Checkpoint: management app redesign, onboarding/signup workflow, and events calendar backend

Large uncommitted body of work accumulated across sessions on this branch --
committing as a checkpoint so it's tracked and future worktree-isolated agents
see the real codebase instead of a stale ancestor commit. Covers the
management app's dedicated Tailwind theme and templates, the club onboarding
requirement/signup workflow (club/services/onboarding.py, requirement/status
models, sign-up dashboard), fee/status auto-activation decoupling, referee
management, and the new events calendar grid service layer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ECGMEwrc2k4D8VQuwjstj9

authentication/middleware.py

@@ -1,8 +1,8 @@
 """Force MFA enrolment for privileged users.
 
 Anyone who can change other people's data must have a second factor: Django
-staff/superusers, and anyone holding an elevated ``ClubRole`` (ADMIN or EDITOR)
-in *any* club. Regular members may enrol, but aren't forced to.
+staff/superusers, and anyone holding an elevated ``ClubRole`` (ADMIN, EDITOR, or
+MEMBER_ADMIN) in *any* club. Regular members may enrol, but aren't forced to.
 
 Enrolled users are challenged for their second factor by allauth at login; this
 middleware only handles the other half — a privileged user who has never
@@ -21,7 +21,7 @@ from club.models import ClubRole
 #: under DEBUG — without it, live reload dies on the enrolment page itself.
 EXEMPT_PREFIXES = ("/accounts/", "/static/", "/media/", "/__reload__/")
 
-ELEVATED_ROLES = (ClubRole.Roles.ADMIN, ClubRole.Roles.EDITOR)
+ELEVATED_ROLES = (ClubRole.Roles.ADMIN, ClubRole.Roles.EDITOR, ClubRole.Roles.MEMBER_ADMIN)
 
 
 def mfa_required_for(user) -> bool: