- Gate ranks-roles management route on canManageSettings with safe
unauthorized state, matching sibling founder-management routes
- Enforce HTTPS image URL invariant for club logo/banner in the data
layer (validateClubImageUrl) and in Firestore rules, preserving
null/empty clearing