Add billing-ending banner, events CRUD, RBIHF import, public API, team photos, and sponsors

A large batch of club-management features built up over one session:

- Club dashboard banner warning admins 1 month before billing ends
- Full Events/EventSeries CRUD (recurrence builder, occurrence lifecycle,
  per-team permissions), with match->game rename and game-specific fields
  (score, competition, live status, external game ID)
- Django-admin competition dropdown, gated per-club by feature flag
- Auto-import of RBIHF fixtures (scrape -> diff -> preview -> confirm),
  with location/opponent dropdowns suggested from existing club data
- Feature-flag-gated Shop/Forms nav sections, reusing the same flag
  machinery for the RBIHF import button
- Team roster now scoped to members active this season or next, sorted and
  grouped by position
- Club sport type (ice hockey / other), shown in the control panel's club
  subtitle
- Per-season team photo upload from the team page
- New public read-only API (Django Ninja) at /api/v1/: news, team rosters,
  upcoming/live/per-team games, and sponsors -- auto-documented via Swagger
  UI, CORS-enabled for a club's own external website
- Club sponsors: admin-only CRUD (logo, URL, active date window) plus a
  date-windowed, optionally randomized API endpoint
- Assorted fixes: NullBooleanField dropdown rendering, cross-club event
  validation timing, searchable-select chip placement, btn-neutral ->
  default button style sweep, calendar-month chart windows

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R1gj3J1QPfP38XWpnpbFpy

club/api.py

@@ -0,0 +1,58 @@
+"""Public read-only sponsors endpoint -- see api/urls.py for how this is
+mounted.
+"""
+
+import random
+import uuid
+from datetime import date
+
+from django.db.models import Q
+from django.utils import timezone
+from ninja import Router, Schema
+
+from api.errors import require_club
+
+from .models import Sponsor
+
+router = Router(tags=["sponsors"])
+
+
+class SponsorOut(Schema):
+    id: uuid.UUID
+    name: str
+    logo_url: str | None
+    url: str | None
+    start_date: date
+    end_date: date | None
+
+
+def _to_sponsor_out(sponsor, request) -> SponsorOut:
+    return SponsorOut(
+        id=sponsor.pk,
+        name=sponsor.name,
+        logo_url=request.build_absolute_uri(sponsor.logo.url) if sponsor.logo else None,
+        url=sponsor.url or None,
+        start_date=sponsor.start_date,
+        end_date=sponsor.end_date,
+    )
+
+
+@router.get("/", response=list[SponsorOut], summary="Active sponsors")
+def list_sponsors(request, randomize: bool = False):
+    """Sponsors currently "live": start_date has passed and either there's no
+    end_date (runs indefinitely once started) or it hasn't passed yet. Both
+    bounds are inclusive of today.
+
+    `randomize=true` shuffles the result (e.g. for a sponsor strip that
+    shouldn't always lead with the same one) -- shuffled in Python after a
+    stable-ordered fetch rather than an ORDER BY RANDOM(), which sponsor
+    counts are far too small to need and which SQLite/Postgres don't even
+    express the same way."""
+    club = require_club(request)
+    today = timezone.localdate()
+
+    sponsors = list(Sponsor.objects.filter(club=club, start_date__lte=today).filter(Q(end_date__isnull=True) | Q(end_date__gte=today)).order_by("name"))
+    if randomize:
+        random.shuffle(sponsors)
+
+    return [_to_sponsor_out(sponsor, request) for sponsor in sponsors]