position=self.other_position)
+        with self.assertRaises(ValidationError) as ctx:
+            entry.full_clean()
+        self.assertIn("position", ctx.exception.error_dict)
+
+    def test_teammembership_accepts_same_club(self):
+        TeamMembership(team=self.team, member=self.member, season=self.season, position=self.forward).full_clean()
+
+    def test_staffassignment_rejects_cross_club_season(self):
+        assignment = StaffAssignment(team=self.team, member=self.member, season=self.other_season, position=self.coach)
+        with self.assertRaises(ValidationError) as ctx:
+            assignment.full_clean()
+        self.assertIn("season", ctx.exception.error_dict)
+
+    def test_staffassignment_accepts_same_club(self):
+        StaffAssignment(team=self.team, member=self.member, season=self.season, position=self.coach).full_clean()
+
+
+class TeamPhotoModelTests(TeamsTestCase):
+    def test_can_set_a_photo(self):
+        photo = TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        self.assertEqual(str(photo), "First Team - 26-27")
+        self.assertEqual(list(self.team.photos.all()), [photo])
+
+    def test_only_one_photo_per_team_and_season(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        with self.assertRaises(IntegrityError):
+            TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic2.jpg")
+
+    def test_the_same_team_can_have_a_photo_in_a_different_season(self):
+        other_season = Season.objects.create(club=self.club, start_date=datetime.date(2000, 1, 1), end_date=datetime.date(2000, 12, 31))
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        TeamPhoto.objects.create(team=self.team, season=other_season, image="clubs/ajax-united/teams/x/00-00/pic.jpg")
+
+        self.assertEqual(self.team.photos.count(), 2)
+
+    def test_season_is_protected_while_a_photo_references_it(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        with self.assertRaises(ProtectedError):
+            self.season.delete()
+
+    def test_deleting_the_team_deletes_its_photos(self):
+        TeamPhoto.objects.create(team=self.team, season=self.season, image="clubs/ajax-united/teams/x/26-27/pic.jpg")
+
+        self.team.delete()
+
+        self.assertEqual(TeamPhoto.objects.count(), 0)
diff --git a/teams/views.py b/teams/views.py
new file mode 100644
index 0000000..60f00ef
--- /dev/null
+++ b/teams/views.py
@@ -0,0 +1 @@
+# Create your views here.
diff --git a/templates/403.html b/templates/403.html
new file mode 100644
index 0000000..6e44cdc
--- /dev/null
+++ b/templates/403.html
@@ -0,0 +1,26 @@
+{% extends base_template %}
+{% load i18n lucide %}
+
+{% comment %}
+    Django's default 403 handler (django.views.defaults.permission_denied) looks up
+    this exact filename automatically -- no urls.py wiring needed. Rendered through
+    the tenant's own skin (base_template, from club.context_processors.branding),
+    same reasoning as maintenance.html: a club sees its own logo and colours, not a
+    bare error page, and the navbar (sign out, theme toggle, ...) stays reachable
+    since {% block main %} is the only thing this page actually replaces.
+{% endcomment %}
+
+{% block head_title %}{% trans "Access denied" %}{% endblock head_title %}
+
+{% block main %}
+    <div class="flex justify-center">
+        <div class="card w-full max-w-xl bg-base-100 shadow">
+            <div class="card-body items-center text-center">
+                <div class="text-error">{% lucide "shield-x" size=48 %}</div>
+                <h1 class="card-title mt-2">{% trans "Access denied" %}</h1>
+                <p class="opacity-80">{% trans "You don't have permission to view this page." %}</p>
+                <a class="btn btn-primary mt-4 gap-2" href="/">{% lucide "house" size=16 %} {% trans "Go to home" %}</a>
+            </div>
+        </div>
+    </div>
+{% endblock main %}
diff --git a/templates/_base.html b/templates/_base.html
new file mode 100644
index 0000000..abbe5bc
--- /dev/null
+++ b/templates/_base.html
@@ -0,0 +1,204 @@
+{% load lucide static ui %}
+
+{% comment %}
+    The page skeleton, with no branding of its own. `_platform_base.html` dresses it
+    as RosterChief, `_club_base.html` as a club; the `branding` context processor
+    picks between them per tenant.
+{% endcomment %}
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+
+        <title>
+            {% block title %}RosterChief{% endblock title %}
+        </title>
+
+        {% comment %}
+            Apply the stored theme before first paint, otherwise the page flashes the wrong
+            colours. Nothing stored means "auto": we set no attribute at all, so daisyUI's
+            `dark --prefersdark` follows the OS.
+        {% endcomment %}
+        <script>
+            (() => {
+                const stored = localStorage.getItem("theme");
+                if (stored) document.documentElement.setAttribute("data-theme", stored);
+            })();
+        </script>
+
+        <link rel="stylesheet" href="{% static 'css/app.css' %}"/>
+
+        {# After the stylesheet: brand overrides (logo urls, club colours) must win. #}
+        {% block extra %}{% endblock extra %}
+    </head>
+
+    {% comment %}
+        An app shell: the viewport is the frame, and exactly one region scrolls. The body is a
+        flex column pinned to the screen height with overflow hidden, so the navbar and the
+        sidebar cannot be scrolled away — only <main> moves. Leave the body scrollable instead
+        and a "sticky" sidebar still drifts on a long page, which is the thing this is for.
+    {% endcomment %}
+    <body class="flex h-screen flex-col overflow-hidden bg-base-200">
+        {% comment %}
+            Every text label on the right (theme name, "Django admin", the user's email) is
+            wrapped in `hidden sm:inline` — icon-only below the `sm` breakpoint, with the
+            button's own padding doing the rest (no fixed width to fight). None of these
+            buttons wrap or shrink on their own (button labels don't break), so on a
+            360-400px phone the unlabelled row is what keeps the navbar from forcing the
+            whole page wider than the device — which, left unchecked, makes the browser
+            zoom the entire layout out to fit rather than actually rendering at device width.
+            `min-w-0` on the brand block matters for the same reason: a flex item defaults to
+            `min-width: auto`, which ignores `flex-1` and refuses to shrink past its content's
+            intrinsic width.
+        {% endcomment %}
+        <div class="navbar shrink-0 border-b border-base-300 bg-base-100 px-3 shadow-sm sm:px-6">
+            <div class="my-4 min-w-0 flex-1">
+                {% block brand %}{% endblock brand %}
+            </div>
+
+            <button class="btn btn-ghost" type="button" data-theme-toggle aria-label="Theme">
+                <span data-theme-icon="light" class="hidden items-center gap-4">{% lucide "sun" size=20 %} <span class="hidden sm:inline">light</span></span>
+                <span data-theme-icon="dark" class="hidden items-center gap-4">{% lucide "moon" size=20 %} <span class="hidden sm:inline">dark</span></span>
+                <span data-theme-icon="auto" class="hidden items-center gap-4">{% lucide "sun-moon" size=20 %} <span class="hidden sm:inline">auto</span></span>
+            </button>
+
+            {% if user.is_authenticated %}
+                {% if has_management_access %}
+                    {# Only ever true on a club subdomain -- see management.context_processors.management_link. #}
+                    <a class="btn btn-ghost gap-4" href="{% url "management:home" %}" aria-label="Management">{% lucide "layout-dashboard" %}<span class="hidden sm:inline">Management</span></a>
+                {% endif %}
+
+                {% if user.is_superuser %}
+                    <a class="btn btn-ghost gap-4" href="{% url "admin:index" %}" aria-label="Django admin">{% lucide "shield-cog" %}<span class="hidden sm:inline">Django admin</span></a>
+                {% endif %}
+
+                <div class="dropdown dropdown-end">
+                    <div tabindex="0" role="button" class="btn btn-ghost gap-4" aria-label="Account">{% lucide "circle-user" %}<span class="hidden max-w-40 truncate sm:inline">{{ user.get_full_name }}</span></div>
+                    <ul tabindex="0" class="menu dropdown-content z-10 mt-2 w-60 rounded-box bg-base-100 p-2 shadow border border-base-content/20">
+                        <li class="menu-title truncate sm:hidden">{{ user.email }}</li>
+                        <li>
+                            <a href="{% url 'mfa_index' %}">{% lucide "shield-check" size=16 %} Two-factor authentication</a>
+                        </li>
+                        <li>
+                            <a href="{% url 'account_change_password' %}">{% lucide "key-round" size=16 %} Change password</a>
+                        </li>
+                        <li>
+                            <a href="{% url 'account_logout' %}">{% lucide "log-out" size=16 %} Sign out</a>
+                        </li>
+                    </ul>
+                </div>
+            {% else %}
+                <a class="btn btn-ghost gap-4" href="{% url 'account_login' %}">{% lucide "log-in" size=16 %} Sign in</a>
+            {% endif %}
+        </div>
+
+        <div class="flex flex-1 overflow-hidden">
+            {% comment %}
+                The sidebar is a sibling of <main>, not inside it, so it sits outside the one
+                scrolling region and stays put by construction. Pages with no menu (the auth
+                screens) leave the block empty and <main> simply takes the full width.
+            {% endcomment %}
+            {% block menu %}{% endblock menu %}
+
+            {% comment %}
+                `scrollbar-gutter: stable` reserves the scrollbar's width whether or not
+                the page actually overflows -- without it, a short page (nothing to
+                scroll) renders a hair wider than a tall one (scrollbar eats the width),
+                and switching between them visibly shifts the content.
+            {% endcomment %}
+            <main class="flex-1 overflow-y-auto scrollbar-gutter-stable">
+                <div class="mx-auto w-full px-8 py-6">
+                    {% if messages %}
+                        <div class="mb-6 w-full space-y-2">
+                            {% for message in messages %}
+                                {% with alert=message|as_alert %}
+                                    <div class="alert alert-soft border-2 {{ alert.css }}" role="alert">
+                                        {% lucide alert.icon size=20 %}
+                                        <div>
+                                            <div class="font-bold">{{ alert.title }}</div>
+                                            <div class="text-sm">{{ alert.body }}</div>
+                                        </div>
+                                    </div>
+                                {% endwith %}
+                            {% endfor %}
+                        </div>
+                    {% endif %}
+
+                    {% block main %}{% endblock main %}
+                </div>
+
+                <footer class="mx-auto w-full px-8 pb-6 text-center text-xs opacity-60">
+                    &copy; {% now "Y" %} Bernard Siebens &middot; <a class="link link-hover" href="mailto:info@rosterchief.app">info@rosterchief.app</a>
+                </footer>
+            </main>
+        </div>
+
+        <script>
+            // The button cycles light -> dark -> auto. "auto" removes the attribute and the
+            // stored key rather than writing the OS's current choice: that keeps daisyUI's
+            // `dark --prefersdark` following the OS *live*, so the page flips when the OS
+            // does. Storing a snapshot would freeze it at whatever the OS was on click.
+            const MODES = ["light", "dark", "auto"];
+            const currentMode = () => localStorage.getItem("theme") || "auto";
+
+            const applyMode = (mode) => {
+                if (mode === "auto") {
+                    localStorage.removeItem("theme");
+                    document.documentElement.removeAttribute("data-theme");
+                } else {
+                    localStorage.setItem("theme", mode);
+                    document.documentElement.setAttribute("data-theme", mode);
+                }
+
+                // Show the label for the *chosen* mode, not the resulting colours -- otherwise
+                // "auto" would be indistinguishable from whichever theme it resolved to.
+                // `hidden` and `inline-flex` are both display utilities, so the visible one
+                // must carry exactly one of them: leaving both on would let stylesheet order,
+                // not class order, decide who wins.
+                document.querySelectorAll("[data-theme-icon]").forEach((label) => {
+                    const active = label.dataset.themeIcon === mode;
+                    label.classList.toggle("hidden", !active);
+                    label.classList.toggle("inline-flex", active);
+                });
+                document.querySelectorAll("[data-theme-toggle]").forEach((button) => button.setAttribute("aria-label", `Theme: ${mode}`));
+            };
+
+            document.querySelectorAll("[data-theme-toggle]").forEach((button) => {
+                button.addEventListener("click", () => applyMode(MODES[(MODES.indexOf(currentMode()) + 1) % MODES.length]));
+            });
+
+            applyMode(currentMode());
+        </script>
+
+        <script>
+            // A TOTP code is 6 characters, a recovery code 8, and allauth accepts either in
+            // the same field. The boxed otp layout only fits six, so past that we fall back
+            // to a plain input rather than letting the text spill out of the boxes. Boxing
+            // the field to six and calling it done would lock recovery codes out entirely.
+            document.querySelectorAll("[data-otp]").forEach((otp) => {
+                const input = otp.querySelector("input");
+                if (!input) return;
+
+                const fit = () => {
+                    const boxed = input.value.length <= 6;
+                    otp.classList.toggle("otp", boxed);
+                    otp.classList.toggle("otp-lg", boxed);
+                    otp.querySelectorAll("span").forEach((box) => box.classList.toggle("hidden", !boxed));
+                    input.classList.toggle("input", !boxed);
+                    input.classList.toggle("input-lg", !boxed);
+                };
+
+                input.addEventListener("input", fit);
+                fit();
+            });
+        </script>
+
+        {% comment %}
+            allauth puts page-level scripts and out-of-form markup here — notably the
+            hidden `mfa_login` form the passkey button submits. Without this block that
+            form is never rendered and "Sign in with a passkey" is a dead button.
+        {% endcomment %}
+        {% block extra_body %}{% endblock extra_body %}
+    </body>
+</html>
diff --git a/templates/_club_base.html b/templates/_club_base.html
new file mode 100644
index 0000000..527942b
--- /dev/null
+++ b/templates/_club_base.html
@@ -0,0 +1,58 @@
+{% extends "_base.html" %}
+
+{% comment %}
+    A club's skin, used on its subdomain. `club` comes from the branding context
+    processor, which reads the tenant resolved by ClubTenantMiddleware.
+{% endcomment %}
+
+{% block title %}
+    {% block head_title %}{% endblock head_title %} · {{ club.name }}
+{% endblock title %}
+
+{% block extra %}
+    {% if club.primary_color or club.secondary_color %}
+        {% comment %}
+            daisyUI declares its theme variables inside `@layer base`, and unlayered styles
+            beat every layered rule regardless of specificity -- so this plain :root wins
+            without any !important or selector games. primary_content_color / secondary_content_color
+            are computed from the club's colours so a pale brand doesn't end up with
+            white-on-yellow buttons or initials.
+        {% endcomment %}
+        <style>
+            :root {
+                {% if club.primary_color %}
+                    --color-primary: {{ club.primary_color }};
+                    --color-primary-content: {{ club.primary_content_color }};
+                {% endif %}
+                {% if club.secondary_color %}
+                    --color-secondary: {{ club.secondary_color }};
+                    --color-secondary-content: {{ club.secondary_content_color }};
+                {% endif %}
+            }
+        </style>
+    {% endif %}
+{% endblock extra %}
+
+{% block brand %}
+    <a class="flex flex-row items-center gap-3" href="/">
+        {% if club.logo %}
+            {# The ring is the club's own primary colour -- a plain frame around whatever crest they uploaded. #}
+            <div class="avatar">
+                <div class="w-16 rounded-full bg-base-100 ring-2 ring-primary ring-offset-2 ring-offset-base-100">
+                    <img class="club-logo object-contain" src="{{ club.logo.url }}" alt="{{ club.name }}">
+                </div>
+            </div>
+        {% else %}
+            {# Never the RosterChief mark: that would pass our branding off as the club's own. #}
+            <div class="avatar avatar-placeholder">
+                <div class="w-16 rounded-full bg-secondary text-secondary-content">
+                    <span class="font-roboto text-xl font-bold">{{ club.initials }}</span>
+                </div>
+            </div>
+        {% endif %}
+        <div class="flex flex-col gap-1">
+            <div class="font-roboto text-2xl font-bold tracking-wider">{{ club.name }}</div>
+            <div class="font-mono text-xs font-semibold text-base-content/50">Powered by RosterChief</div>
+        </div>
+    </a>
+{% endblock brand %}
diff --git a/templates/_platform_base.html b/templates/_platform_base.html
new file mode 100644
index 0000000..74daa0d
--- /dev/null
+++ b/templates/_platform_base.html
@@ -0,0 +1,35 @@
+{% extends "_base.html" %}
+{% load static %}
+
+{% comment %}
+    RosterChief's own skin: the platform control panel, Django-admin-adjacent pages,
+    and every auth screen served on the base domain.
+{% endcomment %}
+
+{% block title %}
+    {% block head_title %}{% endblock head_title %} · RosterChief
+{% endblock title %}
+
+{% block extra %}
+    {% comment %}
+        Named after the logo's own ink, not the theme it is used on: the white logo goes
+        on dark backgrounds and vice versa. They live here rather than in app.css because
+        only Django knows the {% static %} URL.
+    {% endcomment %}
+    <style>
+        :root {
+            --logo-light: url("{% static 'images/rosterchief-white.svg' %}");
+            --logo-dark: url("{% static 'images/rosterchief-dark.svg' %}");
+        }
+    </style>
+{% endblock extra %}
+
+{% block brand %}
+    <a class="flex flex-row items-center gap-2" href="/">
+        <span class="logo inline-block h-16 w-16" role="img" aria-label="RosterChief"></span>
+        <div class="flex flex-col gap-1">
+            <div class="font-roboto text-2xl font-bold tracking-wider">Roster<span class="text-sky-500">Chief</span></div>
+            <div class="font-mono text-xs font-semibold text-base-content/50">Club &amp; Team Management</div>
+        </div>
+    </a>
+{% endblock brand %}
diff --git a/templates/account/login.html b/templates/account/login.html
new file mode 100644
index 0000000..923bb9f
--- /dev/null
+++ b/templates/account/login.html
@@ -0,0 +1,65 @@
+{% extends "account/base_entrance.html" %}
+{% load allauth i18n lucide ui %}
+
+{% comment %}
+    Overridden for layout: "Remember Me" sits on the button row rather than floating as
+    a third field, and the passkey button sits beside Sign In instead of below a rule.
+
+    The passkey button submits a *different* form (the hidden `mfa_login` rendered by the
+    webauthn snippet in extra_body) via the `form` attribute — forms cannot nest, so it
+    can live inside the login form and still post elsewhere.
+{% endcomment %}
+
+{% block head_title %}
+    {% trans "Sign In" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Sign In" %}
+    {% endelement %}
+
+    <form class="mt-8" method="post" action="{% url 'account_login' %}">
+        {% csrf_token %}
+
+        <div class="mb-10">
+            {% element fields form=form unlabeled=True exclude="remember" %}
+            {% endelement %}
+        </div>
+
+        {{ redirect_field }}
+
+        <div class="flex flex-wrap items-center justify-between gap-3">
+            {% if form.fields.remember %}
+                <label class="label cursor-pointer justify-start gap-3" for="{{ form.remember.id_for_label }}">
+                    {{ form.remember|daisy }}
+                    <span class="label-text">{{ form.remember.label }}</span>
+                </label>
+            {% else %}
+                <span></span>
+            {% endif %}
+
+            <div class="flex flex-wrap gap-2">
+                <button class="btn btn-primary gap-2" type="submit">{% lucide "log-in" size=16 %} {% trans "Sign In" %}</button>
+                {% if PASSKEY_LOGIN_ENABLED %}
+                    <button class="btn btn-accent gap-2" type="submit" form="mfa_login" id="passkey_login">{% lucide "key-round" size=16 %} {% trans "Sign in with a passkey" %}</button>
+                {% endif %}
+            </div>
+        </div>
+    </form>
+
+    {% if LOGIN_BY_CODE_ENABLED %}
+        {% element hr %}
+        {% endelement %}
+        {% element button href=request_login_code_url tags="prominent,login,outline,primary" %}
+            {% trans "Send me a sign-in code" %}
+        {% endelement %}
+    {% endif %}
+{% endblock content %}
+
+{% block extra_body %}
+    {{ block.super }}
+    {% if PASSKEY_LOGIN_ENABLED %}
+        {% include "mfa/webauthn/snippets/login_script.html" with button_id="passkey_login" %}
+    {% endif %}
+{% endblock extra_body %}
diff --git a/templates/account/logout.html b/templates/account/logout.html
new file mode 100644
index 0000000..0deb535
--- /dev/null
+++ b/templates/account/logout.html
@@ -0,0 +1,33 @@
+{% extends "account/base_manage.html" %}
+{% load allauth i18n lucide %}
+
+{% comment %}
+    Overridden for layout: Cancel sits beside Sign Out, both with icons.
+
+    Cancel points at "/" rather than the Referer header — "/" already resolves per tenant
+    (club home on a club subdomain, control panel on the base domain), whereas Referer can
+    be missing or off-site, and is not something to turn into a link unchecked.
