feat(admission): add scheduled group access

design/us-012-admin-operations.md

@@ -21,8 +21,9 @@ As an administrator, I want operational settings and audit visibility, so that I
 - [x] Event views show type, subject, IP, classification, and approximate location when available.
 - [x] Admin console access itself creates an audit event with the SSO identity.
 - [x] Settings, users, and events are linked from the shared admin navigation.
-- [x] Administrators can independently configure registration-required, group-access-disabled, and VPN/proxy/Tor-denied game messages.
-- [x] Every message is validated server-side and has a safe default.
+- [x] Administrators can independently configure registration-required, group-access-disabled, schedule-denied, and VPN/proxy/Tor-denied game-message templates.
+- [x] Registration, group, and network templates accept only `{player}` and `{group}`; schedule templates also accept `{next_start}` and `{next_end}`.
+- [x] Every template is validated server-side and has a safe default.
 - [x] Admission-message changes are audited with the administrator identity without logging credentials.
 
 # Implementation
@@ -31,6 +32,7 @@ As an administrator, I want operational settings and audit visibility, so that I
 - [`apps/web/src/app/admin/(console)/actions.ts`](../apps/web/src/app/admin/%28console%29/actions.ts)
 - [`apps/web/src/lib/admission-settings.ts`](../apps/web/src/lib/admission-settings.ts)
 - [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
+- [`packages/database/drizzle/0005_young_vertigo.sql`](../packages/database/drizzle/0005_young_vertigo.sql)
 - [`apps/web/src/app/admin/(console)/events/page.tsx`](../apps/web/src/app/admin/%28console%29/events/page.tsx)
 
 # Validation