Add optional immutable Club affiliation, authorized Club Owner/Admin ride planning, privacy-preserving point access, and narrowly scoped Club admin ride controls.
Club-wide ride discovery remains deferred pending a privacy-preserving architecture.
- Gate ranks-roles management route on canManageSettings with safe
unauthorized state, matching sibling founder-management routes
- Enforce HTTPS image URL invariant for club logo/banner in the data
layer (validateClubImageUrl) and in Firestore rules, preserving
null/empty clearing