+{% endcomment %}
+
+{% block head_title %}
+    {% trans "Sign Out" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Sign Out" %}
+    {% endelement %}
+    {% element p %}
+        {% trans 'Are you sure you want to sign out?' %}
+    {% endelement %}
+
+    <form class="mt-8" method="post" action="{% url 'account_logout' %}">
+        {% csrf_token %}
+        {{ redirect_field }}
+
+        <div class="flex flex-wrap items-center justify-end gap-2">
+            <a class="btn btn-outline gap-2" href="/">{% lucide "arrow-left" size=16 %} {% trans "Cancel" %}</a>
+            <button class="btn btn-primary gap-2" type="submit">{% lucide "log-out" size=16 %} {% trans "Sign Out" %}</button>
+        </div>
+    </form>
+{% endblock content %}
diff --git a/templates/account/password_change.html b/templates/account/password_change.html
new file mode 100644
index 0000000..226ae62
--- /dev/null
+++ b/templates/account/password_change.html
@@ -0,0 +1,40 @@
+{% extends "account/base_manage_password.html" %}
+{% load allauth i18n lucide %}
+
+{% comment %}
+    Overridden for layout: the fields lose their visible labels (allauth already gives each
+    a placeholder), the current password is set apart from the new one, and the actions
+    become real buttons.
+
+    The two field groups are rendered by two `fields` calls with complementary excludes —
+    that is what puts air between "what you have now" and "what you want it to be", rather
+    than three identical boxes in a stack.
+{% endcomment %}
+
+{% block head_title %}
+    {% trans "Change Password" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Change Password" %}
+    {% endelement %}
+
+    <form class="mt-8" method="post" action="{% url 'account_change_password' %}">
+        {% csrf_token %}
+        {{ redirect_field }}
+
+        {% element fields form=form unlabeled=True exclude="password1,password2" %}
+        {% endelement %}
+
+        <div class="mt-10">
+            {% element fields form=form unlabeled=True exclude="oldpassword" %}
+            {% endelement %}
+        </div>
+
+        <div class="mt-10 flex flex-wrap items-center justify-end gap-2">
+            <a class="btn btn-accent btn-outline gap-2" href="{% url 'account_reset_password' %}">{% lucide "life-buoy" size=16 %} {% trans "Forgot Password?" %}</a>
+            <button class="btn btn-primary gap-2" type="submit">{% lucide "key-round" size=16 %} {% trans "Change Password" %}</button>
+        </div>
+    </form>
+{% endblock content %}
diff --git a/templates/allauth/elements/alert.html b/templates/allauth/elements/alert.html
new file mode 100644
index 0000000..e57a824
--- /dev/null
+++ b/templates/allauth/elements/alert.html
@@ -0,0 +1,4 @@
+{% load allauth %}
+<div class="alert {% if attrs.level == 'error' %}alert-error{% elif attrs.level == 'warning' %}alert-warning{% elif attrs.level == 'success' %}alert-success{% else %}alert-info{% endif %} my-2">
+    <span>{% slot message %}{% endslot %}</span>
+</div>
diff --git a/templates/allauth/elements/badge.html b/templates/allauth/elements/badge.html
new file mode 100644
index 0000000..432e80c
--- /dev/null
+++ b/templates/allauth/elements/badge.html
@@ -0,0 +1 @@
+{% load allauth %}<span class="badge badge-neutral">{% slot %}{% endslot %}</span>
diff --git a/templates/allauth/elements/button.html b/templates/allauth/elements/button.html
new file mode 100644
index 0000000..088b43d
--- /dev/null
+++ b/templates/allauth/elements/button.html
@@ -0,0 +1,22 @@
+{% load allauth lucide %}
+
+{% comment %}
+    allauth tags every button it renders, and mapping those tags is what styles the MFA
+    and account pages without overriding each one. The ranking matters: those pages put
+    three buttons in a row (Deactivate / View / Download) and rely on the tags to say
+    which is destructive and which is secondary. Flattening them all to btn-primary makes
+    "Deactivate" look exactly as safe as "View".
+{% endcomment %}
+{% comment %} djlint:off {% endcomment %}
+<{% if attrs.href %}a href="{{ attrs.href }}"{% else %}button{% endif %}
+class="btn gap-2 {% if attrs.tags and 'danger' in attrs.tags %}btn-error{% elif attrs.tags and 'link' in attrs.tags %}btn-link{% elif attrs.tags and 'secondary' in attrs.tags %}btn-outline{% elif attrs.tags and 'outline' in attrs.tags %}btn-outline btn-primary{% else %}btn-primary{% endif %}"
+{% if attrs.form %}form="{{ attrs.form }}"{% endif %}
+{% if attrs.id %}id="{{ attrs.id }}"{% endif %}
+{% if attrs.name %}name="{{ attrs.name }}"{% endif %}
+{% if attrs.value %}value="{{ attrs.value }}"{% endif %}
+{% if attrs.type %}type="{{ attrs.type }}"{% endif %}
+>
+{% if attrs.icon %}{% lucide attrs.icon size=16 %}{% endif %}
+{% slot %}
+{% endslot %}
+</{% if attrs.href %}a{% else %}button{% endif %}>
diff --git a/templates/allauth/elements/button_group.html b/templates/allauth/elements/button_group.html
new file mode 100644
index 0000000..f0ed9cc
--- /dev/null
+++ b/templates/allauth/elements/button_group.html
@@ -0,0 +1,4 @@
+{% load allauth %}
+<div class="flex flex-wrap gap-2">
+    {% slot %}{% endslot %}
+</div>
diff --git a/templates/allauth/elements/details.html b/templates/allauth/elements/details.html
new file mode 100644
index 0000000..ceab2e8
--- /dev/null
+++ b/templates/allauth/elements/details.html
@@ -0,0 +1,5 @@
+{% load allauth %}
+<details class="collapse-arrow collapse border border-base-300 bg-base-100 my-2" {% if attrs.open %}open{% endif %}>
+    <summary class="collapse-title font-medium">{% slot summary %}{% endslot %}</summary>
+    <div class="collapse-content">{% slot body %}{% endslot %}</div>
+</details>
diff --git a/templates/allauth/elements/field.html b/templates/allauth/elements/field.html
new file mode 100644
index 0000000..5e6bd51
--- /dev/null
+++ b/templates/allauth/elements/field.html
@@ -0,0 +1,42 @@
+{% load allauth %}
+
+{% comment %}
+    A standalone field that isn't part of a Django form — allauth uses it for the TOTP
+    secret and the recovery-code list. Mono, because both are strings people copy
+    character by character and must not misread.
+{% endcomment %}
+{{ attrs.errors }}
+<div class="form-control my-6 w-full">
+    {% if slots.label %}
+        <label class="label" for="{{ attrs.id }}">
+            <span class="label-text">{% slot label %}{% endslot %}</span>
+        </label>
+    {% endif %}
+
+    {% if attrs.type == "textarea" %}
+        <textarea class="textarea textarea-bordered w-full font-mono"
+                  {% if attrs.required %}required{% endif %}
+                  {% if attrs.rows %}rows="{{ attrs.rows }}"{% endif %}
+                  {% if attrs.disabled %}disabled{% endif %}
+                  {% if attrs.readonly %}readonly{% endif %}
+                  {% if attrs.name %}name="{{ attrs.name }}"{% endif %}
+                  {% if attrs.id %}id="{{ attrs.id }}"{% endif %}
+                  {% if attrs.placeholder %}placeholder="{{ attrs.placeholder }}"{% endif %}>{% slot value %}{% endslot %}</textarea>
+    {% else %}
+        <input class="input input-bordered w-full font-mono"
+               {% if attrs.required %}required{% endif %}
+               {% if attrs.disabled %}disabled{% endif %}
+               {% if attrs.readonly %}readonly{% endif %}
+               {% if attrs.checked %}checked{% endif %}
+               {% if attrs.name %}name="{{ attrs.name }}"{% endif %}
+               {% if attrs.id %}id="{{ attrs.id }}"{% endif %}
+               {% if attrs.placeholder %}placeholder="{{ attrs.placeholder }}"{% endif %}
+               {% if attrs.autocomplete %}autocomplete="{{ attrs.autocomplete }}"{% endif %}
+               {% if attrs.value is not None %}value="{{ attrs.value }}"{% endif %}
+               type="{{ attrs.type }}">
+    {% endif %}
+
+    {% if slots.help_text %}
+        <span class="label-text-alt mt-1 block text-base-content/70">{% slot help_text %}{% endslot %}</span>
+    {% endif %}
+</div>
diff --git a/templates/allauth/elements/fields.html b/templates/allauth/elements/fields.html
new file mode 100644
index 0000000..6481eae
--- /dev/null
+++ b/templates/allauth/elements/fields.html
@@ -0,0 +1,102 @@
+{% load lucide ui %}
+
+{% comment %}
+    allauth passes `unlabeled=True` on the entrance forms (login, signup, reset) and
+    already sets a placeholder on each of their fields ("Email address", "Password"),
+    so dropping the visible label loses nothing on screen. The label is still emitted
+    sr-only inside the wrapper: a placeholder is not a label, and it disappears the
+    moment you start typing.
+
+    Fields with an icon use daisyUI's icon-in-field layout, where the `input` class
+    goes on the *wrapping label* and the input itself carries only `grow`. Putting
+    `input` on both draws a box inside a box.
+{% endcomment %}
+{% for field in attrs.form.hidden_fields %}{{ field }}{% endfor %}
+{% for error in attrs.form.non_field_errors %}
+    <div class="alert alert-error my-2">
+        <span>{{ error }}</span>
+    </div>
+{% endfor %}
+{% comment %}
+    `exclude` lets a page lay a field out itself — the login page puts "remember" on the
+    button row. It is pinned to a real variable first, and that is not cosmetic: passing
+    `attrs.exclude` straight into a filter on a page that never set it raises
+    VariableDoesNotExist, which Django catches for the *main* variable of an expression
+    but not for a filter *argument*. {% if %} then swallows it and reads the condition as
+    false — silently dropping every field on every form that doesn't pass `exclude`.
+{% endcomment %}
+{% with exclude=attrs.exclude|default:"" %}
+    {% for field in attrs.form.visible_fields %}
+        {% if not field|excluded:exclude %}
+            <div class="form-control my-3 w-full">
+                {% if field.field.widget.input_type == "checkbox" %}
+                    <label class="label cursor-pointer justify-start gap-3" for="{{ field.id_for_label }}">
+                        {{ field|daisy }}
+                        <span class="label-text">{{ field.label }}</span>
+                    </label>
+                {% else %}
+                    {% if not attrs.unlabeled and not field|is_otp %}
+                        <label class="label" for="{{ field.id_for_label }}">
+                            <span class="label-text">{{ field.label }}</span>
+                        </label>
+                    {% endif %}
+                    {% with icon=field|field_icon %}
+                        {% if field|is_otp %}
+                            {% comment %}
+                        daisyUI's otp is one input overlaid on the boxes. Child order is load-bearing:
+                        it places each box with `nth-child`, which counts *every* child, not just the
+                        spans — so the input must come LAST. Put it first and all six boxes shift one
+                        stride right, the container matches :has(>span:nth-child(7)) and grows to
+                        seven strides, and the ::after active-box marker (invisible until focus) shows
+                        up in the gap as a phantom seventh box.
+
+                        For the same reason the sr-only label lives outside the container: another
+                        child would throw the count off again.
+
+                        The overlaid input carries daisyUI's own `pointer-events: none` (it exists so
+                        clicks land on the boxes, not a naked input) — which also means a tap/click on
+                        the boxes never reaches the input directly. A <label for> is what actually
+                        closes that gap: browsers focus a labelled control on click regardless of the
+                        control's own pointer-events, so wrapping the boxes in one (without adding a
+                        child *inside* the otp container, which would break the nth-child count above)
+                        makes the whole visible field tappable. Without it the field is a decorative
+                        box nobody can enter a code into — invisible on desktop, where autofocus or Tab
+                        gets you there anyway, but a dead end on mobile, which has neither.
+                    {% endcomment %}
+                            <label class="sr-only" for="{{ field.id_for_label }}">{{ field.label }}</label>
+                            <div class="flex justify-center">
+                                <label class="contents" for="{{ field.id_for_label }}">
+                                    <div class="otp otp-lg" data-otp>
+                                        <span></span>
+                                        <span></span>
+                                        <span></span>
+                                        <span></span>
+                                        <span></span>
+                                        <span></span>
+                                        {{ field|as_otp }}
+                                    </div>
+                                </label>
+                            </div>
+                        {% elif icon %}
+                            <label class="input flex w-full items-center gap-2 {% if field.errors %}input-error{% endif %}" for="{{ field.id_for_label }}">
+                                <span class="opacity-50">{% lucide icon size=16 %}</span>
+                                {% if attrs.unlabeled %}<span class="sr-only">{{ field.label }}</span>{% endif %}
+                                {{ field|daisy:"grow" }}
+                            </label>
+                        {% else %}
+                            {{ field|daisy }}
+                        {% endif %}
+                    {% endwith %}
+                {% endif %}
+                {% comment %}
+            The password field's help_text is allauth's "Forgot your password?" link, so it
+            gets room to breathe. The id is not decorative: Django points the input's
+            aria-describedby at `<auto_id>_helptext`, and without it that reference dangles
+            and the link is never announced.
+        {% endcomment %}
+                {% if field.help_text %}<span id="{{ field.auto_id }}_helptext" class="label-text-alt mt-3 block text-base-content/70">{{ field.help_text }}</span>{% endif %}
+                {% for error in field.errors %}<span class="label-text-alt mt-1 text-error">{{ error }}</span>{% endfor %}
+            </div>
+        {% endif %}
+    {% endfor %}
+{% endwith %}
diff --git a/templates/allauth/elements/form.html b/templates/allauth/elements/form.html
new file mode 100644
index 0000000..3bbba1a
--- /dev/null
+++ b/templates/allauth/elements/form.html
@@ -0,0 +1,23 @@
+{% load allauth %}
+
+{% comment %}
+    `id` is not decorative: allauth renders out-of-band forms (webauthn, logout-from-stage)
+    and points buttons at them with the HTML `form` attribute. Drop the id and those
+    buttons submit nothing.
+
+    The action bar is drawn when the actions slot has something in it — NOT keyed on
+    `no_visible_fields`, which means the form has no visible *fields* (logout is a bare
+    csrf token, and so is TOTP deactivate) and says nothing about its buttons. Keying the
+    bar on it hides the Sign Out button on the very page whose only purpose is that button.
+{% endcomment %}
+<form method="{{ attrs.method }}"
+      {% if attrs.id %}id="{{ attrs.id }}"{% endif %}
+      {% if attrs.action %}action="{{ attrs.action }}"{% endif %}
+      class="space-y-2">
+    {% slot body %}{% endslot %}
+    {% if slots.actions %}
+        <div class="card-actions justify-end pt-3">
+            {% slot actions %}{% endslot %}
+        </div>
+    {% endif %}
+</form>
diff --git a/templates/allauth/elements/h1.html b/templates/allauth/elements/h1.html
new file mode 100644
index 0000000..92a6edb
--- /dev/null
+++ b/templates/allauth/elements/h1.html
@@ -0,0 +1 @@
+{% comment %} djlint:off {% endcomment %}{% load allauth %}<h1 class="card-title text-2xl border-b border-base-content pb-2 mb-2">{% slot %}{% endslot %}</h1>
diff --git a/templates/allauth/elements/h2.html b/templates/allauth/elements/h2.html
new file mode 100644
index 0000000..0018ab0
--- /dev/null
+++ b/templates/allauth/elements/h2.html
@@ -0,0 +1 @@
+{% comment %} djlint:off {% endcomment %}{% load allauth %}<h2 class="text-xl font-semibold">{% slot %}{% endslot %}</h2>
diff --git a/templates/allauth/elements/hr.html b/templates/allauth/elements/hr.html
new file mode 100644
index 0000000..31684e3
--- /dev/null
+++ b/templates/allauth/elements/hr.html
@@ -0,0 +1 @@
+{% comment %} djlint:off {% endcomment %}{% load allauth %}<div class="divider"></div>
diff --git a/templates/allauth/elements/img.html b/templates/allauth/elements/img.html
new file mode 100644
index 0000000..c7a607d
--- /dev/null
+++ b/templates/allauth/elements/img.html
@@ -0,0 +1,10 @@
+{% load allauth %}
+
+{% comment %}
+    Only used for the TOTP QR code. The white plate is not decoration: the QR is dark
+    modules on a transparent ground, so on the dark theme it would be dark-on-dark and
+    phones could not scan it.
+{% endcomment %}
+<div class="my-4 flex justify-center">
+    <img class="rounded-box bg-white p-3" src="{{ attrs.src }}" {% if attrs.alt %}alt="{{ attrs.alt }}"{% endif %}>
+</div>
diff --git a/templates/allauth/elements/p.html b/templates/allauth/elements/p.html
new file mode 100644
index 0000000..04cd76c
--- /dev/null
+++ b/templates/allauth/elements/p.html
@@ -0,0 +1 @@
+{% comment %} djlint:off {% endcomment %}{% load allauth %}<p class="text-base-content/80">{% slot %}{% endslot %}</p>
diff --git a/templates/allauth/elements/panel.html b/templates/allauth/elements/panel.html
new file mode 100644
index 0000000..44c3931
--- /dev/null
+++ b/templates/allauth/elements/panel.html
@@ -0,0 +1,9 @@
+{% load allauth %}
+<div class="card border border-base-content/20 bg-base-100 my-4">
+    <div class="card-body gap-2">
+        {% if slots.title %}<h2 class="card-title text-lg">{% slot title %}{% endslot %}</h2>{% endif %}
+        <div>{% slot body %}{% endslot %}</div>
+        {% if slots.actions %}
+            <div class="card-actions mt-4 justify-end">{% slot actions %}{% endslot %}</div>{% endif %}
+    </div>
+</div>
diff --git a/templates/allauth/elements/table.html b/templates/allauth/elements/table.html
new file mode 100644
index 0000000..bf01d82
--- /dev/null
+++ b/templates/allauth/elements/table.html
@@ -0,0 +1,6 @@
+{% load allauth %}
+<div class="overflow-x-auto">
+    <table class="table">
+        {% slot %}{% endslot %}
+    </table>
+</div>
diff --git a/templates/allauth/layouts/base.html b/templates/allauth/layouts/base.html
new file mode 100644
index 0000000..ac71a41
--- /dev/null
+++ b/templates/allauth/layouts/base.html
@@ -0,0 +1,20 @@
+{% extends base_template %}
+
+{% comment %}
+    Not a fixed parent: `base_template` is resolved per request by the branding context
+    processor, so every auth screen allauth ships -- login, password reset, MFA, passkeys,
+    and whatever it adds next -- picks up the club's skin on a club subdomain and the
+    RosterChief one on the base domain, with no template of its own knowing clubs exist.
+
+    The title is left to the chosen base, which suffixes the club or the platform name.
+{% endcomment %}
+
+{% block main %}
+    <div class="flex justify-center">
+        <div class="card w-full max-w-xl bg-base-100 border-2 border-base-content/20 shadow-xl">
+            <div class="card-body prose max-w-none">
+                {% block content %}{% endblock content %}
+            </div>
+        </div>
+    </div>
+{% endblock main %}
diff --git a/templates/maintenance.html b/templates/maintenance.html
new file mode 100644
index 0000000..5b6df86
--- /dev/null
+++ b/templates/maintenance.html
@@ -0,0 +1,24 @@
+{% extends base_template %}
+{% load lucide %}
+
+{% comment %}
+    Rendered through the tenant's own skin, so a club sees its own logo and colours rather
+    than a bare error page — this is the platform being unavailable, not the club being gone.
+{% endcomment %}
+
+{% block head_title %}Maintenance{% endblock head_title %}
+
+{% block main %}
+    <div class="flex justify-center">
+        <div class="card w-full max-w-xl bg-base-100 shadow">
+            <div class="card-body items-center text-center">
+                <div class="text-warning">{% lucide "wrench" size=48 %}</div>
+                <h1 class="card-title mt-2">Down for maintenance</h1>
+                <p class="opacity-80">{{ message }}</p>
+                {% if maintenance.started_at %}
+                    <p class="text-xs opacity-60">Since {{ maintenance.started_at|date:"j M Y, H:i" }}</p>
+                {% endif %}
+            </div>
+        </div>
+    </div>
+{% endblock main %}
diff --git a/templates/mfa/authenticate.html b/templates/mfa/authenticate.html
new file mode 100644
index 0000000..925302c
--- /dev/null
+++ b/templates/mfa/authenticate.html
@@ -0,0 +1,73 @@
+{% extends "mfa/base_entrance.html" %}
+{% load allauth i18n lucide %}
+
+{% comment %}
+    Overridden for layout only: Cancel sits beside Sign In, and "Use a security key" is an
+    accent button under Alternative options. The code field itself is styled by the `fields`
+    element (it renders a `code` field as a daisyUI otp), so the reauthenticate and TOTP
+    activate pages get the same input without a template of their own.
+
+    Cancel and the security key submit *other* forms (`logout-from-stage`, `webauthn_form`)
+    through the HTML `form` attribute — forms cannot nest, so those sit at the end of the
+    page and the buttons point at them by id.
