Add the disabled Founder Portal Club Rides scaffold aligned with the live GroupRide.clubId domain.
Keep production discovery and actions disabled until a privacy-preserving read path and real management destinations are implemented.
- Gate ranks-roles management route on canManageSettings with safe
unauthorized state, matching sibling founder-management routes
- Enforce HTTPS image URL invariant for club logo/banner in the data
layer (validateClubImageUrl) and in Firestore rules, preserving
null/empty clearing