feat(club): ClubRole, RBAC access service and role sync

Add ClubRole (ADMIN / MEMBER / EDITOR, one per member per club) and complete
club/services/access.py — the single module all authorisation routes through:

- teams_managed_by / can_edit_event  -> authority: a *management* StaffAssignment
  in the *current season*; ADMIN overrides club-wide. A StaffAssignment is
  per-season, so a former coach's authority expires with it.
- teams_staffed_by -> visibility: *any* staff position, so support staff (physio,
  kit manager) can see the roster they work with without gaining authority.
- members_visible_to -> ADMIN sees everyone linked to the club; otherwise self +
  children (family graph) + the current-season players and staff of the teams
  they're staffed on.
- can_edit_event -> ADMIN/EDITOR, the event's owner, or a manager of one of its
  teams for that event's season.
- can_manage_shop -> ADMIN.

Fix roles_in_club, which called .unique() — not a QuerySet method, so it would
have raised AttributeError on first use.

Keep ClubRole in sync with membership status: an active ClubMembership grants
the MEMBER role and losing it withdraws that role — but an elevated role
(ADMIN/EDITOR) is never downgraded or removed, so a lapsed membership or a
season rollover can never lock an admin out.

Validate ClubMembership.season against the membership's club.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

club/models.py

@@ -4,7 +4,7 @@ from django.db import models
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 
-from clubmanager.base import ClubScopedModel, UUIDModel, unique_slugify
+from clubmanager.base import ClubScopedModel, UUIDModel, unique_slugify, validate_club_scope
 from members.models import Member
 
 
@@ -102,3 +102,27 @@ class ClubMembership(ClubScopedModel):
 
     def __str__(self):
         return f"{self.club} - {self.member}"
+
+    def clean(self):
+        validate_club_scope(self, self.club_id, same_club_fields=("season",))
+
+
+class ClubRole(ClubScopedModel):
+    class Roles(models.TextChoices):
+        ADMIN = "admin", _("admin")
+        MEMBER = "member", _("member")
+        EDITOR = "editor", _("editor")
+
+    member = models.ForeignKey(Member, on_delete=models.CASCADE, related_name="roles", verbose_name=_("member"))
+    role = models.CharField(_("role"), max_length=250, choices=Roles.choices, default=Roles.MEMBER)
+
+    class Meta:
+        verbose_name = _("club role")
+        verbose_name_plural = _("club roles")
+        ordering = ["club", "member__last_name", "member__first_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["club", "member"], name="unique_member_per_club"),
+        ]
+
+    def __str__(self):
+        return f"{self.club} - {self.member}"