+{% endcomment %}
+
+{% block head_title %}
+    {% trans "Sign In" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Two-Factor Authentication" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate %}Your account is protected by two-factor authentication. Please enter an authenticator code:{% endblocktranslate %}
+    {% endelement %}
+
+    <form class="mt-8" method="post" action="{% url 'mfa_authenticate' %}">
+        {% csrf_token %}
+
+        <div class="mb-10">
+            {% element fields form=form unlabeled=True %}
+            {% endelement %}
+        </div>
+
+        <div class="flex flex-wrap items-center justify-end gap-2">
+            <button class="btn btn-outline gap-2" type="submit" form="logout-from-stage">{% lucide "x" size=16 %} {% trans "Cancel" %}</button>
+            <button class="btn btn-primary gap-2" type="submit">{% lucide "log-in" size=16 %} {% trans "Sign In" %}</button>
+        </div>
+    </form>
+
+    {% if "webauthn" in MFA_SUPPORTED_TYPES %}
+        {% element hr %}
+        {% endelement %}
+        {% element h2 %}
+            {% translate "Alternative options" %}
+        {% endelement %}
+
+        <button class="btn btn-accent gap-2" type="button" form="webauthn_form" id="mfa_webauthn_authenticate">
+            {% lucide "user-key" size=16 %} {% trans "Use a security key" %}
+        </button>
+
+        <form id="webauthn_form" method="post" action="{% url 'mfa_authenticate' %}">
+            {% csrf_token %}
+            {{ webauthn_form.credential }}
+        </form>
+        {{ js_data|json_script:"js_data" }}
+        {% include "mfa/webauthn/snippets/scripts.html" %}
+        <script data-allauth-onload="allauth.webauthn.forms.authenticateForm" type="application/json">
+            {
+                "ids": {
+                    "authenticate": "mfa_webauthn_authenticate",
+                    "credential": "{{ webauthn_form.credential.auto_id }}",
+                    "data": "js_data"
+                }
+            }
+        </script>
+    {% endif %}
+
+    <form id="logout-from-stage" method="post" action="{% url 'account_logout' %}">
+        <input type="hidden" name="next" value="{% url 'account_login' %}">
+        {% csrf_token %}
+    </form>
+{% endblock content %}
diff --git a/templates/mfa/index.html b/templates/mfa/index.html
new file mode 100644
index 0000000..1281248
--- /dev/null
+++ b/templates/mfa/index.html
@@ -0,0 +1,129 @@
+{% extends "mfa/base_manage.html" %}
+{% load allauth i18n %}
+
+{% comment %}
+    allauth's own index, with an icon on every button and the recovery-code actions given
+    the ranking they deserve: View is the primary action, Download and Generate are outline
+    (Generate silently invalidates the codes you already have, so it must not look like the
+    obvious thing to click).
+{% endcomment %}
+
+{% block head_title %}
+    {% trans "Two-Factor Authentication" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 tags="mfa,index" %}
+        {% trans "Two-Factor Authentication" %}
+    {% endelement %}
+
+    {% if "totp" in MFA_SUPPORTED_TYPES %}
+        {% element panel %}
+            {% slot title %}
+                {% translate "Authenticator App" %}
+            {% endslot %}
+            {% slot body %}
+                {% if authenticators.totp %}
+                    {% element p %}
+                        {% translate "Authentication using an authenticator app is active." %}
+                    {% endelement %}
+                {% else %}
+                    {% element p %}
+                        {% translate "An authenticator app is not active." %}
+                    {% endelement %}
+                {% endif %}
+            {% endslot %}
+            {% slot actions %}
+                {% url 'mfa_deactivate_totp' as deactivate_url %}
+                {% url 'mfa_activate_totp' as activate_url %}
+                {% if authenticators.totp %}
+                    {% element button href=deactivate_url icon="power" tags="danger,delete,panel" %}
+                        {% translate "Deactivate" %}
+                    {% endelement %}
+                {% else %}
+                    {% element button href=activate_url icon="qr-code" tags="panel" %}
+                        {% translate "Activate" %}
+                    {% endelement %}
+                {% endif %}
+            {% endslot %}
+        {% endelement %}
+    {% endif %}
+
+    {% if "webauthn" in MFA_SUPPORTED_TYPES %}
+        {% element panel %}
+            {% slot title %}
+                {% translate "Security Keys" %}
+            {% endslot %}
+            {% slot body %}
+                {% if authenticators.webauthn|length %}
+                    {% element p %}
+                        {% blocktranslate count count=authenticators.webauthn|length %}You have added {{ count }} security key.{% plural %}You have added {{ count }} security keys.{% endblocktranslate %}
+                    {% endelement %}
+                {% else %}
+                    {% element p %}
+                        {% translate "No security keys have been added." %}
+                    {% endelement %}
+                {% endif %}
+            {% endslot %}
+            {% slot actions %}
+                {% if authenticators.webauthn|length %}
+                    {% url 'mfa_list_webauthn' as webauthn_list_url %}
+                    {% element button href=webauthn_list_url icon="settings" %}
+                        {% translate "Manage" %}
+                    {% endelement %}
+                {% else %}
+                    {% url 'mfa_add_webauthn' as webauthn_add_url %}
+                    {% element button href=webauthn_add_url icon="user-key" %}
+                        {% translate "Add" %}
+                    {% endelement %}
+                {% endif %}
+            {% endslot %}
+        {% endelement %}
+    {% endif %}
+
+    {% if "recovery_codes" in MFA_SUPPORTED_TYPES %}
+        {% with total_count=authenticators.recovery_codes.generate_codes|length unused_count=authenticators.recovery_codes.get_unused_codes|length %}
+            {% element panel %}
+                {% slot title %}
+                    {% translate "Recovery Codes" %}
+                {% endslot %}
+                {% slot body %}
+                    {% if authenticators.recovery_codes %}
+                        {% element p %}
+                            {% blocktranslate count unused_count=unused_count %}There is {{ unused_count }} out of {{ total_count }} recovery codes available.{% plural %}There are {{ unused_count }} out of {{ total_count }} recovery codes available.
+                            {% endblocktranslate %}
+                        {% endelement %}
+                    {% else %}
+                        {% element p %}
+                            {% translate "No recovery codes set up." %}
+                        {% endelement %}
+                    {% endif %}
+                {% endslot %}
+                {% if is_mfa_enabled %}
+                    {% if authenticators.recovery_codes %}
+                        {% if unused_count > 0 and not MFA_RECOVERY_CODES_SHOW_ONCE %}
+                            {% slot actions %}
+                                {% url 'mfa_view_recovery_codes' as view_url %}
+                                {% element button href=view_url icon="eye" tags="panel" %}
+                                    {% translate "View" %}
+                                {% endelement %}
+                            {% endslot %}
+                            {% slot actions %}
+                                {% url 'mfa_download_recovery_codes' as download_url %}
+                                {% element button href=download_url icon="download" tags="outline,panel" %}
+                                    {% translate "Download" %}
+                                {% endelement %}
+                            {% endslot %}
+                        {% endif %}
+                    {% endif %}
+                    {% slot actions %}
+                        {% url 'mfa_generate_recovery_codes' as generate_url %}
+                        {% element button href=generate_url icon="refresh-cw" tags="outline,panel" %}
+                            {% translate "Generate" %}
+                        {% endelement %}
+                    {% endslot %}
+                {% endif %}
+            {% endelement %}
+        {% endwith %}
+    {% endif %}
+{% endblock content %}
diff --git a/templates/mfa/recovery_codes/generate.html b/templates/mfa/recovery_codes/generate.html
new file mode 100644
index 0000000..25c8dfd
--- /dev/null
+++ b/templates/mfa/recovery_codes/generate.html
@@ -0,0 +1,35 @@
+{% extends "mfa/recovery_codes/base.html" %}
+{% load i18n allauth %}
+
+{% block content %}
+    {% element h1 %}
+        {% translate "Recovery Codes" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate %}You are about to generate a new set of recovery codes for your account.{% endblocktranslate %}
+        {% if unused_code_count %}
+            {% blocktranslate %}This action will invalidate your existing codes.{% endblocktranslate %}
+        {% endif %}
+        {% blocktranslate %}Are you sure?{% endblocktranslate %}
+    {% endelement %}
+
+    {% url 'mfa_generate_recovery_codes' as action_url %}
+    {% element form method="post" action=action_url no_visible_fields=True %}
+        {% slot body %}
+            {% csrf_token %}
+            {{ form.as_p }}
+        {% endslot %}
+        {% slot actions %}
+            {# Destructive when codes already exist: generating throws the old ones away. #}
+            {% setvar tags %}
+                {% if unused_code_count %}
+                    danger
+                {% else %}
+                {% endif %}
+            {% endsetvar %}
+            {% element button type="submit" icon="refresh-cw" tags=tags %}
+                {% trans "Generate" %}
+            {% endelement %}
+        {% endslot %}
+    {% endelement %}
+{% endblock content %}
diff --git a/templates/mfa/recovery_codes/index.html b/templates/mfa/recovery_codes/index.html
new file mode 100644
index 0000000..f17d8c3
--- /dev/null
+++ b/templates/mfa/recovery_codes/index.html
@@ -0,0 +1,65 @@
+{% extends "mfa/recovery_codes/base.html" %}
+{% load i18n allauth static %}
+
+{% comment %}
+    Overridden for layout: Download and Generate sit side by side under the codes rather
+    than stacking. Generate is outline-only — it silently invalidates the codes on screen,
+    so it must not be the button your eye lands on.
+{% endcomment %}
+
+{% block content %}
+    {% element h1 %}
+        {% translate "Recovery Codes" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate count unused_count=unused_codes|length %}There is {{ unused_count }} out of {{ total_count }} recovery codes available.{% plural %}There are {{ unused_count }} out of {{ total_count }} recovery codes available.{% endblocktranslate %}
+    {% endelement %}
+
+    {% if can_view_codes %}
+        {% element field id="recovery_codes" type="textarea" rows=unused_codes|length readonly=True %}
+            {% slot label %}
+                {% translate "Unused codes" %}
+            {% endslot %}
+            {# djlint:off #}
+{% slot value %}{% for code in unused_codes %}{% if forloop.counter0 %}
+{% endif %}{{ code }}{% endfor %}{% endslot %}
+            {# djlint:on #}
+        {% endelement %}
+    {% endif %}
+
+    <div class="mt-6 flex flex-wrap items-center gap-2">
+        {% if can_download_codes %}
+            {% url 'mfa_download_recovery_codes' as download_url %}
+            {% element button href=download_url icon="download" %}
+                {% translate "Download codes" %}
+            {% endelement %}
+        {% endif %}
+        {% if can_generate_codes %}
+            {% url 'mfa_generate_recovery_codes' as generate_url %}
+            {% element button href=generate_url icon="refresh-cw" tags="outline" %}
+                {% translate "Generate new codes" %}
+            {% endelement %}
+        {% endif %}
+    </div>
+
+    {% if MFA_RECOVERY_CODES_SHOW_ONCE and can_view_codes %}
+        {% element field type="checkbox" id="codes_saved" %}
+            {% slot label %}
+                {% translate "I have saved my recovery codes" %}
+            {% endslot %}
+        {% endelement %}
+    {% endif %}
+{% endblock content %}
+
+{% block extra_body %}
+    {{ block.super }}
+    <script src="{% static 'mfa/js/recovery_codes.js' %}"></script>
+    <script src="{% static 'account/js/onload.js' %}"></script>
+    <script data-allauth-onload="allauth.recoveryCodes.forms.viewForm" type="application/json">{
+    "ids": {
+        "saveConfirmation": "codes_saved",
+        "recoveryCodes": "recovery_codes"
+    }
+}
+    </script>
+{% endblock extra_body %}
diff --git a/templates/mfa/totp/activate_form.html b/templates/mfa/totp/activate_form.html
new file mode 100644
index 0000000..c81c39a
--- /dev/null
+++ b/templates/mfa/totp/activate_form.html
@@ -0,0 +1,45 @@
+{% extends "mfa/totp/base.html" %}
+{% load allauth i18n %}
+
+{% comment %}
+    The code field is boxed and label-less (the `fields` element does that for any `code`
+    field), and the secret sits in a mono field with room around it — it is copied by hand,
+    character by character.
+{% endcomment %}
+
+{% block head_title %}
+    {% translate "Activate Authenticator App" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% translate "Activate Authenticator App" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate %}To protect your account with two-factor authentication, scan the QR code below with your authenticator app. Then, input the verification code generated by the app below.{% endblocktranslate %}
+    {% endelement %}
+
+    {% url 'mfa_activate_totp' as action_url %}
+    {% element form form=form method="post" action=action_url %}
+        {% slot body %}
+            {% element img src=totp_svg_data_uri alt=form.secret tags="mfa,totp,qr" %}
+            {% endelement %}
+            {% csrf_token %}
+            {% element field id="authenticator_secret" type="text" value=form.secret disabled=True %}
+                {% slot label %}
+                    {% translate "Authenticator secret" %}
+                {% endslot %}
+                {% slot help_text %}
+                    {% translate "You can store this secret and use it to reinstall your authenticator app at a later time." %}
+                {% endslot %}
+            {% endelement %}
+            {% element fields form=form %}
+            {% endelement %}
+        {% endslot %}
+        {% slot actions %}
+            {% element button type="submit" icon="check" %}
+                {% trans "Activate" %}
+            {% endelement %}
+        {% endslot %}
+    {% endelement %}
+{% endblock content %}
diff --git a/templates/mfa/totp/deactivate_form.html b/templates/mfa/totp/deactivate_form.html
new file mode 100644
index 0000000..36736bb
--- /dev/null
+++ b/templates/mfa/totp/deactivate_form.html
@@ -0,0 +1,30 @@
+{% extends "mfa/totp/base.html" %}
+{% load allauth i18n %}
+
+{% block head_title %}
+    {% trans "Deactivate Authenticator App" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Deactivate Authenticator App" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate %}You are about to deactivate authenticator app based authentication. Are you sure?{% endblocktranslate %}
+    {% endelement %}
+
+    {% url 'mfa_deactivate_totp' as action_url %}
+    {% element form form=form method="post" action=action_url no_visible_fields=True %}
+        {% slot body %}
+            {% csrf_token %}
+            {% element fields form=form %}
+                {{ form.as_p }}
+            {% endelement %}
+        {% endslot %}
+        {% slot actions %}
+            {% element button type="submit" icon="power" tags="danger,delete" %}
+                {% trans "Deactivate" %}
+            {% endelement %}
+        {% endslot %}
+    {% endelement %}
+{% endblock content %}
diff --git a/templates/mfa/webauthn/add_form.html b/templates/mfa/webauthn/add_form.html
new file mode 100644
index 0000000..27a17bc
--- /dev/null
+++ b/templates/mfa/webauthn/add_form.html
@@ -0,0 +1,39 @@
+{% extends "mfa/webauthn/base.html" %}
+{% load allauth i18n static %}
+
+{% block head_title %}
+    {% trans "Add Security Key" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Add Security Key" %}
+    {% endelement %}
+
+    {% url 'mfa_add_webauthn' as action_url %}
+    {% element form form=form method="post" action=action_url %}
+        {% slot body %}
+            {% csrf_token %}
+            {% element fields form=form %}
+            {% endelement %}
+        {% endslot %}
+        {% slot actions %}
+            {# type="button": the webauthn script takes over the click and posts the form itself. #}
+            {% element button id="mfa_webauthn_add" type="button" icon="user-key" %}
+                {% trans "Add" %}
+            {% endelement %}
+        {% endslot %}
+    {% endelement %}
+
+    {% include "mfa/webauthn/snippets/scripts.html" %}
+    {{ js_data|json_script:"js_data" }}
+    <script data-allauth-onload="allauth.webauthn.forms.addForm" type="application/json">{
+    "ids": {
+        "add": "mfa_webauthn_add",
+        "passwordless": "{{ form.passwordless.auto_id }}",
+        "credential": "{{ form.credential.auto_id }}",
+        "data": "js_data"
+    }
+}
+    </script>
+{% endblock content %}
diff --git a/templates/mfa/webauthn/authenticator_confirm_delete.html b/templates/mfa/webauthn/authenticator_confirm_delete.html
new file mode 100644
index 0000000..82e9945
--- /dev/null
+++ b/templates/mfa/webauthn/authenticator_confirm_delete.html
@@ -0,0 +1,25 @@
+{% extends "mfa/webauthn/base.html" %}
+{% load allauth i18n %}
+
+{% block head_title %}
+    {% trans "Remove Security Key" %}
+{% endblock head_title %}
+
+{% block content %}
+    {% element h1 %}
+        {% trans "Remove Security Key" %}
+    {% endelement %}
+    {% element p %}
+        {% blocktranslate %}Are you sure you want to remove this security key?{% endblocktranslate %}
+    {% endelement %}
+
+    {% url 'mfa_remove_webauthn' pk=authenticator.pk as action_url %}
+    {% element form method="post" action=action_url no_visible_fields=True %}
+        {% slot actions %}
+            {% csrf_token %}
+            {% element button type="submit" icon="trash-2" tags="danger" %}
+                {% translate "Remove" %}
+            {% endelement %}
+        {% endslot %}
+    {% endelement %}
+{% endblock content %}
diff --git a/templates/mfa/webauthn/authenticator_list.html b/templates/mfa/webauthn/authenticator_list.html
new file mode 100644
index 0000000..2ed3050
--- /dev/null
+++ b/templates/mfa/webauthn/authenticator_list.html
@@ -0,0 +1,72 @@
+{% extends "mfa/webauthn/base.html" %}
+{% load i18n %}
+{% load static %}
+{% load allauth %}
+{% load humanize %}
+{% block content %}
+    {% element h1 %}
+        {% trans "Security Keys" %}
+    {% endelement %}
+    {% if authenticators|length == 0 %}
+        {% element p %}
+            {% blocktranslate %}No security keys have been added.{% endblocktranslate %}
+        {% endelement %}
+    {% else %}
+        {% element table %}
+            {% element thead %}
+                {% element th %}
+                    {% translate "Key" %}
+                {% endelement %}
+                {% element th %}
+                    {% translate "Usage" %}
+                {% endelement %}
+                {% element th %}
+                {% endelement %}
+            {% endelement %}
+            {% element tbody %}
+                {% for authenticator in authenticators %}
+                    {% element tr %}
+                        {% element td %}
+                            {{ authenticator }}
+                            {% if authenticator.wrap.is_passwordless is True %}
+                                {% element badge tags="mfa,key,primary" %}
+                                    {% translate "Passkey" %}
+                                {% endelement %}
+                            {% elif authenticator.wrap.is_passwordless is False %}
+                                {% element badge tags="mfa,key,secondary" %}
+                                    {% translate "Security key" %}
+                                {% endelement %}
+                            {% else %}
+                                {% element badge title=_("This key does not indicate whether it is a passkey.") tags="mfa,key,warning" %}
+                                    {% translate "Unspecified" %}
+                                {% endelement %}
+                            {% endif %}
+                        {% endelement %}
+                        {% element td %}
+                            {% blocktranslate with created_at=authenticator.created_at|date:"SHORT_DATE_FORMAT" %}Added on {{ created_at }}{% endblocktranslate %}.
+                            {% if authenticator.last_used_at %}
+                                {% blocktranslate with last_used=authenticator.last_used_at|naturaltime %}Last used {{ last_used }}{% endblocktranslate %}
+                            {% else %}
+                                Not used.
