feat(panel): let a sponsor slot start at a scheduled time

sponsors.json only had an end date, so a booked placement had to be
added to the file on the day it started. An optional `from` now hides
a sponsor (and its logo) until that instant; entries without it show
immediately as before.

docs/content/docs/en/reference/api/authentication.mdx

@@ -24,10 +24,10 @@ _openapi:
       url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
     - depth: 2
       title: Public. Active paid sponsor placements read from the project
-        sponsors.json (cached for 1h); expired entries are dropped. Logos are
-        proxied by the panel at /sponsors/logo/{name}. Used by the login page
-        and panel sponsor slots.
-      url: '#public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-expired-entries-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots'
+        sponsors.json (cached for 1h); entries outside their from/until window
+        are dropped. Logos are proxied by the panel at /sponsors/logo/{name}.
+        Used by the login page and panel sponsor slots.
+      url: '#public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-entries-outside-their-fromuntil-window-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots'
     - depth: 2
       title: Returns whether 2FA is enabled on the panel — used by the login page to
         decide whether to show the OTP field.
@@ -46,10 +46,10 @@ _openapi:
           requests.
         id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
       - content: Public. Active paid sponsor placements read from the project
-          sponsors.json (cached for 1h); expired entries are dropped. Logos are
-          proxied by the panel at /sponsors/logo/{name}. Used by the login page
-          and panel sponsor slots.
-        id: public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-expired-entries-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots
+          sponsors.json (cached for 1h); entries outside their from/until window
+          are dropped. Logos are proxied by the panel at /sponsors/logo/{name}.
+          Used by the login page and panel sponsor slots.
+        id: public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-entries-outside-their-fromuntil-window-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots
       - content: Returns whether 2FA is enabled on the panel — used by the login page to
           decide whether to show the OTP field.
         id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field

docs/public/openapi.json

@@ -4502,6 +4502,12 @@
             "nullable": true,
             "type": "boolean"
           },
+          "from": {
+            "example": "2026-10-01T00:00:00Z",
+            "format": "date-time",
+            "nullable": true,
+            "type": "string"
+          },
           "id": {
             "example": "acme-2026-10",
             "type": "string"
@@ -5029,7 +5035,7 @@
         "tags": [
           "Authentication"
         ],
-        "summary": "Public. Active paid sponsor placements read from the project sponsors.json (cached for 1h); expired entries are dropped. Logos are proxied by the panel at /sponsors/logo/{name}. Used by the login page and panel sponsor slots.",
+        "summary": "Public. Active paid sponsor placements read from the project sponsors.json (cached for 1h); entries outside their from/until window are dropped. Logos are proxied by the panel at /sponsors/logo/{name}. Used by the login page and panel sponsor slots.",
         "operationId": "get_sponsors",
         "responses": {
           "200": {
@@ -5057,6 +5063,7 @@
                     "sponsors": [
                       {
                         "enable": true,
+                        "from": "2026-10-01T00:00:00Z",
                         "id": "acme-2026-10",
                         "link": "https://acme.example/?utm_source=3x-ui",
                         "logo": "/sponsors/logo/acme.png",