fix: MEDIUM — Cache-Control headers on admin GETs, Open Day past date validation

- Add Cache-Control headers to admin GET endpoints (sections 60s, team 60s, bookings 30s, unread 15s, open-day 60s)
- Validate Open Day date is not in the past on both create (POST) and update (PUT)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/app/api/admin/sections/[key]/route.ts

@@ -24,7 +24,9 @@ export async function GET(_request: NextRequest, { params }: Params) {
     }
   }
 
-  return NextResponse.json(data);
+  return NextResponse.json(data, {
+    headers: { "Cache-Control": "private, max-age=60" },
+  });
 }
 
 export async function PUT(request: NextRequest, { params }: Params) {