+                            {% endif %}
+                        {% endelement %}
+                        {% element td align="right" %}
+                            {% url 'mfa_edit_webauthn' pk=authenticator.pk as edit_url %}
+                            {% element button href=edit_url icon="pencil" tags="mfa,authenticator,edit,tool" %}
+                                {% translate "Edit" %}
+                            {% endelement %}
+                            {% url 'mfa_remove_webauthn' pk=authenticator.pk as remove_url %}
+                            {% element button href=remove_url icon="trash-2" tags="mfa,authenticator,danger,delete,tool" %}
+                                {% translate "Remove" %}
+                            {% endelement %}
+                        {% endelement %}
+                    {% endelement %}
+                {% endfor %}
+            {% endelement %}
+        {% endelement %}
+    {% endif %}
+    {% url 'mfa_add_webauthn' as add_url %}
+    {% element button href=add_url icon="user-key" %}
+        {% translate "Add" %}
+    {% endelement %}
+{% endblock %}
diff --git a/uv.lock b/uv.lock
index 8a55f2c..087f760 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2,6 +2,15 @@ version = 1
 revision = 3
 requires-python = ">=3.14"
 
+[[package]]
+name = "annotated-types"
+version = "0.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/56/a8120250d128bed162cd73c76d45f6ef9991f3e068f62a8ee060afa3104a/annotated_types-0.8.0.tar.gz", hash = "sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7", size = 15893, upload-time = "2026-07-23T20:16:13.995Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/99/91/8acff4f5e50511b911bbccb72b8628a49c68ce14148cd9f6431094859a90/annotated_types-0.8.0-py3-none-any.whl", hash = "sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0", size = 13427, upload-time = "2026-07-23T20:16:12.938Z" },
+]
+
 [[package]]
 name = "asgiref"
 version = "3.11.1"
@@ -12,24 +21,311 @@ wheels = [
 ]
 
 [[package]]
-name = "clubmanager"
-version = "0.1.0"
-source = { virtual = "." }
+name = "beautifulsoup4"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "soupsieve" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/43/65/318323f98dbee45d42dff61d8f047181bc6f2268a9068cfad035a46be5af/beautifulsoup4-4.15.0.tar.gz", hash = "sha256:288e3ca7d54b06f2ac191970bc275c1939cb46d450b255bf6718b04aa37ab4f7", size = 632571, upload-time = "2026-06-07T16:44:20.453Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/88/c6/92fcd42f1ba33e1184263f25bfabf3d27c383410470f169e4b8163bf9c17/beautifulsoup4-4.15.0-py3-none-any.whl", hash = "sha256:d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9", size = 109924, upload-time = "2026-06-07T16:44:21.566Z" },
+]
+
+[[package]]
+name = "boto3"
+version = "1.43.47"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "botocore" },
+    { name = "jmespath" },
+    { name = "s3transfer" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/eb/76/8c2b062b9a9f27db8d78c3183213efd2cb31493b9a81853025da5254652e/boto3-1.43.47.tar.gz", hash = "sha256:09a8ce4abab4391bf08315e2dcc449b4b33e97ce7654ee9398d9fe4ef73a33da", size = 112681, upload-time = "2026-07-13T19:32:13.511Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/86/4aaa23e1433a6f4021258b1d8e4ec129bf691e419339454806807595a93d/boto3-1.43.47-py3-none-any.whl", hash = "sha256:aef0cccd5bc4a443fb3e64fada023f7b5b9da36864cb4255b68cf93067476676", size = 140031, upload-time = "2026-07-13T19:32:11.072Z" },
+]
+
+[[package]]
+name = "botocore"
+version = "1.43.47"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "jmespath" },
+    { name = "python-dateutil" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/76/2c/279bf51f68e85a12323996aa4a7f2a163da84dad949ee751caa318928ce1/botocore-1.43.47.tar.gz", hash = "sha256:9e04d8da7f9cff8a911b14284829f78b74e1ce785444833199837decb5ecc17a", size = 15696311, upload-time = "2026-07-13T19:32:01.095Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/28/c0/6a8f824d613c5e5b8755ce99e3cf83fd1db135f5df02da7ed5bf106abdfd/botocore-1.43.47-py3-none-any.whl", hash = "sha256:4d16559a3a1866fa7b9e651dd1422c1a033497e069f8a73cae5eebafe70ff39c", size = 15382537, upload-time = "2026-07-13T19:31:56.213Z" },
+]
+
+[[package]]
+name = "brotli"
+version = "1.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f7/16/c92ca344d646e71a43b8bb353f0a6490d7f6e06210f8554c8f874e454285/brotli-1.2.0.tar.gz", hash = "sha256:e310f77e41941c13340a95976fe66a8a95b01e783d430eeaf7a2f87e0a57dd0a", size = 7388632, upload-time = "2025-11-05T18:39:42.86Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/17/e1/298c2ddf786bb7347a1cd71d63a347a79e5712a7c0cba9e3c3458ebd976f/brotli-1.2.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:6c12dad5cd04530323e723787ff762bac749a7b256a5bece32b2243dd5c27b21", size = 863080, upload-time = "2025-11-05T18:38:45.503Z" },
+    { url = "https://files.pythonhosted.org/packages/84/0c/aac98e286ba66868b2b3b50338ffbd85a35c7122e9531a73a37a29763d38/brotli-1.2.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:3219bd9e69868e57183316ee19c84e03e8f8b5a1d1f2667e1aa8c2f91cb061ac", size = 445453, upload-time = "2025-11-05T18:38:46.433Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/f1/0ca1f3f99ae300372635ab3fe2f7a79fa335fee3d874fa7f9e68575e0e62/brotli-1.2.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:963a08f3bebd8b75ac57661045402da15991468a621f014be54e50f53a58d19e", size = 1528168, upload-time = "2025-11-05T18:38:47.371Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a6/2ebfc8f766d46df8d3e65b880a2e220732395e6d7dc312c1e1244b0f074a/brotli-1.2.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9322b9f8656782414b37e6af884146869d46ab85158201d82bab9abbcb971dc7", size = 1627098, upload-time = "2025-11-05T18:38:48.385Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/2f/0976d5b097ff8a22163b10617f76b2557f15f0f39d6a0fe1f02b1a53e92b/brotli-1.2.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cf9cba6f5b78a2071ec6fb1e7bd39acf35071d90a81231d67e92d637776a6a63", size = 1419861, upload-time = "2025-11-05T18:38:49.372Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/d76df7176a2ce7616ff94c1fb72d307c9a30d2189fe877f3dd99af00ea5a/brotli-1.2.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7547369c4392b47d30a3467fe8c3330b4f2e0f7730e45e3103d7d636678a808b", size = 1484594, upload-time = "2025-11-05T18:38:50.655Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/93/14cf0b1216f43df5609f5b272050b0abd219e0b54ea80b47cef9867b45e7/brotli-1.2.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:fc1530af5c3c275b8524f2e24841cbe2599d74462455e9bae5109e9ff42e9361", size = 1593455, upload-time = "2025-11-05T18:38:51.624Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/73/3183c9e41ca755713bdf2cc1d0810df742c09484e2e1ddd693bee53877c1/brotli-1.2.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:d2d085ded05278d1c7f65560aae97b3160aeb2ea2c0b3e26204856beccb60888", size = 1488164, upload-time = "2025-11-05T18:38:53.079Z" },
+    { url = "https://files.pythonhosted.org/packages/64/6a/0c78d8f3a582859236482fd9fa86a65a60328a00983006bcf6d83b7b2253/brotli-1.2.0-cp314-cp314-win32.whl", hash = "sha256:832c115a020e463c2f67664560449a7bea26b0c1fdd690352addad6d0a08714d", size = 339280, upload-time = "2025-11-05T18:38:54.02Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/10/56978295c14794b2c12007b07f3e41ba26acda9257457d7085b0bb3bb90c/brotli-1.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:e7c0af964e0b4e3412a0ebf341ea26ec767fa0b4cf81abb5e897c9338b5ad6a3", size = 375639, upload-time = "2025-11-05T18:38:55.67Z" },
+]
+
+[[package]]
+name = "brotlicffi"
+version = "1.2.0.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8a/b6/017dc5f852ed9b8735af77774509271acbf1de02d238377667145fcee01d/brotlicffi-1.2.0.1.tar.gz", hash = "sha256:c20d5c596278307ad06414a6d95a892377ea274a5c6b790c2548c009385d621c", size = 478156, upload-time = "2026-03-05T19:54:11.547Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ef/f9/dfa56316837fa798eac19358351e974de8e1e2ca9475af4cb90293cd6576/brotlicffi-1.2.0.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:2c85e65913cf2b79c57a3fdd05b98d9731d9255dc0cb696b09376cc091b9cddd", size = 433046, upload-time = "2026-03-05T19:53:46.209Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/f5/f8f492158c76b0d940388801f04f747028971ad5774287bded5f1e53f08d/brotlicffi-1.2.0.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:535f2d05d0273408abc13fc0eebb467afac17b0ad85090c8913690d40207dac5", size = 1541126, upload-time = "2026-03-05T19:53:48.248Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/e1/ff87af10ac419600c63e9287a0649c673673ae6b4f2bcf48e96cb2f89f60/brotlicffi-1.2.0.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ce17eb798ca59ecec67a9bb3fd7a4304e120d1cd02953ce522d959b9a84d58ac", size = 1541983, upload-time = "2026-03-05T19:53:50.317Z" },
+    { url = "https://files.pythonhosted.org/packages/47/c0/80ecd9bd45776109fab14040e478bf63e456967c9ddee2353d8330ed8de1/brotlicffi-1.2.0.1-cp314-cp314t-win32.whl", hash = "sha256:3c9544f83cb715d95d7eab3af4adbbef8b2093ad6382288a83b3a25feb1a57ec", size = 349047, upload-time = "2026-03-05T19:53:52.215Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/98/13e5b250236a281b6cd9e92a01ee1ae231029fa78faee932ef3766e1cb24/brotlicffi-1.2.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:625f8115d32ae9c0740d01ea51518437c3fbaa3e78d41cb18459f6f7ac326000", size = 385652, upload-time = "2026-03-05T19:53:53.892Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/9f/b98dcd4af47994cee97aebac866996a006a2e5fc1fd1e2b82a8ad95cf09c/brotlicffi-1.2.0.1-cp38-abi3-macosx_11_0_arm64.whl", hash = "sha256:91ba5f0ccc040f6ff8f7efaf839f797723d03ed46acb8ae9408f99ffd2572cf4", size = 432608, upload-time = "2026-03-05T19:53:56.736Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/7a/ac4ee56595a061e3718a6d1ea7e921f4df156894acffb28ed88a1fd52022/brotlicffi-1.2.0.1-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be9a670c6811af30a4bd42d7116dc5895d3b41beaa8ed8a89050447a0181f5ce", size = 1534257, upload-time = "2026-03-05T19:53:58.667Z" },
+    { url = "https://files.pythonhosted.org/packages/99/39/e7410db7f6f56de57744ea52a115084ceb2735f4d44973f349bb92136586/brotlicffi-1.2.0.1-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6f3314a3476f59e5443f9f72a6dff16edc0c3463c9b318feaef04ae3e4683f5a", size = 1536838, upload-time = "2026-03-05T19:54:00.705Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/75/6e7977d1935fc3fbb201cbd619be8f2c7aea25d40a096967132854b34708/brotlicffi-1.2.0.1-cp38-abi3-win32.whl", hash = "sha256:82ea52e2b5d3145b6c406ebd3efb0d55db718b7ad996bd70c62cec0439de1187", size = 343337, upload-time = "2026-03-05T19:54:02.446Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/ef/e7e485ce5e4ba3843a0a92feb767c7b6098fd6e65ce752918074d175ae71/brotlicffi-1.2.0.1-cp38-abi3-win_amd64.whl", hash = "sha256:da2e82a08e7778b8bc539d27ca03cdd684113e81394bfaaad8d0dfc6a17ddede", size = 379026, upload-time = "2026-03-05T19:54:04.322Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2026.7.22"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+]
+
+[[package]]
+name = "cffi"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/57/5f/ff100cae70ebe9d8df1c01a00e510e45d9adb5c1fdda84791b199141de97/cffi-2.1.0.tar.gz", hash = "sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9", size = 531036, upload-time = "2026-07-06T21:34:30.382Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d8/f0/81478e482afa03f6d18dc8f2afb5edc45b3080853b634b5ed91961be0998/cffi-2.1.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a", size = 194142, upload-time = "2026-07-06T21:33:23.657Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/95/8de304305cd9204974b0ca051b86d307cafca13aa575a0ef1b44d92c0d8c/cffi-2.1.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3", size = 196819, upload-time = "2026-07-06T21:33:25.007Z" },
+    { url = "https://files.pythonhosted.org/packages/20/71/7c8372d30e42415602ed9f268f7cfd66f1b855fed881ecd168bcb45dbc0b/cffi-2.1.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d", size = 184965, upload-time = "2026-07-06T21:33:26.605Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/5c/584e626835f0375c928176c04137c96927165cb8733cdb3150ec04e5ee5e/cffi-2.1.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac", size = 184952, upload-time = "2026-07-06T21:33:27.823Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/d2/065fcae1c73979fac8e054462478d0ff8a29c40cdc2ed7ea5676a061df53/cffi-2.1.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6", size = 222353, upload-time = "2026-07-06T21:33:29.178Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/a5/e8bbb1ce5b3ac2f53ad6a10bde44318a5a8d99d4f4a000d44a6e39aeb3e4/cffi-2.1.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913", size = 210051, upload-time = "2026-07-06T21:33:30.534Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ed/c127d3ac36e899c965e3361357c3befacd6578c03f40125183e41c3b219e/cffi-2.1.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d", size = 208630, upload-time = "2026-07-06T21:33:31.753Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/d7/97d3136f81db489ec8d1d67748c110d6c994268fd7528014aa9f2b085e4e/cffi-2.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5", size = 221593, upload-time = "2026-07-06T21:33:33.044Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/27/93195977168ee63aed233a1a0993a2178798654d1f4bddcdd321d6fd3b21/cffi-2.1.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce", size = 225146, upload-time = "2026-07-06T21:33:34.224Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/c1/6dbd291ee2ae5a50a034aa057207081f545923bbf15dad4511e985aafff5/cffi-2.1.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326", size = 223240, upload-time = "2026-07-06T21:33:35.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/6f/ade5ce9863a57992a6ea3d0d10d7e29b8749fc127204b3d493d667b2815f/cffi-2.1.0-cp314-cp314-win32.whl", hash = "sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd", size = 177723, upload-time = "2026-07-06T21:33:51.626Z" },
+    { url = "https://files.pythonhosted.org/packages/41/de/92b9eeed4ae4a21d6fd9b2a2c8505cbed573299902ea73981cc13f7ff62c/cffi-2.1.0-cp314-cp314-win_amd64.whl", hash = "sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb", size = 187937, upload-time = "2026-07-06T21:33:53.403Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/1a/cc6ae6c2913a03aab8898eee57963cf1035b8df5872ed8b9115fcc7e2be8/cffi-2.1.0-cp314-cp314-win_arm64.whl", hash = "sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804", size = 183001, upload-time = "2026-07-06T21:33:54.74Z" },
+    { url = "https://files.pythonhosted.org/packages/14/f0/134c00ce0779ec86dea2aa1aac69339c2741a8045072676763512363a2ea/cffi-2.1.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714", size = 188538, upload-time = "2026-07-06T21:33:36.792Z" },
+    { url = "https://files.pythonhosted.org/packages/50/d8/3b86aba791cb610d24e8a3e1b2cd529e71fa15096b04e4d4e360049d4a4c/cffi-2.1.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376", size = 188230, upload-time = "2026-07-06T21:33:38.011Z" },
+    { url = "https://files.pythonhosted.org/packages/14/d0/117dcd9209255ad8571fbc8c92ef32593a1d294dcec91ddc4e4db50606f2/cffi-2.1.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98", size = 223899, upload-time = "2026-07-06T21:33:39.514Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/3d/f20f8b886b254e3ad10e15cd4186d3aed49f3e6a35ab37aab9f8f25f7c03/cffi-2.1.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13", size = 211652, upload-time = "2026-07-06T21:33:40.851Z" },
+    { url = "https://files.pythonhosted.org/packages/28/3b/fad54de07260b93ddeef4b96d0131d57ea900675df1d410ae1deee52d7a6/cffi-2.1.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d", size = 210755, upload-time = "2026-07-06T21:33:42.183Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/82/3d5c705acb7abbba9bbd7d79b8e62e0f25b6120eb7ae6ac49f1b721722fe/cffi-2.1.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056", size = 223933, upload-time = "2026-07-06T21:33:43.603Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/d0/47e338384ab6b1004241002fa616301020cea4fc95f283506565d252f276/cffi-2.1.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4", size = 226749, upload-time = "2026-07-06T21:33:45.046Z" },
+    { url = "https://files.pythonhosted.org/packages/70/25/65bd5b58ea4bfdfc15cde02cb5365f89ef8ab8b2adfb8fe5c4bd4233382f/cffi-2.1.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94", size = 225703, upload-time = "2026-07-06T21:33:46.374Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/78/aa01ac599a8a4322533d45a1f9bc93b338276d2d59dabbe7c6d92a775c81/cffi-2.1.0-cp314-cp314t-win32.whl", hash = "sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76", size = 182857, upload-time = "2026-07-06T21:33:47.696Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/d00496b22de4d4228f32dde94ad996f350c8aad676d63bcca0743c8dea4d/cffi-2.1.0-cp314-cp314t-win_amd64.whl", hash = "sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5", size = 194065, upload-time = "2026-07-06T21:33:48.953Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/dd/0c7dbf815a579ff005008a2d815a55d6bb047c349eef536d9dc53d3f0a8d/cffi-2.1.0-cp314-cp314t-win_arm64.whl", hash = "sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8", size = 186404, upload-time = "2026-07-06T21:33:50.309Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c7/8c8c50cb11c6750051daf12164098a9a6f027ac4356967fd4d800a07f242/cffi-2.1.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c", size = 194121, upload-time = "2026-07-06T21:33:56.109Z" },
+    { url = "https://files.pythonhosted.org/packages/99/e2/67680bf19a6b60d2bb7ff83baefa2a4c3d2d7dc0f3277034b802e1fc504c/cffi-2.1.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001", size = 196820, upload-time = "2026-07-06T21:33:57.288Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/da/4bbe583a3b3a5c8c60892124fe17f3fa3656523faf0d3484eae90f091853/cffi-2.1.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3", size = 184936, upload-time = "2026-07-06T21:33:58.765Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/4b/1f4c36ab273980d7aa75bb126ea4f8971f24a96108acad3a0a084028c57b/cffi-2.1.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc", size = 185045, upload-time = "2026-07-06T21:34:00.085Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/c3/ad299dc38f3583f8d916b299f028af418a9ec98bc695fcbebeae7420691c/cffi-2.1.0-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699", size = 222342, upload-time = "2026-07-06T21:34:01.814Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/d8/df4543cc087245044ed02ef3ad8e0a26619d0075ac7a77a12dc81177851b/cffi-2.1.0-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022", size = 210073, upload-time = "2026-07-06T21:34:03.255Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/0e/fac738d73728c6cea2a88a2883dca54892496cbba88a1dc1f2909cb8a6f5/cffi-2.1.0-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0", size = 208551, upload-time = "2026-07-06T21:34:04.433Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/3f/0b04a700dd64f465c93020253a793a82c9b4dff9961f48facd0df945d9b8/cffi-2.1.0-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1", size = 221649, upload-time = "2026-07-06T21:34:06.157Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/7c/b7379a5704c79eda57ce075869ba70a0368d1c850f803b3c0d078d39dcaf/cffi-2.1.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28", size = 225203, upload-time = "2026-07-06T21:34:07.489Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/02/d5e6c43ea85c41bda2a184a3418f195fe7cf602967a8d2b94e085b83deef/cffi-2.1.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629", size = 223263, upload-time = "2026-07-06T21:34:08.712Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/d8/772b8259bf75749adffb1c546828978381fb516f60cf701f6c83daf60c85/cffi-2.1.0-cp315-cp315-win32.whl", hash = "sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6", size = 177696, upload-time = "2026-07-06T21:34:26.355Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/dd/afa2191fc6d57fedd26e5844a2fe2fcc0bbfa00961bbaa5a41e4921e7cca/cffi-2.1.0-cp315-cp315-win_amd64.whl", hash = "sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853", size = 187914, upload-time = "2026-07-06T21:34:27.58Z" },
