feat(web): add private club showcases with membership flow (v3.7.0)

Implements Issue #110: game masters can now publish sessions
exclusively to a club's private showcase, gated behind a
member application and approval flow. Adds a 4-state
publication_mode (None/Catalog/ClubOnly/Both) replacing the
binary is_public, plus a club_memberships table with
Pending/Active/Rejected/Left lifecycle and partial unique
index ensuring a single Active row per (group, player).

Highlights
- V030 migration: club_memberships, publication_mode, drop
  is_public, recreate partial indexes, portfolio_games gains
  publication_mode.
- PublicationMode enum + extensions in GmRelay.Shared.
- ISessionStore gains 12 membership/showcase methods;
  AuthorizedMembershipService owns the membership flow with
  GM-only approve/reject authorization.
- PublicClub / PublicMasterProfile / PublicSession: member-
  aware queries (ClubOnly visible only to Active members).
- New pages: MyClubMemberships (/profile/memberships) and
  ClubApplications (/group/{id}/applications).
- GroupDetails and EditSession switch from a bool toggle to
  a 4-state publication_mode selector.
- NavMenu adds Moji kluby, PublicLayout adds Kluby.

Tests: 4 new test files (PublicationMode, ClubMemberships,
AuthorizedMembershipService, ClubShowcaseSource) + updates
to PublicClubPages, AuthorizedSessionService/Portfolio
service FakeSessionStore, CampaignTemplatesNavigation.
493 tests pass.

Bump version 3.6.0 -> 3.7.0 across Directory.Build.props,
compose.yaml, deploy.yml, NavMenu.razor.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/GmRelay.Web/Services/AuthorizedSessionService.cs

@@ -136,7 +136,7 @@ public sealed class AuthorizedSessionService(ISessionStore sessionStore, IHttpCo
             normalizedBio);
     }
 
-    public async Task SetSessionPublicForCurrentUserAsync(Guid sessionId, bool isPublic)
+    public async Task SetSessionPublicationModeForCurrentUserAsync(Guid sessionId, PublicationMode mode)
     {
         var identity = GetCurrentIdentity();
         if (identity is null)
@@ -148,10 +148,10 @@ public sealed class AuthorizedSessionService(ISessionStore sessionStore, IHttpCo
             throw new SessionAccessDeniedException(sessionId, identity.Value.ExternalUserId);
         }
 
-        await sessionStore.SetSessionPublicAsync(sessionId, session.GroupId, isPublic);
+        await sessionStore.SetSessionPublicationModeAsync(sessionId, session.GroupId, mode);
     }
 
-    public async Task SetBatchPublicForCurrentUserAsync(Guid batchId, bool isPublic)
+    public async Task SetBatchPublicationModeForCurrentUserAsync(Guid batchId, PublicationMode mode)
     {
         var identity = GetCurrentIdentity();
         if (identity is null)
@@ -163,7 +163,20 @@ public sealed class AuthorizedSessionService(ISessionStore sessionStore, IHttpCo
             throw new SessionAccessDeniedException(batchId, identity.Value.ExternalUserId);
         }
 
-        await sessionStore.SetBatchPublicAsync(batchId, batch.GroupId, isPublic);
+        await sessionStore.SetBatchPublicationModeAsync(batchId, batch.GroupId, mode);
+    }
+
+    public async Task<bool> IsActiveClubMemberForCurrentUserAsync(Guid groupId)
+    {
+        var identity = GetCurrentIdentity();
+        if (identity is null)
+            return false;
+
+        var playerId = await sessionStore.GetPlayerIdByPlatformIdentityAsync(identity.Value.Platform, identity.Value.ExternalUserId);
+        if (playerId is null)
+            return false;
+
+        return await sessionStore.IsActiveClubMemberAsync(groupId, playerId.Value);
     }
 
     public async Task<WebSession?> GetSessionForCurrentUserAsync(Guid sessionId)