Rework Teams/Positions access control and add full Locations/Opponents CRUD

Team managers/coaches now only see their own teams, can't create teams,
and can view (but not edit) positions -- admins keep full rights.
Locations and Opponents move from read-only stubs to full CRUD, gated
to admins and management-position staff, with a country dropdown
(django-countries) instead of free text. Also: the team list shows
player/staff counts, and deleting a news item's main photo promotes
another one instead of leaving the item without one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R1gj3J1QPfP38XWpnpbFpy

management/urls.py

@@ -62,7 +62,13 @@ urlpatterns = [
     path("events/", views.EventListView.as_view(), name="event_list"),
     path("event-series/", views.EventSeriesListView.as_view(), name="event_series_list"),
     path("locations/", views.LocationListView.as_view(), name="location_list"),
+    path("locations/new/", views.LocationCreateView.as_view(), name="location_create"),
+    path("locations/<uuid:pk>/edit/", views.LocationUpdateView.as_view(), name="location_update"),
+    path("locations/<uuid:pk>/delete/", views.LocationDeleteView.as_view(), name="location_delete"),
     path("opponents/", views.OpponentListView.as_view(), name="opponent_list"),
+    path("opponents/new/", views.OpponentCreateView.as_view(), name="opponent_create"),
+    path("opponents/<uuid:pk>/edit/", views.OpponentUpdateView.as_view(), name="opponent_update"),
+    path("opponents/<uuid:pk>/delete/", views.OpponentDeleteView.as_view(), name="opponent_delete"),
     # Shop (admin only)
     path("shop/products/", views.ProductListView.as_view(), name="product_list"),
     path("shop/orders/", views.OrderListView.as_view(), name="order_list"),