+    { url = "https://files.pythonhosted.org/packages/05/ef/6cd4f8c671517162379dc79cfae5aea9106bc38abb89628d5c16adf6a838/cffi-2.1.0-cp315-cp315-win_arm64.whl", hash = "sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda", size = 183004, upload-time = "2026-07-06T21:34:28.905Z" },
+    { url = "https://files.pythonhosted.org/packages/11/b6/12fc55092817a5faa26fb8c40c7f9d662e11a46ee248c137aafc42517d92/cffi-2.1.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc", size = 188378, upload-time = "2026-07-06T21:34:09.926Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/2e/cdac88979f295fde5daa69622c7d2111e56e7ceb94f211357fbe452339e4/cffi-2.1.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca", size = 188319, upload-time = "2026-07-06T21:34:11.101Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/27/1d0b408497e41a74795af122d7b603c418c5fed0171450f899afd04e594f/cffi-2.1.0-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d", size = 223904, upload-time = "2026-07-06T21:34:12.606Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/31/e115c985105dd7ffb32444505f18ceb874bb42d992af05d5dced7ecf1980/cffi-2.1.0-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8", size = 211554, upload-time = "2026-07-06T21:34:13.987Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/67/9e6e09409336d9e515c58367e7cfcf4f89df06ad25252675595a58eb59d5/cffi-2.1.0-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd", size = 210795, upload-time = "2026-07-06T21:34:15.972Z" },
+    { url = "https://files.pythonhosted.org/packages/19/e5/d3cc82a4a0be7902af279c04181ad038449c096734464a5ae1de3e1401bd/cffi-2.1.0-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f", size = 223843, upload-time = "2026-07-06T21:34:17.509Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/65/b434abc97ce7cecc2c640fde160507c0ecc7e21544b483ba3325d2e2ea17/cffi-2.1.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc", size = 226773, upload-time = "2026-07-06T21:34:19.05Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/9f/d4dc66ca651eb1145a133314cda721abf13cfac3d28c4a0402263ae6ad75/cffi-2.1.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9", size = 225719, upload-time = "2026-07-06T21:34:20.576Z" },
+    { url = "https://files.pythonhosted.org/packages/68/5a/e536c528bc8057496c360c0978559a2dc45653f89dd6151078aa7d8fca1a/cffi-2.1.0-cp315-cp315t-win32.whl", hash = "sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b", size = 182760, upload-time = "2026-07-06T21:34:22.059Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/0b/0ffe8b82d3875bced5fa1e7986a7a46b748262a40ab7f60b475eb9fb1bb3/cffi-2.1.0-cp315-cp315t-win_amd64.whl", hash = "sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5", size = 193769, upload-time = "2026-07-06T21:34:23.589Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/17/1073b53b68c9b5ca6914adf5f8bf55aacc2d3be102418c90700160ea8605/cffi-2.1.0-cp315-cp315t-win_arm64.whl", hash = "sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210", size = 186405, upload-time = "2026-07-06T21:34:24.857Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.9"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bd/2a/23f34ec9d04624958e137efdc394888716353190e75f25dd22c7a2c7a8aa/charset_normalizer-3.4.9.tar.gz", hash = "sha256:673611bbd43f0810bec0b0f028ddeaaa501190339cac411f347ac76917c3ae7b", size = 152439, upload-time = "2026-07-07T14:34:58.454Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/8d/496817fa0944239ecae662dd57ea765cfeaec6a735f9f025d4b7b72e7143/charset_normalizer-3.4.9-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:0327fcd59a935777d83410750c50600ee9571af2846f71ce40f25b13da1ef380", size = 317253, upload-time = "2026-07-07T14:33:54.994Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/f9/ef4a69ea338ad3c0deceea0f5f7d2380ae8b52132b06d652cb0d2cd86706/charset_normalizer-3.4.9-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8a79d9f4d8001473a30c163556b3c3bfebec837495a412dde78b51672f6134f9", size = 215898, upload-time = "2026-07-07T14:33:56.334Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/e7/5ddfd76fc061eb52de219658a4aa431cbacadf0a0219c8854f00da50d289/charset_normalizer-3.4.9-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:33bdcc2a32c0a0e861f60841a512c8acc658c87c2ac59d89e3a46dacf7d866e4", size = 236718, upload-time = "2026-07-07T14:33:57.9Z" },
+    { url = "https://files.pythonhosted.org/packages/49/ba/768fa3f36048d81c477a0ce61f813bc1454d80917ccfe550abd9f44f5e24/charset_normalizer-3.4.9-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f840ed6d8ecba8255df8c42b87fadeda98ddfc6eeec05e2dc66e26d46dd6f58a", size = 232519, upload-time = "2026-07-07T14:33:59.811Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/c4/b3e049d2aa3766180c78507110543d9d50894cc97f57de543f1be521dcdc/charset_normalizer-3.4.9-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c25fe15c70c59eb7c5ce8c06a1f3fa1da0ecc5ea1e7a5922c40fd2fa9b0d5046", size = 223143, upload-time = "2026-07-07T14:34:01.517Z" },
+    { url = "https://files.pythonhosted.org/packages/19/79/55c32d06d76ae4feafe053f061f3e3ab70bcf19f4007797ce8c3efda7830/charset_normalizer-3.4.9-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:f7fb7d750cfa0a070d2c24e831fd3481019a60dd317ea2b39acbcebc08b6ed81", size = 206742, upload-time = "2026-07-07T14:34:03.04Z" },
+    { url = "https://files.pythonhosted.org/packages/10/e0/47c079dd82d217c807479cd59ffd30af56307ea31c108b75758970459ad3/charset_normalizer-3.4.9-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4d1c96a7a18b9690a4d46df09e3e3382406ae3213727cd1019ebade1c4a81917", size = 219191, upload-time = "2026-07-07T14:34:04.657Z" },
+    { url = "https://files.pythonhosted.org/packages/42/ab/b9bc2e77d6b44a7e46ef62ec5cac1c9a6ba7b9135a5d560f002696ec9995/charset_normalizer-3.4.9-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a4cfde78a9f2880208d16a93b795726a3017d5977e08d1e162a7a31322479c41", size = 218328, upload-time = "2026-07-07T14:34:06.115Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/78/c9c71d599f5aa2d42bcdd35cbbd46d7f535351a57e40ff7d8e5a7e219401/charset_normalizer-3.4.9-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:d4d6fcde76f94f5cb9e43e9e9a61f16dacefd228cbbf6f1a09bd9b219a92f1a1", size = 207406, upload-time = "2026-07-07T14:34:07.554Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/39/c914445c321a845097ce4f6ac7de9a18228a77b766272125a1ce00d851eb/charset_normalizer-3.4.9-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:898f0e9068ca27d37f8e83a5b962821df851532e6c4a7d615c1c033f9da6eedf", size = 225157, upload-time = "2026-07-07T14:34:09.061Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/f2/c0d4b8508565a36bc5c624e88ed297f5b0b1095011034d7f5b83a69908b5/charset_normalizer-3.4.9-cp314-cp314-win32.whl", hash = "sha256:c1c948747b03be832dceed96ca815cef7360de9aa19d37c730f8e3f6101aca48", size = 151095, upload-time = "2026-07-07T14:34:10.901Z" },
+    { url = "https://files.pythonhosted.org/packages/49/fd/a1d26144398c67486422a72bf5812cda22cb4ccfcd95a290fb41ceb4b8e2/charset_normalizer-3.4.9-cp314-cp314-win_amd64.whl", hash = "sha256:16b65ea0f2465b6fb52aa22de5eca612aa964ddfec00a912e26f4656cbef890b", size = 162796, upload-time = "2026-07-07T14:34:12.47Z" },
+    { url = "https://files.pythonhosted.org/packages/20/95/d75e82f8ce9fd323ebf059c16c9aadefb22a1ecde13b7840b35835e4886c/charset_normalizer-3.4.9-cp314-cp314-win_arm64.whl", hash = "sha256:40a126142a56b2dfc0aacbad1de8310cbf60da7656db0e6b16eebd48e3e93519", size = 153334, upload-time = "2026-07-07T14:34:14.044Z" },
+    { url = "https://files.pythonhosted.org/packages/00/5e/17398df3a139985ba9d11ed072531986f408c8fca952835ef1ab1820c02b/charset_normalizer-3.4.9-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:609b3ba8fcc0fb5ab7af00719d0fb6ad0cb518e48e7712d12fd68f1327951198", size = 338848, upload-time = "2026-07-07T14:34:15.688Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/91/7253a32e86b7e1d1239b1b36ba6dd0f021a21107ab33054b53119cc083b9/charset_normalizer-3.4.9-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:51447e9aa2684679af07ca5021c3db526e0284347ebf4ffcec1154c3350cfe32", size = 223022, upload-time = "2026-07-07T14:34:17.248Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/32/2e64bd2be10e89c61e57ebe6a93fd98ae88eb7ebe414b5121f22c96c69eb/charset_normalizer-3.4.9-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:cc1b0fff8ead343dae06305f954eb8468ba0ec1a97881f42489d198e4ce3c632", size = 241590, upload-time = "2026-07-07T14:34:18.813Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/ef/d96ec496cfea0c21db43b0ad03891308b02388d054cc902cf0e5a1ad6a88/charset_normalizer-3.4.9-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fa36ec09ef71d158186bc79e359ff5fdd6e7996fe8ab638f00d6b93139ba4fcf", size = 239584, upload-time = "2026-07-07T14:34:20.52Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/ce/9af95f7876194bd7a14e3dfe4a4de2e0bff02666a3910d72beafd06cc297/charset_normalizer-3.4.9-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:df115d4d83168fdf2cae48ef1ff6d1cb4c466364e30861b37121de0f3bf1b990", size = 230224, upload-time = "2026-07-07T14:34:22.189Z" },
+    { url = "https://files.pythonhosted.org/packages/52/94/af74dde74a3996bd959c350709bfe50e297823d70a8c1cbd54b838880863/charset_normalizer-3.4.9-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:f86c6358749bd4fda175388691e3ba8c46e24c5347d0afd20f9b7edfc9faf07d", size = 212667, upload-time = "2026-07-07T14:34:23.857Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/f0/f1c4fe746c395922961b5916ed1d7d6e7d4c84851d19ed43cc89980ec953/charset_normalizer-3.4.9-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:32286a2c8d167e897177b673176c1e3e00d4057caf5d2b64eef9a3666b03018e", size = 227179, upload-time = "2026-07-07T14:34:25.586Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/56/6c745619ac397e8871e2bcd3cea1eec86b877488f33888b3aef5c3ed506e/charset_normalizer-3.4.9-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:83aed2c10721ddd90f68140685391b50811a880af20654c59af6b6c66c40513c", size = 225372, upload-time = "2026-07-07T14:34:27.212Z" },
+    { url = "https://files.pythonhosted.org/packages/78/ad/98aae8630ac71f16711968e38a5acfecce41b778bf2f0312851020f565a8/charset_normalizer-3.4.9-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:cd6c3d4b783c556fa00bf540854e42f135e2f256abd29669fcd0da0f2dec79c2", size = 215222, upload-time = "2026-07-07T14:34:28.774Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/40/9593d54209765207a7f11073c06494c1721e4ca4a0a426c597679bf7f91e/charset_normalizer-3.4.9-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ee2f2a527e3c1a6e6411eb4209642e138b544a2d72fe5d0d76daf77b24063534", size = 231958, upload-time = "2026-07-07T14:34:30.345Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/27/693ee5e8a18191eb38647360c51cd505013e2bd3b366aa43fd5344c21e3c/charset_normalizer-3.4.9-cp314-cp314t-win32.whl", hash = "sha256:0d861473f743244d349b50f850d10eb87aeb22bbdcc8e64f79273c94af5a8226", size = 155580, upload-time = "2026-07-07T14:34:31.884Z" },
+    { url = "https://files.pythonhosted.org/packages/80/3f/bd97d3d9c613013d07cb7733d299385b41df37f0471310f5a73dc359f0b8/charset_normalizer-3.4.9-cp314-cp314t-win_amd64.whl", hash = "sha256:9b8e0f3107e2200b76f6054de99016eac3ee6762713587b36baaa7e4bd2ae177", size = 167620, upload-time = "2026-07-07T14:34:33.438Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/c6/eee9dca4439b1061f76373f06ea855678cc4a64c1c3c90b50e479edbb8eb/charset_normalizer-3.4.9-cp314-cp314t-win_arm64.whl", hash = "sha256:19ac87f93086ce37b86e098888555c4b4bc48102279bae3350098c0ed664b501", size = 158037, upload-time = "2026-07-07T14:34:35.018Z" },
+    { url = "https://files.pythonhosted.org/packages/98/2b/f97f1c193fb855c345d678f5077d6926034db0722df74c8f057020e05a25/charset_normalizer-3.4.9-py3-none-any.whl", hash = "sha256:68e5f26a1ad57ded6d1cfb85331d1c1a195314756471d97758c48498bb4dcdf5", size = 64538, upload-time = "2026-07-07T14:34:56.993Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "coverage"
+version = "7.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cc/8b/adeb62ea8951f13c4c7fef2e7a85e1a06b499c8d8237ea589d496029e53f/coverage-7.15.0.tar.gz", hash = "sha256:9ac3fe7a1435986463eaa8ee253ae2f2a268709ba4ae5c7dd1f52a05391ad78f", size = 925362, upload-time = "2026-07-02T13:10:50.535Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/9c/1e3ca54f72a3185ece06c58d871099898c48f0ed6430d17b6ab75f0d180a/coverage-7.15.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:41cb79af843222e11da87127ad0ecbfa878abadd0f770a4a99391a27d3887324", size = 220906, upload-time = "2026-07-02T13:09:51.339Z" },
+    { url = "https://files.pythonhosted.org/packages/09/37/f718613d83b274880382f6b67e78f3802549ae39b0b3e65ae5b5974df56e/coverage-7.15.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:7d2008989ef8fe54188d3f3bfa2e3099b025af11e90a6a1b9e7dc433d04263d8", size = 221239, upload-time = "2026-07-02T13:09:53.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/ce/22bae91e0b75445f68d365c7643ed0aa4880bbf77450ee74ca65bdae53a7/coverage-7.15.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:769e8ece11a596315ebf5aa7ec383aeeed016c091d2bf6363ffb996d41529092", size = 252286, upload-time = "2026-07-02T13:09:54.996Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/1e/bec5e32aa508615d9d7a2790effb25fb4dc28606e995816afe400b25ece3/coverage-7.15.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:65a6b6164ee5c39e2f3803f314292d6c61a607ba7fee253d1e03c42dc3903502", size = 254789, upload-time = "2026-07-02T13:09:56.678Z" },
+    { url = "https://files.pythonhosted.org/packages/17/29/0e865435b4354e4a7c03b1b7920046d31d0a273d55decefea27e011cb9bf/coverage-7.15.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:75128817f95a5c45bb01d65fd2d8b9cb54bbe03d81608fb70e3e14b437ad56c2", size = 256135, upload-time = "2026-07-02T13:09:58.343Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ff/33a870b58a13325d62fc0a6c8f01fa0ff667cef60c7498e2382a147dfa18/coverage-7.15.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9887bb428fe2d4cd4bee89bac1a6c9932f484afd5b36fbd4ff6ea5f825bb1f5e", size = 258449, upload-time = "2026-07-02T13:10:00.057Z" },
+    { url = "https://files.pythonhosted.org/packages/18/7b/6fffe596bf3ddba8462758d02c5dad730fd91055a6634aa2e4226229181a/coverage-7.15.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0bfc0be1f702042207a93a00523b1065ee1fe951e96edf311581c0bbc2e34888", size = 252313, upload-time = "2026-07-02T13:10:01.946Z" },
+    { url = "https://files.pythonhosted.org/packages/58/1b/11468dd6c1676ab831a70cb9a8d4e198e8607fa0b7220ab918b73fe9bfbd/coverage-7.15.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:f64627d55def5a43282d70e08396672692f77e4da610a5bb8bb4060b432b6859", size = 254142, upload-time = "2026-07-02T13:10:04.065Z" },
+    { url = "https://files.pythonhosted.org/packages/79/41/29328e21d16b1b95092c30dd700e08cf915bd3734f836df8f3bdb0e8fa9f/coverage-7.15.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:2c6f0fa473003905c6d5bac328ee4eba9fbea654f15bc24b8a3274b23363fa99", size = 252108, upload-time = "2026-07-02T13:10:06.11Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/de/05ccfb990439655b35afbfd8e0d13fe66677565a7d4eb38c3f5ef2635e1c/coverage-7.15.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:2bcf9afaf064172c6ec3c58a325a9957ad1178c05dd934e25f253321776e0676", size = 256385, upload-time = "2026-07-02T13:10:08.141Z" },
+    { url = "https://files.pythonhosted.org/packages/51/0e/486828a3d2695ea7a2609f17ff572f6b01905e608379440a11da4b8dffbe/coverage-7.15.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:baf06bc987115d6fb938d403f7eab684a057766c490367999a2b71a6883110c6", size = 251923, upload-time = "2026-07-02T13:10:10.179Z" },
+    { url = "https://files.pythonhosted.org/packages/18/c7/03582b6715f078e5e558354c87616d945b9894cda2dace8e4009b17035e4/coverage-7.15.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f0405f2ff97b1c4c0e782cb32e02f32369bcf2e6b618b591d67e1ea754575dfe", size = 253580, upload-time = "2026-07-02T13:10:12.052Z" },
+    { url = "https://files.pythonhosted.org/packages/db/dc/9e578bbaf2ecb4959a81b7e7601ad8cca772cba2892e8d144cb749b4a71a/coverage-7.15.0-cp314-cp314-win32.whl", hash = "sha256:ab282853ed5fbd64bbb162f19cb8fcb7087187508a6374b4f9c34ec1577c4e8f", size = 223107, upload-time = "2026-07-02T13:10:13.994Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/3e/c8c3b75d8dbe0e35f7b0cc3ff5e949fc59500f70b21d0398813f66740664/coverage-7.15.0-cp314-cp314-win_amd64.whl", hash = "sha256:3bb3040e9f4bbe26fcb0cd7cc85ac63e630d3f3a9c74f027abf4caa27e706663", size = 223597, upload-time = "2026-07-02T13:10:15.906Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/bc/3cbc9fb036eb388519bccd521f783499c39b64256013fbc362782f196fe1/coverage-7.15.0-cp314-cp314-win_arm64.whl", hash = "sha256:346771144d34f7fa84ec28386f78e0f31653f33cf35e19d253d5b35f9e8201da", size = 223020, upload-time = "2026-07-02T13:10:17.844Z" },
+    { url = "https://files.pythonhosted.org/packages/28/00/199c4a8d656dff63102577a056c0fce2ff6a79e40adac092fc986c49cbf1/coverage-7.15.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:d34a010905fb6401324ba016b5da03d574967f7b21ce48ea41e66f0f1f95f641", size = 221638, upload-time = "2026-07-02T13:10:19.703Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/8e/9d0092c96a3d3a26951ecc7020826aa57bcb1b119ca81acbba996884ab13/coverage-7.15.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:bb25d825d885ca8036795dacfc3924d33091fc76d71ebc99420c6b79e77d96fa", size = 221903, upload-time = "2026-07-02T13:10:21.514Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b4/c0ca3028f42c9a08e51feb4561ef1192e5de99797cd1db5b04590c215bda/coverage-7.15.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:94c9686bfe8a9a6810297aecbd99beaa3445f9e8dc2f80b1382cca0d86b64461", size = 263267, upload-time = "2026-07-02T13:10:23.261Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/aa/a375e3846e5d3c013dc600b2a3231089055c73d77f5393dd2192a8d64da6/coverage-7.15.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9bd671c25f9d85f09d7ec481d0e43d5139f486c06a37139847a7ce569788af72", size = 265390, upload-time = "2026-07-02T13:10:25.152Z" },
+    { url = "https://files.pythonhosted.org/packages/92/e1/5783cdabb797305e1c9e4809fea496d31834c51fa772514f73dc148bcfc9/coverage-7.15.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:110cbdf8d2e216577312cf06ccf85539c0e5a5420ef747e4a4719b5e483c88cd", size = 267811, upload-time = "2026-07-02T13:10:27.249Z" },
+    { url = "https://files.pythonhosted.org/packages/85/31/96d8bbf58b8e9193bc8389574a91a0db48355ee98feb66aa6bf8d1b32eea/coverage-7.15.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c5d4619214f1d9993e7b00a8600d14614b7e9d84e89507460b126aa5e6559e5", size = 268928, upload-time = "2026-07-02T13:10:29.242Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/7a/5294567e811a1cb7eda93140c628fa050d66189da28da320f93d1d815c73/coverage-7.15.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:781a704516e2d8346fbbd5be6c6f3412dd824785146528b3a01816f26c081007", size = 262378, upload-time = "2026-07-02T13:10:31.107Z" },
+    { url = "https://files.pythonhosted.org/packages/69/3f/3f48538421f899f28946f90a3d272136a4686e1abf461cc9249a783ee0f3/coverage-7.15.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:bd4a1b44bcb65ee29e947ac92bbee04956df3a6bfc6143641bb6cae7ede00fc9", size = 265263, upload-time = "2026-07-02T13:10:32.942Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/d3/092df15efcab8a9c1467ee960eb8019bbad3f9300d115d89ea6195f369ff/coverage-7.15.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:0e4950c9d6d3e39c64c991814ff315e2d0b9cb8152363594212c9e55208c0a8f", size = 262866, upload-time = "2026-07-02T13:10:35.104Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/ab/0254d2b88665efb2c57ad368cc77ab5de3435bd8d5add4729c1b0e79431e/coverage-7.15.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:fe9c87ff42e5472d80d21704972e1f96e104a0a599d77c5e35db5a3c562e2571", size = 266599, upload-time = "2026-07-02T13:10:37.05Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/79/1cfa4023e489ce6fbc7be4a5d442dbc375edb4f4fda39a352cedb53263c2/coverage-7.15.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f00d5ae1dd2fe13fb8186e3e7d37bcbd8b25c0d764ff7d1b32cef9be058510a8", size = 261714, upload-time = "2026-07-02T13:10:38.966Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/eb/fee5c8665656be63f497418d410484637c438172568688e8ac92e06574e7/coverage-7.15.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:363ab38cc78b615f11c9cac3cf1d7eef950c18b9fdedfb9066f59461dcf84d68", size = 264025, upload-time = "2026-07-02T13:10:40.789Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/99/63005db722f91edc81abc16302f9cc2f6228c1679e46e15be9ae144b14d0/coverage-7.15.0-cp314-cp314t-win32.whl", hash = "sha256:54fd9c53a5fafff509195f1b6a3f9be615d8e8362a3629ff1de23d270c03c86b", size = 223413, upload-time = "2026-07-02T13:10:42.597Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/e8/2bc6181c4fb06f1a6b981eb85330cc57bfad7e3f710fc9c9d350013ba228/coverage-7.15.0-cp314-cp314t-win_amd64.whl", hash = "sha256:87b47553097ba185ed964866078e7e63adea9f5f51b5f39691c34f30afd21080", size = 224245, upload-time = "2026-07-02T13:10:44.47Z" },
+    { url = "https://files.pythonhosted.org/packages/79/b8/4d959bf9cc45d0cfed2f4d35cafcab978cdb6ea02eb5100009cd740632a3/coverage-7.15.0-cp314-cp314t-win_arm64.whl", hash = "sha256:aeefb2dd178fe7eee79f0ad25d75855cb35ee9ed472db2c5ea06f5b4fd00cec5", size = 223558, upload-time = "2026-07-02T13:10:46.368Z" },
+    { url = "https://files.pythonhosted.org/packages/52/30/21b2ad45959cd50e909e02ebac1e30b4ceb7162e91c11d4c570223a458b7/coverage-7.15.0-py3-none-any.whl", hash = "sha256:56da6a4cbe8f7e9e80bd072ca9cefe67d7106a440a7ec06519ec6507ac94ad19", size = 212632, upload-time = "2026-07-02T13:10:48.641Z" },
+]
+
+[[package]]
+name = "cryptography"
+version = "49.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
+    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
+    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
+    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
+    { url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
+    { url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
+    { url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
+    { url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
+    { url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
+    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
+    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
+    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
+]
+
+[[package]]
+name = "cssselect2"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "tinycss2" },
+    { name = "webencodings" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e0/20/92eaa6b0aec7189fa4b75c890640e076e9e793095721db69c5c81142c2e1/cssselect2-0.9.0.tar.gz", hash = "sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb", size = 35595, upload-time = "2026-02-12T17:16:39.614Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/21/0e/8459ca4413e1a21a06c97d134bfaf18adfd27cea068813dc0faae06cbf00/cssselect2-0.9.0-py3-none-any.whl", hash = "sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563", size = 15453, upload-time = "2026-02-12T17:16:38.317Z" },
+]
+
+[[package]]
+name = "dj-database-url"
+version = "3.1.2"
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
 ]
-
-[package.dev-dependencies]
-dev = [
-    { name = "ruff" },
+sdist = { url = "https://files.pythonhosted.org/packages/03/f6/00b625e9d371b980aa261011d0dc906a16444cb688f94215e0dc86996eb5/dj_database_url-3.1.2.tar.gz", hash = "sha256:63c20e4bbaa51690dfd4c8d189521f6bf6bc9da9fcdb23d95d2ee8ee87f9ec62", size = 11490, upload-time = "2026-02-19T15:30:23.638Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cf/a9/57c66006373381f1d3e5bd94216f1d371228a89f443d3030e010f73dd198/dj_database_url-3.1.2-py3-none-any.whl", hash = "sha256:544e015fee3efa5127a1eb1cca465f4ace578265b3671fe61d0ed7dbafb5ec8a", size = 8953, upload-time = "2026-02-19T15:30:39.37Z" },
 ]
 
-[package.metadata]
-requires-dist = [{ name = "django", specifier = ">=6.0.6" }]
-
-[package.metadata.requires-dev]
-dev = [{ name = "ruff", specifier = ">=0.15.17" }]
-
 [[package]]
 name = "django"
 version = "6.0.6"
@@ -44,6 +340,531 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/eb/50/23f9dc45483419a3cc2085b498b25adfbf10642b2941c73e6d2dfaffc9ab/django-6.0.6-py3-none-any.whl", hash = "sha256:25148b1194c47c2e685e5f5e9c5d59c78b075dfd282cb9618861ba6c1708f4d2", size = 8373354, upload-time = "2026-06-03T13:02:41.72Z" },
 ]
 
+[[package]]
+name = "django-allauth"
+version = "65.18.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d7/10/2d33c5bc3c0f9d7db1276a1babcaadd147e73eb416ccb1bd9523c6ac925f/django_allauth-65.18.0.tar.gz", hash = "sha256:afb82e2c545b9a5539370ad120468faaed84715e095a7b6e76972dacdc6376fe", size = 2246988, upload-time = "2026-05-29T13:01:26.071Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1d/75/5a4c2bf050e38ab16549395a7cd751ddcf3a18305bff4852cfd6c0d94998/django_allauth-65.18.0-py3-none-any.whl", hash = "sha256:e508640c83b94eaf1a9b4e9ac5332dc310dcdc83fca40d58a3f670e15bad1e84", size = 2061080, upload-time = "2026-05-29T13:01:16.532Z" },
+]
+
+[package.optional-dependencies]
+mfa = [
+    { name = "fido2" },
+    { name = "qrcode" },
+]
+
+[[package]]
+name = "django-browser-reload"
+version = "1.21.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/79/ef/ab407c1a2f14e13c75a6419a2d124954aa0364f62580ad95a3d31dc6c73d/django_browser_reload-1.21.0.tar.gz", hash = "sha256:3335ad3d107eb657f623d1a8e680dfbcab8a83ae1f94df1895e069dddf5604ba", size = 15800, upload-time = "2025-09-22T17:00:35.199Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/46/61/1b4a8c589652859995bcab87682286443eb9fdf2d7fd584975b9ffc1db33/django_browser_reload-1.21.0-py3-none-any.whl", hash = "sha256:0b2a86ab460774fa9bb142a121c70e75a72f18109f51a4f6de409cd633d3a70d", size = 12852, upload-time = "2025-09-22T17:00:33.479Z" },
+]
+
+[[package]]
+name = "django-countries"
+version = "9.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/6e/c1/1e8feb818164c3f23465c08cc3bc1cd7da7101506268a138a1b92ea40339/django_countries-9.0.0.tar.gz", hash = "sha256:a993416af08a8a4e6e866d56b71c7ce92351c81a2543da213cd7899917567a42", size = 614144, upload-time = "2026-06-10T00:39:28.841Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5c/bb/5a17b339852f6486d02b4dd0033132082976c71f049ee909ccb42917be52/django_countries-9.0.0-py3-none-any.whl", hash = "sha256:21fce461733c856355c487d1f24b71338599482505004a0c2e521fd574a59fb1", size = 931759, upload-time = "2026-06-10T00:39:26.851Z" },
+]
+
+[[package]]
+name = "django-lucide"
+version = "1.3.1"
+source = { git = "https://github.com/bsiebens/lucide#d2cdc609c30ad09701c9d044427adef5cec87500" }
+
+[[package]]
+name = "django-ninja"
+version = "1.6.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "pydantic" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d5/7c/3307e17b872f545c88314b2737a22f965785dfb5a120d739b0131d0492c3/django_ninja-1.6.2.tar.gz", hash = "sha256:d56ae5aa4791068ef4ac9a66cfdf2fc11f507413ded35abb79c51d0d52ad6412", size = 3685599, upload-time = "2026-03-18T20:06:47.284Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/21/0c/25f72060a39632fbd2d90e9c8b6052a09cd45b0598fc06c0758d313f0052/django_ninja-1.6.2-py3-none-any.whl", hash = "sha256:20095f5900bada22ea00cf1a58af50bdb285b2354c61a9d9b47d0dc89ac462d6", size = 2374994, upload-time = "2026-03-18T20:06:45.676Z" },
+]
+
+[[package]]
+name = "django-phonenumber-field"
+version = "8.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/87/bf/8aa60c9834773b955dff1ddea842e361e8daaf6b0945d5bfc29fc66d53ab/django_phonenumber_field-8.4.0.tar.gz", hash = "sha256:2b83e843dac35eec6a69880a166487235b737a71a1e38c9a52e5ad67d6996083", size = 45512, upload-time = "2025-11-24T15:09:51.904Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8b/a3/f6b85a9246e22cf719752ad83f5e95aa9ba12419b2f9eff70f20d30e55df/django_phonenumber_field-8.4.0-py3-none-any.whl", hash = "sha256:7a1cb3a6456edb54d879f11ffa0acb227ded08c93b587035d0f28093f0e46511", size = 69528, upload-time = "2025-11-24T15:09:45.479Z" },
+]
+
+[package.optional-dependencies]
+phonenumbers = [
+    { name = "phonenumbers" },
+]
+
+[[package]]
+name = "django-redis"
+version = "7.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "redis" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/fb/78/203a0cdc0f1c083a5407d01f77b58099a120bb8a5a04562f56a9bb341314/django_redis-7.0.0.tar.gz", hash = "sha256:e48491c862f4350b0747ceb1016700686fb93c4f4e0fb9c490fe6c6658ffd933", size = 64601, upload-time = "2026-06-02T14:17:48.819Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/9f/09cdb9a1eebe8533b02a7694ca787acfc1e4d93b5b6175ff99366d4e6d64/django_redis-7.0.0-py3-none-any.whl", hash = "sha256:4b23aa6e0cd0937bb1242e9a463809e6004de3ca2150f34e986306bb6220d688", size = 38932, upload-time = "2026-06-02T14:17:47.281Z" },
+]
+
+[[package]]
+name = "django-storages"
+version = "1.14.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ff/d6/2e50e378fff0408d558f36c4acffc090f9a641fd6e084af9e54d45307efa/django_storages-1.14.6.tar.gz", hash = "sha256:7a25ce8f4214f69ac9c7ce87e2603887f7ae99326c316bc8d2d75375e09341c9", size = 87587, upload-time = "2025-04-02T02:34:55.103Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1f/21/3cedee63417bc5553eed0c204be478071c9ab208e5e259e97287590194f1/django_storages-1.14.6-py3-none-any.whl", hash = "sha256:11b7b6200e1cb5ffcd9962bd3673a39c7d6a6109e8096f0e03d46fab3d3aabd9", size = 33095, upload-time = "2025-04-02T02:34:53.291Z" },
+]
+
+[package.optional-dependencies]
+s3 = [
+    { name = "boto3" },
+]
+
+[[package]]
+name = "django-waffle"
+version = "5.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/22/e1/6f533da0d4ac89f427dfd9410e39bfc14ae3a23335ecd549d76be4b2a834/django_waffle-5.0.0.tar.gz", hash = "sha256:62f9d00eedf68dafb82657beab56e601bddedc1ea1ccfef91d83df8658708509", size = 37761, upload-time = "2025-06-12T07:38:54.895Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7a/d2/6f0d664bd35a3fdd0403655c7c32ec290704923f11541ef356b180cd8fbf/django_waffle-5.0.0-py3-none-any.whl", hash = "sha256:3312851d9d926b76b9e90712355781700a383b82b5bf2b61e1f1be97532c0f3d", size = 48137, upload-time = "2025-06-12T07:38:53.698Z" },
+]
+
+[[package]]
+name = "et-xmlfile"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/38/af70d7ab1ae9d4da450eeec1fa3918940a5fafb9055e934af8d6eb0c2313/et_xmlfile-2.0.0.tar.gz", hash = "sha256:dab3f4764309081ce75662649be815c4c9081e88f0837825f90fd28317d4da54", size = 17234, upload-time = "2024-10-25T17:25:40.039Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c1/8b/5fe2cc11fee489817272089c4203e679c63b570a5aaeb18d852ae3cbba6a/et_xmlfile-2.0.0-py3-none-any.whl", hash = "sha256:7a91720bc756843502c3b7504c77b8fe44217c85c537d85037f0f536151b2caa", size = 18059, upload-time = "2024-10-25T17:25:39.051Z" },
+]
+
+[[package]]
+name = "fido2"
+version = "2.2.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ba/ea/6f08c354b7aeb8019249d46a86c2153f8218499cced4d21bf16b6d49fc16/fido2-2.2.1.tar.gz", hash = "sha256:85787428a94c3f8eaf72f0ff30afba983b559a1b1b795c93318c81b4ad4062c4", size = 327147, upload-time = "2026-06-29T17:41:11.927Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/71/84/198d99c3312557ef6121cf78c38281efe9b3bc88cba0e2c05446f38a024d/fido2-2.2.1-py3-none-any.whl", hash = "sha256:ed397da981b9ab133da6ead7309e41f924b566b749956129efe286fae097749f", size = 238354, upload-time = "2026-06-29T17:41:09.921Z" },
+]
+
+[[package]]
+name = "fonttools"
+version = "4.63.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/84/69/c97f2c18e0db87d2c7b15da1974dace76ae938f1cfa22e2727a648b7ed43/fonttools-4.63.0.tar.gz", hash = "sha256:caeb583deeb5168e694b65cda8b4ee62abedfa66cf88488734466f2366b9c4e0", size = 3597189, upload-time = "2026-05-14T12:04:30.958Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/d2/23d25e3f247b328be58d04a4c9f894178a0d1eda7d42867cfb388adaf416/fonttools-4.63.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:fd1e3094f42d806d3d7c79162fc59e5910fcbe3a7360c385b8da969bc4493745", size = 2875338, upload-time = "2026-05-14T12:03:50.052Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/58/7dfa0c761cb3b2964e2a84c4dc986c926a87de0cb9fb60d5b28ded3f2914/fonttools-4.63.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:6e528da43bc3791085f8cb6141b1d13e459226790240340fcbb4625649238b03", size = 2422661, upload-time = "2026-05-14T12:03:52.154Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/87/64cfa18a7a1621d17b7f4502b2b0ed8a135a90c3db51ea590ee99043e76b/fonttools-4.63.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b2248c5decb223562f7902ff6325077a073f608ee8e33e88ad88db734eb9f49", size = 5010526, upload-time = "2026-05-14T12:03:54.647Z" },
+    { url = "https://files.pythonhosted.org/packages/36/e1/a8933a72c45a87177fbde2696e0d0755c8c9062f8c077a961c6215fa27b1/fonttools-4.63.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:308f957cdeaf8abe4e5f2f124902ef405448af92c90f80e302a3b771c2e6116b", size = 4923946, upload-time = "2026-05-14T12:03:56.984Z" },
+    { url = "https://files.pythonhosted.org/packages/27/60/872e6e233b8c5e8b41413796ff18b7fe479661bd40147e071b450dfad7a1/fonttools-4.63.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:bf00f21eb5fb721dbaf73d1e9da6d02a1af7768f2ebcf9798be98beab8ba90f6", size = 4962489, upload-time = "2026-05-14T12:03:59.443Z" },
+    { url = "https://files.pythonhosted.org/packages/30/c4/83c24f2ec38b90cfda84bf4b1a1f49df80e84a1db4e7ac6e0d41bf23bc39/fonttools-4.63.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c1aaa4b9c75798400ac043ce04d74e7830376c85095a5a6ed7cba2f17a266bf4", size = 5071870, upload-time = "2026-05-14T12:04:02.122Z" },
+    { url = "https://files.pythonhosted.org/packages/de/40/3ae22b60ff1d41ce0bd044b31238cdc72cef99f28b976f1e128ebd618c9b/fonttools-4.63.0-cp314-cp314-win32.whl", hash = "sha256:22693918177bd9ceabec4736d338045f357769416fc6b0b2508eefef75b08616", size = 2295026, upload-time = "2026-05-14T12:04:04.47Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/d4/98078064ccc76b45cb0f6c002452011e93c4bd26f6850344f0951cc1fe89/fonttools-4.63.0-cp314-cp314-win_amd64.whl", hash = "sha256:7d782fac32985914c351556f68ac0855391572bcd87de50e05970d3cd4c96fc5", size = 2347454, upload-time = "2026-05-14T12:04:06.752Z" },
+    { url = "https://files.pythonhosted.org/packages/49/4e/652d1580c5f4e39f7d103b0c793e4773129ad633dce4addd0cf4dfebde02/fonttools-4.63.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:6db5140a60a5d731d21ec076745b40a310607731b0a565b50776393188649001", size = 2958152, upload-time = "2026-05-14T12:04:08.706Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/55/ad864c9a9b219f552eb46b32cd7906c466e5a578ba0c3abfcc0fe7413eb6/fonttools-4.63.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:7d76edbff9014094dbf03bd2d074709dfa6ec7aba13d838c937a2b33d2d6a86e", size = 2460809, upload-time = "2026-05-14T12:04:10.783Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/2b/0aa8db70f18cf52e49b4ed5ecec68547f981160bf5ded3b5aed6faa0a6f9/fonttools-4.63.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0eac00b9118c3c2f87d272e45341871c5b3066baa3c86897fa634a7c3fb59096", size = 5148649, upload-time = "2026-05-14T12:04:12.747Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/63/18e4369c25043096f1048e0c9915951adc4f842bd81c6b18155824d6fa99/fonttools-4.63.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:51394295f1a51de8b5f30bdb1e1b9a4231536c7064ef5c6e211eec19fa36036f", size = 4932147, upload-time = "2026-05-14T12:04:14.806Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/3f/67f3eac2ffd8a98446c5022f8ed3864eac878a5ff7af8df4c8286dba16cc/fonttools-4.63.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:9e12f105d2b6342c559c298afb674006bb2893afc7102dcf8a1b55b0486b4e40", size = 5027237, upload-time = "2026-05-14T12:04:17.675Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/ba/4e6214cb38a7b04779e97bb7636de9a5c7f20af7018d03dee0b64c08510a/fonttools-4.63.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:796f27556dbe094c4824f75ca85267e4df776c79036c8441469a4df37038c196", size = 5053933, upload-time = "2026-05-14T12:04:20.818Z" },
+    { url = "https://files.pythonhosted.org/packages/34/3b/214dcc19ee31d3d38fb5ad2755c11ef0514e5dc300bbaf41c0b69f393799/fonttools-4.63.0-cp314-cp314t-win32.whl", hash = "sha256:948428a275741f0b64b113c955425a953314f4b9ab9997f73a72c83e68e569c8", size = 2359326, upload-time = "2026-05-14T12:04:24.22Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/1e/3ff1a9b523058c2eeb6a9d50f5574e2a738200d0d94107d5bc4105e8da3f/fonttools-4.63.0-cp314-cp314t-win_amd64.whl", hash = "sha256:6d4741eb179121cab9eea4cb2393d24492373a260d7945006358c08cfbf45419", size = 2425829, upload-time = "2026-05-14T12:04:26.829Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/47/c99d5268f354002ce80f8d029cd9d7d872969da1de8b93d32de4dc56d6f4/fonttools-4.63.0-py3-none-any.whl", hash = "sha256:445af2eab030a16b9171ea8bdda7ebf7d96bda2df88ee182a464252f6e05e20d", size = 1164562, upload-time = "2026-05-14T12:04:29.092Z" },
+]
+
+[package.optional-dependencies]
+woff = [
+    { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
+    { name = "brotlicffi", marker = "platform_python_implementation != 'CPython'" },
+    { name = "zopfli" },
+]
+
+[[package]]
+name = "gunicorn"
+version = "26.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/6d/b7/a4a3f632f823e432ce6bc65f62961b7980c898c77f075a2f7118cb3846fe/gunicorn-26.0.0.tar.gz", hash = "sha256:ca9346f85e3a4aeeb64d491045c16b9a35647abd37ea15efe53080eb8b090baf", size = 727286, upload-time = "2026-05-05T06:38:25.529Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e6/40/9c2384fc2be4ad25dd4a49decd5ad9ea5a3639814c11bd40ab77cb9f0a14/gunicorn-26.0.0-py3-none-any.whl", hash = "sha256:40233d26a5f0d1872916188c276e21641155111c2853f0c2cd55260aec0d24fc", size = 212009, upload-time = "2026-05-05T06:38:23.007Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.18"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
+]
+
+[[package]]
+name = "jmespath"
+version = "1.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/59/322338183ecda247fb5d1763a6cbe46eff7222eaeebafd9fa65d4bf5cb11/jmespath-1.1.0.tar.gz", hash = "sha256:472c87d80f36026ae83c6ddd0f1d05d4e510134ed462851fd5f754c8c3cbb88d", size = 27377, upload-time = "2026-01-22T16:35:26.279Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/2f/967ba146e6d58cf6a652da73885f52fc68001525b4197effc174321d70b4/jmespath-1.1.0-py3-none-any.whl", hash = "sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64", size = 20419, upload-time = "2026-01-22T16:35:24.919Z" },
+]
+
+[[package]]
+name = "openpyxl"
+version = "3.1.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "et-xmlfile" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/3d/f9/88d94a75de065ea32619465d2f77b29a0469500e99012523b91cc4141cd1/openpyxl-3.1.5.tar.gz", hash = "sha256:cf0e3cf56142039133628b5acffe8ef0c12bc902d2aadd3e0fe5878dc08d1050", size = 186464, upload-time = "2024-06-28T14:03:44.161Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c0/da/977ded879c29cbd04de313843e76868e6e13408a94ed6b987245dc7c8506/openpyxl-3.1.5-py2.py3-none-any.whl", hash = "sha256:5282c12b107bffeef825f4617dc029afaf41d0ea60823bbb665ef3079dc79de2", size = 250910, upload-time = "2024-06-28T14:03:41.161Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "phonenumbers"
+version = "9.0.33"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/75/37/dfc4cf24169f1a7169ebaedaf896c818f0add8603409d1e748e3085ccdc0/phonenumbers-9.0.33.tar.gz", hash = "sha256:9ab8a02b940b90c64f3866c0b25a30e567ddf7bb9836a3e11efdb0478f65fc1c", size = 2306756, upload-time = "2026-06-22T10:23:33.428Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e6/29/f7e30e3dbd3c7e3d9c4a55006112c04ee62b4765a31f21bcc28c253ac3f1/phonenumbers-9.0.33-py2.py3-none-any.whl", hash = "sha256:ba1d0da52711d5fdda6b2b673b2621fe80774fc5d1b2e5a6ef783396b0343186", size = 2595422, upload-time = "2026-06-22T10:23:29.925Z" },
+]
+
+[[package]]
+name = "pillow"
