Feat/manage submissions

[sabinem]

Manage Submissions: see where every team stands

The story

As the organizer of a hackathon, I want to see at a glance which teams
have handed in their work, which only have drafts, and which have nothing yet,
so that I can chase the right teams before the deadline and know what goes
into judging.

Until now there was no way to answer that. The Submissions page shows a
participant their own team's work and nothing else, so an organizer had to ask
every team, or someone had to look in the database.

What you get

A Manage Submissions page in the organizer sidebar, right after Manage Teams
(and as a tile on Settings). It lists every team with:

• its standing — No submission, Draft only or Final — with the teams
  still owing an entry first, then by name;
• its project and members;
• the link or notes of the version that counts, who submitted and finalized it
  and when, a newer draft that has not been finalized, and earlier versions
  folded away.

On top of the list:

• Tabs filter by standing, with a count each. No submission and Draft
  only turn into a warning when they are not zero.
• A search finds a team by its name, its project or a member. While
  searching, the tab counts count the matches, and a tab with none links to the
  tabs that have some — so a person is never "not found" just because their team
  is on another tab. Nothing switches tabs on its own.
• A banner says whether submissions are open, and links to the switch in
  Settings.
• Download CSV saves every team as <hackathon-name>-submissions.csv:

Team,Project,Members,Standing,Version,Submitted (UTC),Submitted By,Finalized (UTC),Finalized By,Newer Draft,Result
Byte Me,Flood maps,"Alice, Bob",Final,3,2026-08-01 10:05,Bob,2026-08-02 09:00,Alice,,https://github.com/byte-me/floods

The decisions behind it, and why

Read only. The backend lets an owner read every submission
(rbac.go:238), but creating and finalizing need submission:write scoped to
the team, which only Member holds. Casbin has no role inheritance, so an owner
cannot finalize for a team, and the page does not pretend otherwise.

No backend change — at the cost of one call per team. TeamService.List
returns teams without their submissions, and ListSubmissions takes one team.
So the page calls List, then ListSubmissions for every team in parallel.
Fine at tens of teams; the single call it should become is asked for in a
backend ticket, and the one function to change carries
TODO(backend: submissions-hackathon-list).

The tab is applied in the browser. The page loads every team once and reads
?standing= on the client. That is what lets a search see every tab, and it
means switching tabs re-runs nothing on the server — otherwise every tab click
would repeat a ListSubmissions per team. The ?standing= link still works for
bookmarks and the back button.

The CSV is the whole hackathon, whatever tab or search is on screen — the
same rule the project and participant exports follow. The Standing column
keeps the three apart. Times are UTC and say so: the file is built on the
server, which does not know the reader's time zone.

"Final" stays final under a newer draft. A team can create a draft after
finalizing. That draft does not count unless it is finalized too, so the team
stays Final and the draft is shown as a note — the same rule the participant
page already follows.

No count on the Settings tile. The Settings page deliberately makes no
TeamService.List call, and a submission count would need one.

Testing

• Unit tests for a team's standing, the sort order, the "Unknown project"
  fallback, member names, the tab filter and its counts, the sidebar entry and
  which entry lights up, and the CSV layout (blank columns for a team with
  nothing, quotes and line breaks in notes, UTC times).
• treefmt clean, lint passes, all 733 unit tests pass. svelte-check reports
  nothing in the touched files (4 pre-existing errors elsewhere, unchanged from
  main).
• Seeded data confirmed over gRPC as alice: AI Innovation Challenge has 3
  teams and 2 submissions, Internal Product Sprint 2 teams and 3 submissions,
  Data for Good 8 teams and none, Partner Data Sprint no teams.

Follow-ups, not in this PR

• One call instead of one per team — the backend ticket above.
• Should an organizer be able to finalize for a team? For example a team
  that forgot before the deadline. Today the backend does not allow it; whether
  it should is a product decision, not a bug.