Add plan deletion, with a confirmation screen listing affected clubs

Due.plan is PROTECT -- a plan that has ever billed anyone can never
truly be removed, on purpose: amount/period_end/grace_until are
frozen on a Due precisely so a later change can't rewrite what was
actually charged, and losing the plan link off an old Due would do
exactly that to every historical invoice.

"Delete" therefore means one of two things, chosen automatically
(billing/services/plans.py):
- never billed anyone -> the row is removed outright.
- has billing history -> soft-deleted (Plan.deleted_at, is_active
  off): hidden from every picker/listing via the new opt-in
  Plan.objects.visible(), but the row survives so old invoices still
  show what they were billed under.

Either way, every club currently on the plan is unsubscribed outright
-- its Subscription row deleted, not just its plan field cleared.
"No plan" was already a fully-understood state everywhere else in the
app, so this reuses it instead of inventing a new one.

Also handles the easy-to-miss second group: a club on a DIFFERENT
plan, mid-trial, configured to convert to the plan being deleted
(Subscription.post_trial_plan). Left alone that would try to convert
onto a hidden/gone plan later; instead that club's trial is ended now
(both trial fields cleared, per the CheckConstraint requiring them
together) so it needs a new plan picked by hand.

The confirmation screen is a real page, not a modal like every other
billing action -- naming exactly which clubs are affected, in both
groups, and that list can be long.

ARCHITECTURE.md

@@ -319,7 +319,10 @@ tenant-scoped manager would be exactly the wrong default.
 thing to get wrong: `duration_months` (period length, from its start), `renewal_lead_days` (how far
 *before* a period starts its invoice is raised), `grace_days` (how long *after* a period starts it
 may stay unpaid). Two `CheckConstraint`s keep them coherent. `is_trial` marks a plan offered as a
-trial; a trial's length is simply its own `duration_months`.
+trial; a trial's length is simply its own `duration_months`. `deleted_at` is a soft-delete marker:
+`Due.plan` is `PROTECT`, so a plan that has ever billed anyone can't really be removed — "delete"
+hides it (`Plan.objects.visible()` excludes it) and unsubscribes every club currently on it instead;
+see `billing/services/plans.py` and `BILLING.md` §11.
 
 **`PlanPrice`** — a dated price (`active_from`). A rate change is a new row, never an edit, so
 every period already opened keeps what it was billed at.