+version = "12.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/01/001f65b68192f0228cc1dbbc8d2530ab5d58b61037ba0587f946fea607cd/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330", size = 4161736, upload-time = "2026-07-01T11:54:51.156Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/d2/0219746d0fd16fc8a84498e79452375be3797d3ce4044596ce565164b84f/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217", size = 4255435, upload-time = "2026-07-01T11:54:53.414Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/02/8d0bc62ef0302318c46ff2a512822d2610e81c7aa46c9b3abe6cbaca5ad0/pillow-12.3.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930", size = 3696262, upload-time = "2026-07-01T11:54:55.739Z" },
+    { url = "https://files.pythonhosted.org/packages/85/e2/73c77d218410b14f5f2d565e8a998d5317b7b9c75368d29985139f7a46f0/pillow-12.3.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8", size = 5350344, upload-time = "2026-07-01T11:54:57.657Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/da/32c752228ae345f489e3a42499d817b6c3996da7e8a3bc7a04fc806b243b/pillow-12.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0", size = 4780131, upload-time = "2026-07-01T11:54:59.713Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/9d/8b2c807dbef61a5197c047afe99823787eb66f63daf9fb2432f91d6f0462/pillow-12.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321", size = 6263757, upload-time = "2026-07-01T11:55:01.778Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/44/c85361f65dbe00eea8576ee467c768d25129989efb76e94f205e9ca9bb46/pillow-12.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b", size = 6936962, upload-time = "2026-07-01T11:55:03.93Z" },
+    { url = "https://files.pythonhosted.org/packages/18/7e/e483414b35800b86b6f08dbbc7803fb5cd52c4d6f897f47d53ea2c7e6f65/pillow-12.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198", size = 6339171, upload-time = "2026-07-01T11:55:05.989Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/f4/68c491844841ede6bed70189546b3ee9731cf9f2cbad396faff5e1ccba45/pillow-12.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130", size = 7048116, upload-time = "2026-07-01T11:55:08.131Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/34/77f3f793fed8efc7d243f21b33c5a3f0d1c97ee70346d3db855587e155ff/pillow-12.3.0-cp314-cp314-win32.whl", hash = "sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a", size = 6467209, upload-time = "2026-07-01T11:55:10.408Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e0/492879f69d94f91f60fc8cd05ba03650e9520afebb2fb7aa12777d7c7f38/pillow-12.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d", size = 7237707, upload-time = "2026-07-01T11:55:12.745Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/ac/6b11f2875f1c2ac040d84e1bbf9cf22a88038f901ca1037898b280b38365/pillow-12.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838", size = 2565995, upload-time = "2026-07-01T11:55:14.736Z" },
+    { url = "https://files.pythonhosted.org/packages/52/69/c2208e56af9bfc1913afb24020297a691eb1d4ef688474c8a04913f65e04/pillow-12.3.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e", size = 5352503, upload-time = "2026-07-01T11:55:17.076Z" },
+    { url = "https://files.pythonhosted.org/packages/07/70/e5686d753e898a45d778ff1718dba8516ead6ab6b95d85fc8c4b70650cf2/pillow-12.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17", size = 4782956, upload-time = "2026-07-01T11:55:19.448Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/37/25c6692f06927ee973ff18c8d9ee98ad0b4d84ee67a09610c2dd1447958e/pillow-12.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385", size = 6322855, upload-time = "2026-07-01T11:55:21.613Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/91/420637fcb8f1bc11029e403b4538e6694744428d8246118e45719f944556/pillow-12.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c", size = 6989642, upload-time = "2026-07-01T11:55:24.006Z" },
+    { url = "https://files.pythonhosted.org/packages/10/08/b94d7811281ccf0d143a1cf768d1c49e1e54af63e7b708ab2ee3eb87face/pillow-12.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d", size = 6391281, upload-time = "2026-07-01T11:55:26.252Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/87/24233f785f55474dc02ce3e739c5528a77e3a862e9333d1dd7a25cc31f70/pillow-12.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931", size = 7096716, upload-time = "2026-07-01T11:55:28.318Z" },
+    { url = "https://files.pythonhosted.org/packages/23/26/fcb2f6e37175b04f53570b59937867e2b80ee1685e744023153028fc14f9/pillow-12.3.0-cp314-cp314t-win32.whl", hash = "sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7", size = 6474125, upload-time = "2026-07-01T11:55:30.956Z" },
+    { url = "https://files.pythonhosted.org/packages/90/de/3634abee5f1c9e13c56787b7d5517b0ba8d6de51700b95578cf338349c9f/pillow-12.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c", size = 7242939, upload-time = "2026-07-01T11:55:34.044Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/2a/fd13f8eb24de5714a6eb444a3d67e2842c6c576e159a43793adf23051351/pillow-12.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45", size = 2567506, upload-time = "2026-07-01T11:55:35.988Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/dc/8fdce34ec725a33c81c6ba122b904d6b9024e50ea9ac7bede62fab54506c/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139", size = 4162063, upload-time = "2026-07-01T11:55:37.941Z" },
+    { url = "https://files.pythonhosted.org/packages/76/66/2044b9a63d3b84ff048228dfcb7cd9bf0df983e8470971bf7d4c57b693de/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402", size = 4255549, upload-time = "2026-07-01T11:55:40.022Z" },
+    { url = "https://files.pythonhosted.org/packages/52/7e/1f67e6f4ece6b582ee4b539decbcc9f848dc245a93ed8cd7338bafef72f1/pillow-12.3.0-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c", size = 3696331, upload-time = "2026-07-01T11:55:41.98Z" },
+    { url = "https://files.pythonhosted.org/packages/12/40/d306fc2c8e4d45d7f175c77edca7063be7b86fe7fe6e68f4353bf71d808c/pillow-12.3.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f", size = 5350370, upload-time = "2026-07-01T11:55:44.028Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/44/668fb1437e8ce420f62d6106eb66e44a5971602a4d794615bdf79315d82d/pillow-12.3.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701", size = 4780147, upload-time = "2026-07-01T11:55:46.073Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/08/93fa2e70e30a2d81547e481b6ee2bb9522117221fb1e0ce4b5df70967677/pillow-12.3.0-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace", size = 6273659, upload-time = "2026-07-01T11:55:48.264Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/6d/043e96ff814fc31a33077e4cba86082167db520c93632afdf2042febbb0c/pillow-12.3.0-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4", size = 6947439, upload-time = "2026-07-01T11:55:50.503Z" },
+    { url = "https://files.pythonhosted.org/packages/af/92/ba71d2ee2ac0edf3fa33bd9d5ee9ee080da70b1766f3ca3934f9938ddac9/pillow-12.3.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39", size = 6353577, upload-time = "2026-07-01T11:55:52.697Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ce/e63064e2122923ff687c8ad792d0d736a7b3920a56a46982e81a7fdd25d6/pillow-12.3.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71", size = 7060394, upload-time = "2026-07-01T11:55:55.149Z" },
+    { url = "https://files.pythonhosted.org/packages/54/76/a09cc3ccc8d773a7283d34c38bec1708f9e3cc932093cbc4c5e71ac4060b/pillow-12.3.0-cp315-cp315-win32.whl", hash = "sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827", size = 6467375, upload-time = "2026-07-01T11:55:57.769Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/03/1846c49ba3b1d5550392a4bbd06d6fb4578e1cd91a803198b5c90f5f7d53/pillow-12.3.0-cp315-cp315-win_amd64.whl", hash = "sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5", size = 7237048, upload-time = "2026-07-01T11:55:59.975Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/bb/89f35dcc79610423f9f195504d7def7f0d1416a711541b42867e25fe3412/pillow-12.3.0-cp315-cp315-win_arm64.whl", hash = "sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658", size = 2566006, upload-time = "2026-07-01T11:56:02.143Z" },
+    { url = "https://files.pythonhosted.org/packages/30/88/707027ba09942dfa2c28759b5c222d769290a41c6d20ea60ec250801941f/pillow-12.3.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf", size = 5352509, upload-time = "2026-07-01T11:56:04.2Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6d/00352fa25332c2569cd387851f568cc5a4b75a9adbfb37ac4fbce4c02eec/pillow-12.3.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64", size = 4783167, upload-time = "2026-07-01T11:56:06.631Z" },
+    { url = "https://files.pythonhosted.org/packages/13/4f/9e049dfa21af7c22427275720e2490267ba8138120add5c4c574deb69782/pillow-12.3.0-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e", size = 6329237, upload-time = "2026-07-01T11:56:08.868Z" },
+    { url = "https://files.pythonhosted.org/packages/36/16/cf6eeaae8d0fce8dd390a33437cf68c5d5bd73834a2bc6e2f14efda0ab45/pillow-12.3.0-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777", size = 6997047, upload-time = "2026-07-01T11:56:11.379Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/69/dbf769bdd55f48bf5733cac28edc6364ffaa072ec9ba336266e4fe66be55/pillow-12.3.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1", size = 6400440, upload-time = "2026-07-01T11:56:13.908Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e1/ffc9cfc2eea0d178da8018e18e959301ad9d6bc9f3edb7181e748a474b97/pillow-12.3.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9", size = 7105895, upload-time = "2026-07-01T11:56:16.575Z" },
+    { url = "https://files.pythonhosted.org/packages/18/f0/a5595c1e8c3ae44b9828cb2f0fa8155e5095ef04d6327b8f61cf44a3df85/pillow-12.3.0-cp315-cp315t-win32.whl", hash = "sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8", size = 6474384, upload-time = "2026-07-01T11:56:18.855Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/04/62bcd9f844984c5938d3b05264a61d797a29d3e0812341a8204af70bbdee/pillow-12.3.0-cp315-cp315t-win_amd64.whl", hash = "sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418", size = 7243537, upload-time = "2026-07-01T11:56:21.214Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/68/1f3066acedf37673694a7141381d8f811ae97f30d34413d236abe7d489f1/pillow-12.3.0-cp315-cp315t-win_arm64.whl", hash = "sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59", size = 2567491, upload-time = "2026-07-01T11:56:23.506Z" },
+]
+
+[[package]]
+name = "psycopg"
+version = "3.3.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "tzdata", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/db/2f/cb91e5502ec9de1de6f1b76cfbf69531932725361168bb06963620c77e2e/psycopg-3.3.4.tar.gz", hash = "sha256:e21207764952cff81b6b8bdacad9a3939f2793367fdac2987b3aac36a651b5bc", size = 165799, upload-time = "2026-05-01T23:31:55.179Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5c/e0/7b3dee031daae7743609ce3c746565d4a3ed7c2c186479eb48e34e838c64/psycopg-3.3.4-py3-none-any.whl", hash = "sha256:b6bbc25ccf05c8fad3b061d9db2ef0909a555171b84b07f29458a447253d679a", size = 213001, upload-time = "2026-05-01T23:20:50.816Z" },
+]
+
+[package.optional-dependencies]
+binary = [
+    { name = "psycopg-binary", marker = "implementation_name != 'pypy'" },
+]
+
+[[package]]
+name = "psycopg-binary"
+version = "3.3.4"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/48/a6/828c9185701dab71b234c2a76c38a08b098ebfec5020716b4e93807492b5/psycopg_binary-3.3.4-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:28b7398fdd19db3232c884fb24550bdfe951221f510e195e233299e4c9b78f97", size = 4607292, upload-time = "2026-05-01T23:30:38.962Z" },
+    { url = "https://files.pythonhosted.org/packages/92/58/5b40dbc9d839045c9dae956960e4fb6d20bcabe6c59a2aa34fc3a371913f/psycopg_binary-3.3.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1fbaa292a3c8bb61b45df1ad3da1908ccee7cb889db9425e3557d9e34e2a4829", size = 4687023, upload-time = "2026-05-01T23:30:47.227Z" },
+    { url = "https://files.pythonhosted.org/packages/85/a9/793f0ac107a9003b48441d0d1f9f616d96e0f37458dd8dc12528ceff55fb/psycopg_binary-3.3.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:94596f9e7633ee3f6440711d43bb70aa31cc0a46a900ab8b4201a366ace5c9e7", size = 5486985, upload-time = "2026-05-01T23:30:55.517Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/26/42e8533497e2592334f68ec529cf5f840f7fa4e99575a4bb61aa184dbfbf/psycopg_binary-3.3.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8c0056529e68dbe9184cd4019a1f3d8f3a4ead2f6fc7a5afcf27d3314edd1277", size = 5168745, upload-time = "2026-05-01T23:31:01.904Z" },
+    { url = "https://files.pythonhosted.org/packages/15/af/b7151776cc08d5935d45c833ec818a9beb417cf7c08239af1aafbdae78ee/psycopg_binary-3.3.4-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2c09aad7051326e7603c14e50636db9c01f78272dc54b3accff03d46370461e6", size = 6761486, upload-time = "2026-05-01T23:31:14.511Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/ed/c92533b9124712d592cbf1cd6c76da933a2e0acea81dfe1fbe7e735f0cff/psycopg_binary-3.3.4-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:514404ed543efd620c85602b747df2a23cf1241b4067199e1a66f2d2757aaa41", size = 4997427, upload-time = "2026-05-01T23:31:20.901Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/23/ccadfd0de416aa188356daa199453af24087b042e296088706d190ae0295/psycopg_binary-3.3.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:46893c26858be12cc49ca4226ed6a60b4bfccadd946b3bebb783a60b38788228", size = 4533549, upload-time = "2026-05-01T23:31:26.204Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/a0/c8f43cee36386f7bc891ab41a9d31ea07cf9826038e732da79f26b1e5f34/psycopg_binary-3.3.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:df1d567fc430f6df15c9fcf67d87685fc49bdb325adc0db5af1adfb2f44eb5c9", size = 4210256, upload-time = "2026-05-01T23:31:33.884Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/2c/c1547871be3790676e8868b38655496422f94f0978dfb66b74bdba2f1676/psycopg_binary-3.3.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:6b9016b1714da4dd5ecaaa75b82098aa5a0b87854ce9b092e21c27c4ae23e014", size = 3946204, upload-time = "2026-05-01T23:31:39.626Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b1/f6670f00fa7ea601584623f6c11602ab92117d83eaff885e0210f6de7418/psycopg_binary-3.3.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:47c656a8a7ba6eb0cff1801a4caaa9c8bdc12d03080e273aff1c8ac39971a77e", size = 4255811, upload-time = "2026-05-01T23:31:44.986Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/e6/5fff07a70d1f945ed90ae131c3bd76cab32beff7c58c6db15ad5820b6d1f/psycopg_binary-3.3.4-cp314-cp314-win_amd64.whl", hash = "sha256:c37e024c07308cd06cf3ec51bfd0e7f6157585a4d84d1bce4a7f5f7913719bf8", size = 3666849, upload-time = "2026-05-01T23:31:51.165Z" },
+]
+
+[[package]]
+name = "pycparser"
+version = "3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
+]
+
+[[package]]
+name = "pydantic"
+version = "2.13.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-types" },
+    { name = "pydantic-core" },
+    { name = "typing-extensions" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/18/a5/b60d21ac674192f8ab0ba4e9fd860690f9b4a6e51ca5df118733b487d8d6/pydantic-2.13.4.tar.gz", hash = "sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6", size = 844775, upload-time = "2026-05-06T13:43:05.343Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fd/7b/122376b1fd3c62c1ed9dc80c931ace4844b3c55407b6fb2d199377c9736f/pydantic-2.13.4-py3-none-any.whl", hash = "sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba", size = 472262, upload-time = "2026-05-06T13:43:02.641Z" },
+]
+
+[[package]]
+name = "pydantic-core"
+version = "2.46.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9d/56/921726b776ace8d8f5db44c4ef961006580d91dc52b803c489fafd1aa249/pydantic_core-2.46.4.tar.gz", hash = "sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1", size = 471464, upload-time = "2026-05-06T13:37:06.98Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8d/74/228a26ddad29c6672b805d9fd78e8d251cd04004fa7eed0e622096cd0250/pydantic_core-2.46.4-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:428e04521a40150c85216fc8b85e8d39fece235a9cf5e383761238c7fa9b96fb", size = 2102079, upload-time = "2026-05-06T13:38:41.019Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/1f/8970b150a4b4365623ae00fc88603491f763c627311ae8031e3111356d6e/pydantic_core-2.46.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:23ace664830ee0bfe014a0c7bc248b1f7f25ed7ad103852c317624a1083af462", size = 1952179, upload-time = "2026-05-06T13:36:59.812Z" },
+    { url = "https://files.pythonhosted.org/packages/95/30/5211a831ae054928054b2f79731661087a2bc5c01e825c672b3a4a8f1b3e/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce5c1d2a8b27468f433ca974829c44060b8097eedc39933e3c206a90ee49c4a9", size = 1978926, upload-time = "2026-05-06T13:37:39.933Z" },
+    { url = "https://files.pythonhosted.org/packages/57/e9/689668733b1eb67adeef047db3c2e8788fcf65a7fd9c9e2b46b7744fe245/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7283d57845ecf5a163403eb0702dfc220cc4fbdd18919cb5ccea4f95ee1cdab4", size = 2046785, upload-time = "2026-05-06T13:38:01.995Z" },
+    { url = "https://files.pythonhosted.org/packages/60/d9/6715260422ff50a2109878fd24d948a6c3446bb2664f34ee78cd972b3acd/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8daafc69c93ee8a0204506a3b6b30f586ef54028f52aeeeb5c4cfc5184fd5914", size = 2228733, upload-time = "2026-05-06T13:40:50.371Z" },
+    { url = "https://files.pythonhosted.org/packages/18/ae/fdb2f64316afca925640f8e70bb1a564b0ec2721c1389e25b8eb4bf9a299/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cd2213145bcc2ba85884d0ac63d222fece9209678f77b9b4d76f054c561adb28", size = 2307534, upload-time = "2026-05-06T13:37:21.531Z" },
+    { url = "https://files.pythonhosted.org/packages/89/1d/8eff589b45bb8190a9d12c49cfad0f176a5cbd1534908a6b5125e2886239/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7a5f930472650a82629163023e630d160863fce524c616f4e5186e5de9d9a49b", size = 2099732, upload-time = "2026-05-06T13:39:31.942Z" },
+    { url = "https://files.pythonhosted.org/packages/06/d5/ee5a3366637fee41dee51a1fc91562dcf12ddbc68fda34e6b253da2324bb/pydantic_core-2.46.4-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:c1b3f518abeca3aa13c712fd202306e145abf59a18b094a6bafb2d2bbf59192c", size = 2129627, upload-time = "2026-05-06T13:37:25.033Z" },
+    { url = "https://files.pythonhosted.org/packages/94/33/2414be571d2c6a6c4d08be21f9292b6d3fdb08949a97b6dfe985017821db/pydantic_core-2.46.4-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:1a7dd0b3ee80d90150e3495a3a13ac34dbcbfd4f012996a6a1d8900e91b5c0fb", size = 2179141, upload-time = "2026-05-06T13:37:14.046Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/79/7daa95be995be0eecc4cf75064cb33f9bbbfe3fe0158caf2f0d4a996a5c7/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:3fb702cd90b0446a3a1c5e470bfa0dd23c0233b676a9099ddcc964fa6ca13898", size = 2184325, upload-time = "2026-05-06T13:36:53.615Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/cb/d0a382f5c0de8a222dc61c65348e0ce831b1f68e0a018450d31c2cace3a5/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_armv7l.whl", hash = "sha256:b8458003118a712e66286df6a707db01c52c0f52f7db8e4a38f0da1d3b94fc4e", size = 2323990, upload-time = "2026-05-06T13:40:29.971Z" },
+    { url = "https://files.pythonhosted.org/packages/05/db/d9ba624cc4a5aced1598e88c04fdbd8310c8a69b9d38b9a3d39ce3a61ed7/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:372429a130e469c9cd698925ce5fc50940b7a1336b0d82038e63d5bbc4edc519", size = 2369978, upload-time = "2026-05-06T13:37:23.027Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/20/d15df15ba918c423461905802bfd2981c3af0bfa0e40d05e13edbfa48bc3/pydantic_core-2.46.4-cp314-cp314-win32.whl", hash = "sha256:85bb3611ff1802f3ee7fdd7dbff26b56f343fb432d57a4728fdd49b6ef35e2f4", size = 1966354, upload-time = "2026-05-06T13:38:03.499Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/b6/6b8de4c0a7d7ab3004c439c80c5c1e0a3e8d78bbae19379b01960383d9e5/pydantic_core-2.46.4-cp314-cp314-win_amd64.whl", hash = "sha256:811ff8e9c313ab425368bcbb36e5c4ebd7108c2bbf4e4089cfbb0b01eff63fac", size = 2072238, upload-time = "2026-05-06T13:39:40.807Z" },
