feat(permissions): hosting keys, and club accounts limited to their own team and registrants

New keys: tournaments.stages, .forms, .registrations, .teams, .arbiter,
.prizes, .exports, sponsors.*, organizations.import, organizations.dashboard.
Admin gains sponsors.* (tournaments.* and organizations.* cover the rest).
Tournament organizers run their own events but not prize release.

Club accounts (org_admin, org_manager) get teams, registrations and their own
dashboard, plus the <module>.own keys OrgScope needs to admit them to those
modules; it still refuses them the form builder, console, prizes, exports,
sponsors, club import and other clubs' dashboards (checked: 403).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/permissions.php

@@ -13,6 +13,23 @@
  * Granular actions:
  *   list, show, create, update, delete, ban, unban, start, complete,
  *   approve, reject, verify, export, own
+ *
+ * Big-tournament hosting (El3ab docs/tournament-hosting-contract.md). Each new
+ * controller action calls Auth::requirePermission() with its key:
+ *   tournaments.stages         stages, cut review, schedule, bracket actions
+ *   tournaments.forms          registration form builder
+ *   tournaments.registrations  registrations, check-in desk, seeds
+ *   tournaments.teams          teams and lineups
+ *   tournaments.arbiter        arbiter console, disputes, fair play, report
+ *   tournaments.prizes         prize categories, hold and release
+ *   tournaments.exports        TRF, PGN, CSV and XLSX exports
+ *   sponsors.*                 the sponsor library
+ *   organizations.import       club CSV import
+ *   organizations.dashboard    an org's dashboard
+ * OrgScope admits an org-scoped account (org_id set) to a module only when its
+ * role lists a key named after that module, so the club roles also carry
+ * "<module>.own": inside those modules a club account sees and edits only its
+ * own club's rows (teams, lineups, registrants).
  */
 
 return [
@@ -56,6 +73,7 @@ return [
         'org-announcements.*',
         'redeem-codes.*',
         'game-content.*',
+        'sponsors.*',
     ],
 
     // ─── Moderation focused ──────────────────────────────────────────────
@@ -115,6 +133,13 @@ return [
         'org-media.*',
         'org-spotlights.*',
         'org-announcements.*',
+        // Hosting: a club manages its own team, lineups and registrants only.
+        'tournaments.teams',
+        'tournaments.registrations',
+        'organizations.dashboard',
+        'tournament-teams.own',
+        'tournament-registrations.own',
+        'org-dashboard.own',
     ],
 
     // ─── Org manager: like org_admin without delete & member write ───────
@@ -163,6 +188,13 @@ return [
         'org-spotlights.list',
         'org-announcements.list',
         'org-announcements.create',
+        // Hosting: a club manages its own team, lineups and registrants only.
+        'tournaments.teams',
+        'tournaments.registrations',
+        'organizations.dashboard',
+        'tournament-teams.own',
+        'tournament-registrations.own',
+        'org-dashboard.own',
     ],
 
     // ─── Tournament organizer: manages own tournaments ───────────────────
@@ -178,6 +210,18 @@ return [
         'players.list',
         'players.show',
         'analytics.own',
+        // Hosting: runs its own events end to end; prizes stay with platform staff.
+        'tournaments.stages',
+        'tournaments.forms',
+        'tournaments.registrations',
+        'tournaments.teams',
+        'tournaments.arbiter',
+        'tournaments.exports',
+        'tournament-forms.own',
+        'tournament-registrations.own',
+        'tournament-teams.own',
+        'tournament-arbiter.own',
+        'tournament-exports.own',
     ],
 
     // ─── Sponsor: manages own ads & campaigns ────────────────────────────