+    { url = "https://files.pythonhosted.org/packages/32/36/51eb763beec1f4cf59b1db243a7dcc39cbb41230f050a09b9d69faaf0a48/pydantic_core-2.46.4-cp314-cp314-win_arm64.whl", hash = "sha256:bfec22eab3c8cc2ceec0248aec886624116dc079afa027ecc8ad4a7e62010f8a", size = 2018251, upload-time = "2026-05-06T13:37:26.72Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/91/855af51d625b23aa987116a19e231d2aaef9c4a415273ddc189b79a45fee/pydantic_core-2.46.4-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:af8244b2bef6aaad6d92cda81372de7f8c8d36c9f0c3ea36e827c60e7d9467a0", size = 2099593, upload-time = "2026-05-06T13:39:47.682Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/1b/8784a54c65edb5f49f0a14d6977cf1b209bba85a4c77445b255c2de58ab3/pydantic_core-2.46.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5a4330cdbc57162e4b3aa303f588ba752257694c9c9be3e7ebb11b4aca659b5d", size = 1935226, upload-time = "2026-05-06T13:40:40.428Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/e7/1955d28d1afc56dd4b3ad7cc0cf39df1b9852964cf16e5d13912756d6d6b/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:29c61fc04a3d840155ff08e475a04809278972fe6aef51e2720554e96367e34b", size = 1974605, upload-time = "2026-05-06T13:37:32.029Z" },
+    { url = "https://files.pythonhosted.org/packages/93/e2/3fedbf0ba7a22850e6e9fd78117f1c0f10f950182344d8a6c535d468fdd8/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:c50f2528cf200c5eed56faf3f4e22fcd5f38c157a8b78576e6ba3168ec35f000", size = 2030777, upload-time = "2026-05-06T13:38:55.239Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/61/46be275fcaaba0b4f5b9669dd852267ce1ff616592dccf7a7845588df091/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0cbe8b01f948de4286c74cdd6c667aceb38f5c1e26f0693b3983d9d74887c65e", size = 2236641, upload-time = "2026-05-06T13:37:08.096Z" },
+    { url = "https://files.pythonhosted.org/packages/60/db/12e93e46a8bac9988be3c016860f83293daea8c716c029c9ace279036f2f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:617d7e2ca7dcb8c5cf6bcb8c59b8832c94b36196bbf1cbd1bfb56ed341905edd", size = 2286404, upload-time = "2026-05-06T13:40:20.221Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/4a/4d8b19008f38d31c53b8219cfedc2e3d5de5fe99d90076b7e767de29274f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7027560ee92211647d0d34e3f7cd6f50da56399d26a9c8ad0da286d3869a53f3", size = 2109219, upload-time = "2026-05-06T13:38:12.153Z" },
+    { url = "https://files.pythonhosted.org/packages/88/70/3cbc40978fefb7bb09c6708d40d4ad1a5d70fd7213c3d17f971de868ec1f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:f99626688942fb746e545232e7726926f3be91b5975f8b55327665fafda991c7", size = 2110594, upload-time = "2026-05-06T13:40:02.971Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/20/b8d36736216e29491125531685b2f9e61aa5b4b2599893f8268551da3338/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:fc3e9034a63de20e15e8ade85358bc6efc614008cab72898b4b4952bea0509ff", size = 2159542, upload-time = "2026-05-06T13:39:27.506Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/a2/367df868eb584dacf6bf82a389272406d7178e301c4ac82545ab98bc2dd9/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:97e7cf2be5c77b7d1a9713a05605d49460d02c6078d38d8bef3cbe323c548424", size = 2168146, upload-time = "2026-05-06T13:38:31.93Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/b8/4460f77f7e201893f649a29ab355dddd3beee8a97bcb1a320db414f9a06e/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_armv7l.whl", hash = "sha256:3bf92c5d0e00fefaab325a4d27828fe6b6e2a21848686b5b60d2d9eeb09d76c6", size = 2306309, upload-time = "2026-05-06T13:37:44.717Z" },
+    { url = "https://files.pythonhosted.org/packages/64/c4/be2639293acd87dc8ddbcec41a73cee9b2ebf996fe6d892a1a74e88ad3f7/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:3ecbc122d18468d06ca279dc26a8c2e2d5acb10943bb35e36ae92096dc3b5565", size = 2369736, upload-time = "2026-05-06T13:37:05.645Z" },
+    { url = "https://files.pythonhosted.org/packages/30/a6/9f9f380dbb301f67023bf8f707aaa75daadf84f7152d95c410fd7e81d994/pydantic_core-2.46.4-cp314-cp314t-win32.whl", hash = "sha256:e846ae7835bf0703ae43f534ab79a867146dadd59dc9ca5c8b53d5c8f7c9ef02", size = 1955575, upload-time = "2026-05-06T13:38:51.116Z" },
+    { url = "https://files.pythonhosted.org/packages/40/1f/f1eb9eb350e795d1af8586289746f5c5677d16043040d63710e22abc43c9/pydantic_core-2.46.4-cp314-cp314t-win_amd64.whl", hash = "sha256:2108ba5c1c1eca18030634489dc544844144ee36357f2f9f780b93e7ddbb44b5", size = 2051624, upload-time = "2026-05-06T13:38:21.672Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/d2/42dd53d0a85c27606f316d3aa5d2869c4e8470a5ed6dec30e4a1abe19192/pydantic_core-2.46.4-cp314-cp314t-win_arm64.whl", hash = "sha256:4fcbe087dbc2068af7eda3aa87634eba216dbda64d1ae73c8684b621d33f6596", size = 2017325, upload-time = "2026-05-06T13:40:52.723Z" },
+]
+
+[[package]]
+name = "pydyf"
+version = "0.12.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/36/ee/fb410c5c854b6a081a49077912a9765aeffd8e07cbb0663cfda310b01fb4/pydyf-0.12.1.tar.gz", hash = "sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095", size = 17716, upload-time = "2025-12-02T14:52:14.244Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/22/11/47efe2f66ba848a107adfd490b508f5c0cedc82127950553dca44d29e6c4/pydyf-0.12.1-py3-none-any.whl", hash = "sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc", size = 8028, upload-time = "2025-12-02T14:52:12.938Z" },
+]
+
+[[package]]
+name = "pyphen"
+version = "0.17.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/69/56/e4d7e1bd70d997713649c5ce530b2d15a5fc2245a74ca820fc2d51d89d4d/pyphen-0.17.2.tar.gz", hash = "sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3", size = 2079470, upload-time = "2025-01-20T13:18:36.296Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7b/1f/c2142d2edf833a90728e5cdeb10bdbdc094dde8dbac078cee0cf33f5e11b/pyphen-0.17.2-py3-none-any.whl", hash = "sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd", size = 2079358, upload-time = "2025-01-20T13:18:29.629Z" },
+]
+
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+
+[[package]]
+name = "python-decouple"
+version = "3.8"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/97/373dcd5844ec0ea5893e13c39a2c67e7537987ad8de3842fe078db4582fa/python-decouple-3.8.tar.gz", hash = "sha256:ba6e2657d4f376ecc46f77a3a615e058d93ba5e465c01bbe57289bfb7cce680f", size = 9612, upload-time = "2023-03-01T19:38:38.143Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a2/d4/9193206c4563ec771faf2ccf54815ca7918529fe81f6adb22ee6d0e06622/python_decouple-3.8-py3-none-any.whl", hash = "sha256:d0d45340815b25f4de59c974b855bb38d03151d81b037d9e3f463b0c9f8cbd66", size = 9947, upload-time = "2023-03-01T19:38:36.015Z" },
+]
+
+[[package]]
+name = "qrcode"
+version = "8.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8f/b2/7fc2931bfae0af02d5f53b174e9cf701adbb35f39d69c2af63d4a39f81a9/qrcode-8.2.tar.gz", hash = "sha256:35c3f2a4172b33136ab9f6b3ef1c00260dd2f66f858f24d88418a015f446506c", size = 43317, upload-time = "2025-05-01T15:44:24.726Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dd/b8/d2d6d731733f51684bbf76bf34dab3b70a9148e8f2cef2bb544fccec681a/qrcode-8.2-py3-none-any.whl", hash = "sha256:16e64e0716c14960108e85d853062c9e8bba5ca8252c0b4d0231b9df4060ff4f", size = 45986, upload-time = "2025-05-01T15:44:22.781Z" },
+]
+
+[[package]]
+name = "redis"
+version = "8.0.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cc/c3/928b290c2c0ca99ab96eea5b4ff8f30be8112b075301a7d3ba214a3c8c12/redis-8.0.1.tar.gz", hash = "sha256:afc5a7a2f5a084f5b1880dec548dd45be17db7e43c82a30d84f952aefb05cfb0", size = 5114170, upload-time = "2026-06-23T14:52:37.728Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fd/0a/c2345ebf1ebe70840ce3f6c6ee612f8fa749cfbd1b03069c53bf0c62aaad/redis-8.0.1-py3-none-any.whl", hash = "sha256:47daa35a058c23468d6437f17a8c76882cb316b838ef763036af99b96cedd743", size = 502406, upload-time = "2026-06-23T14:52:36.137Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.34.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed", size = 142856, upload-time = "2026-05-14T19:25:27.735Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0", size = 73075, upload-time = "2026-05-14T19:25:26.443Z" },
+]
+
+[[package]]
+name = "rosterchief"
+version = "0.1.0"
+source = { virtual = "." }
+dependencies = [
+    { name = "beautifulsoup4" },
+    { name = "dj-database-url" },
+    { name = "django" },
+    { name = "django-allauth", extra = ["mfa"] },
+    { name = "django-countries" },
+    { name = "django-lucide" },
+    { name = "django-ninja" },
+    { name = "django-phonenumber-field", extra = ["phonenumbers"] },
+    { name = "django-redis" },
+    { name = "django-storages", extra = ["s3"] },
+    { name = "django-waffle" },
+    { name = "gunicorn" },
+    { name = "openpyxl" },
+    { name = "pillow" },
+    { name = "psycopg", extra = ["binary"] },
+    { name = "python-dateutil" },
+    { name = "python-decouple" },
+    { name = "requests" },
+    { name = "weasyprint" },
+    { name = "whitenoise" },
+]
+
+[package.dev-dependencies]
+dev = [
+    { name = "coverage" },
+    { name = "django-browser-reload" },
+    { name = "ruff" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "beautifulsoup4", specifier = ">=4.15.0" },
+    { name = "dj-database-url", specifier = ">=3.1.2" },
+    { name = "django", specifier = ">=6.0.6" },
+    { name = "django-allauth", extras = ["mfa"], specifier = ">=65.18.0" },
+    { name = "django-countries", specifier = ">=9.0.0" },
+    { name = "django-lucide", git = "https://github.com/bsiebens/lucide" },
+    { name = "django-ninja", specifier = ">=1.6.2" },
+    { name = "django-phonenumber-field", extras = ["phonenumbers"], specifier = ">=8.4.0" },
+    { name = "django-redis", specifier = ">=7.0.0" },
+    { name = "django-storages", extras = ["s3"], specifier = ">=1.14.6" },
+    { name = "django-waffle", specifier = ">=5.0.0" },
+    { name = "gunicorn", specifier = ">=26.0.0" },
+    { name = "openpyxl", specifier = ">=3.1.5" },
+    { name = "pillow", specifier = ">=12.3.0" },
+    { name = "psycopg", extras = ["binary"], specifier = ">=3.3.4" },
+    { name = "python-dateutil", specifier = ">=2.9.0.post0" },
+    { name = "python-decouple", specifier = ">=3.8" },
+    { name = "requests", specifier = ">=2.34.2" },
+    { name = "weasyprint", specifier = ">=69.0" },
+    { name = "whitenoise", specifier = ">=6.12.0" },
+]
+
+[package.metadata.requires-dev]
+dev = [
+    { name = "coverage", specifier = ">=7.15.0" },
+    { name = "django-browser-reload", specifier = ">=1.21.0" },
+    { name = "ruff", specifier = ">=0.15.17" },
+]
+
 [[package]]
 name = "ruff"
 version = "0.15.17"
@@ -69,6 +890,36 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2d/c7/c53e8dbff9c9dc4b7928773421ae294a5d28fcb8dcda1a089579d3a7e510/ruff-0.15.17-py3-none-win_arm64.whl", hash = "sha256:f3be1fbb34bcdfd146240d8fb92a709d4c2c8191348580a3c044ec60fa0b4456", size = 11355275, upload-time = "2026-06-11T17:54:43.635Z" },
 ]
 
+[[package]]
+name = "s3transfer"
+version = "0.19.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "botocore" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/65/da/4bef7ce7bb989b222aa4785a413896dbec53306dfc59c6ce7d16a7ffbd6a/s3transfer-0.19.1.tar.gz", hash = "sha256:d3d6371dc3f1e5c5427b2b457bcf13bcf87bec334c95aed18642eae61f6926f3", size = 165354, upload-time = "2026-07-10T19:32:04.849Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/24/23/e84c64ad0e8bc59cd1b2ef98def848deff0ef3456c542afe74d51e9e8c85/s3transfer-0.19.1-py3-none-any.whl", hash = "sha256:d5fd7005ee39307455ad5f310b5ea67f4b1960d7fed5b3671ee50c249de675de", size = 90072, upload-time = "2026-07-10T19:32:03.673Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
+[[package]]
+name = "soupsieve"
+version = "2.9.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d9/38/e12680bbe6b4f8f3d17adcaf38d26850aa756c85cf4a80e79fc12a018fe8/soupsieve-2.9.1.tar.gz", hash = "sha256:c33e6605bbc71dd628b00c632d58ae607c22bade247e52553928f83bbb75b4ba", size = 122261, upload-time = "2026-07-21T16:57:17.452Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0f/2c/437fe806897c2d6cfdc3ee43a18da8bf8e568530a4ae9bac781541ca9896/soupsieve-2.9.1-py3-none-any.whl", hash = "sha256:4f4477399246b7a0c720a88ca2454b11cd6bb9ae4c9d170140786e916776c14c", size = 37404, upload-time = "2026-07-21T16:57:16.421Z" },
+]
+
 [[package]]
 name = "sqlparse"
 version = "0.5.5"
@@ -78,6 +929,51 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
 ]
 
+[[package]]
+name = "tinycss2"
+version = "1.5.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "webencodings" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a3/ae/2ca4913e5c0f09781d75482874c3a95db9105462a92ddd303c7d285d3df2/tinycss2-1.5.1.tar.gz", hash = "sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957", size = 88195, upload-time = "2025-11-23T10:29:10.082Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/60/45/c7b5c3168458db837e8ceab06dc77824e18202679d0463f0e8f002143a97/tinycss2-1.5.1-py3-none-any.whl", hash = "sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661", size = 28404, upload-time = "2025-11-23T10:29:08.676Z" },
+]
+
+[[package]]
+name = "tinyhtml5"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "webencodings" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/1f/cfe2f6b30557c92b3f31d41707e09cef5c1efbd87392bc6c0430c46b0e4d/tinyhtml5-2.1.0.tar.gz", hash = "sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67", size = 179242, upload-time = "2026-03-05T17:06:30.704Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/52/48/01695a036b695f83fea7aef6955d735db0f517b1c8e25ddb399ac0bdbcbf/tinyhtml5-2.1.0-py3-none-any.whl", hash = "sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a", size = 39686, upload-time = "2026-03-05T17:06:28.498Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/cc/6253133b5bb138fc3306cebfbda2c520f545d36b5be2c7255cc528bb45d6/typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5", size = 113555, upload-time = "2026-07-02T08:40:05.92Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/49/d3/b8441a820a491ddfc024b0b0cf0393375b75ea13866d9c66727e54c2fc80/typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8", size = 45571, upload-time = "2026-07-02T08:40:04.659Z" },
+]
+
+[[package]]
+name = "typing-inspection"
+version = "0.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/55/e3/70399cb7dd41c10ac53367ae42139cf4b1ca5f36bb3dc6c9d33acdb43655/typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464", size = 75949, upload-time = "2025-10-01T02:14:41.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/9b/47798a6c91d8bdb567fe2698fe81e0c6b7cb7ef4d13da4114b41d239f65d/typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7", size = 14611, upload-time = "2025-10-01T02:14:40.154Z" },
+]
+
 [[package]]
 name = "tzdata"
 version = "2026.2"
@@ -86,3 +982,65 @@ sdist = { url = "https://files.pythonhosted.org/packages/ba/19/1b9b0e29f30c6d35c
 wheels = [
     { url = "https://files.pythonhosted.org/packages/ce/e4/dccd7f47c4b64213ac01ef921a1337ee6e30e8c6466046018326977efd95/tzdata-2026.2-py2.py3-none-any.whl", hash = "sha256:bbe9af844f658da81a5f95019480da3a89415801f6cc966806612cc7169bffe7", size = 349321, upload-time = "2026-04-24T15:22:05.876Z" },
 ]
+
+[[package]]
+name = "urllib3"
+version = "2.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+]
+
+[[package]]
+name = "weasyprint"
+version = "69.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi" },
+    { name = "cssselect2" },
+    { name = "fonttools", extra = ["woff"] },
+    { name = "pillow" },
+    { name = "pydyf" },
+    { name = "pyphen" },
+    { name = "tinycss2" },
+    { name = "tinyhtml5" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/59/53/dcc3885c2f7a47faa45f6b8b801412f5f9e055173a52801ef01c09943c5a/weasyprint-69.0.tar.gz", hash = "sha256:a7a32f39ca16bd82ef11de99c92ea4b5f14951c9033af035e451ce4f4ee0a88c", size = 1549834, upload-time = "2026-06-02T14:42:17.765Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/93/cb/208525c6bd5033d7b2589b55e07bec23d9c61bb00703cbaf20ef52c3811f/weasyprint-69.0-py3-none-any.whl", hash = "sha256:475951cfd917014de6d4d005caff48c6aa867e7e42b80cd5b16a0484a1609ee6", size = 322872, upload-time = "2026-06-02T14:42:15.871Z" },
+]
+
+[[package]]
+name = "webencodings"
+version = "0.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/0b/02/ae6ceac1baeda530866a85075641cec12989bd8d31af6d5ab4a3e8c92f47/webencodings-0.5.1.tar.gz", hash = "sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923", size = 9721, upload-time = "2017-04-05T20:21:34.189Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/24/2a3e3df732393fed8b3ebf2ec078f05546de641fe1b667ee316ec1dcf3b7/webencodings-0.5.1-py2.py3-none-any.whl", hash = "sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78", size = 11774, upload-time = "2017-04-05T20:21:32.581Z" },
+]
+
+[[package]]
+name = "whitenoise"
+version = "6.12.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cb/2a/55b3f3a4ec326cd077c1c3defeee656b9298372a69229134d930151acd01/whitenoise-6.12.0.tar.gz", hash = "sha256:f723ebb76a112e98816ff80fcea0a6c9b8ecde835f8ddda25df7a30a3c2db6ad", size = 26841, upload-time = "2026-02-27T00:05:42.028Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/db/eb/d5583a11486211f3ebd4b385545ae787f32363d453c19fffd81106c9c138/whitenoise-6.12.0-py3-none-any.whl", hash = "sha256:fc5e8c572e33ebf24795b47b6a7da8da3c00cff2349f5b04c02f28d0cc5a3cc2", size = 20302, upload-time = "2026-02-27T00:05:40.086Z" },
+]
+
+[[package]]
+name = "zopfli"
+version = "0.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/74/21/3b6af43a663b22b00e738bb0642931a2579e15da6852613d56c6aa535d28/zopfli-0.4.3.tar.gz", hash = "sha256:d3a50f91a13cea9bafe025de8fd87a005eb26de02a4f0c193127ddbf23ac8ebe", size = 179156, upload-time = "2026-06-10T09:10:19.96Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a5/5f/b7d81b670daf990e15a0f7551da96c3c0700f69ae6d96b0245d6a19f51f3/zopfli-0.4.3-cp310-abi3-macosx_10_9_universal2.whl", hash = "sha256:88f4fbe429aad72bc206275d81fab11a097e0f951a5848d1f51083c37ea73073", size = 291492, upload-time = "2026-06-10T09:10:06.621Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c8/d8d8d731e0b192024567b7198fb77b748821d355f3c8bf0109de27191f43/zopfli-0.4.3-cp310-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:769875152d0625c46707bcca57d4b2233fe653482067acd55fbf6ec525cb9bdc", size = 829354, upload-time = "2026-06-10T09:10:07.909Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/2b/fbe8ba2ec40f5986b8983a4752f7a32672a80a10ea6e68213324a7055469/zopfli-0.4.3-cp310-abi3-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eb0c9c1d40a8cb1d58762d7e57290ccb753e0828c4d01be8acb59aae5d0ca206", size = 818436, upload-time = "2026-06-10T09:10:09.063Z" },
+    { url = "https://files.pythonhosted.org/packages/de/d9/63568c54c8b68b9135f3456c5add83797a5528d596657f0e4f4910173b08/zopfli-0.4.3-cp310-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7fa3c35193475290e3f007bbcdebdbae64ba2f012d75c632da0d727e1da50d5e", size = 1778931, upload-time = "2026-06-10T09:10:10.282Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/05/8f3aac10a858e89c2146d3a1f6ce33634c3db757365b4148fef1b85784d2/zopfli-0.4.3-cp310-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:47604eee5c6704bdf0e94d8391fe3b74ddb2abd84128fbcfdc3ee0fc265feaef", size = 1864132, upload-time = "2026-06-10T09:10:11.595Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/20/9ca59d14b91f9fbc631793b4b085b309777edadaca496aa518a180817827/zopfli-0.4.3-cp310-abi3-win32.whl", hash = "sha256:628c3e941752880b3491db8d44163d0aedb221944e22a17187ff7fc549b050f6", size = 271715, upload-time = "2026-06-10T09:10:12.7Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/3a/4ff4fdead77ef30f5832b38a47eb7a1283e98b3c678576b83f8fdfff53eb/zopfli-0.4.3-cp310-abi3-win_amd64.whl", hash = "sha256:921c2c9907f4364963848da5ad194b46d68865e07fdb975d04fd09bc42d47357", size = 288550, upload-time = "2026-06-10T09:10:13.639Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/44/6264f929057236fde72dd6d271f54612b4811ce37288e002f5d5339d696a/zopfli-0.4.3-cp310-abi3-win_arm64.whl", hash = "sha256:7e9703ca6e7ef66c8d05e0826b6f558b680c9db8206f84f05a3ee93430a12e42", size = 451343, upload-time = "2026-06-10T09:10:14.72Z" },
+]