feat(core): unlock foundations — Foundation(u8) slots, suit derived from contents

Standard Klondike behaviour: any Ace can land in any empty foundation,
and that slot then claims the suit until the pile empties. The
previous PileType::Foundation(Suit) variant pre-assigned each of the
four foundations to a fixed suit ("C / D / H / S" placeholders) and
rejected mismatched Aces — non-standard and (per the smoke-test
feedback) confusing.

Replaces the variant payload with a slot index Foundation(u8) (0..=3)
and derives the claimed suit from the bottom card via a new
Pile::claimed_suit() method. The bottom card is, by construction,
the Ace that established the claim; using it directly eliminates an
entire class of "stuck claim after undo" bugs that a separate
claimed_suit field would have introduced.

can_place_on_foundation drops its suit parameter — the rule reduces
to "empty pile accepts any Ace; non-empty pile accepts the next
rank up of the bottom card's suit." Iteration sites across
input_plugin, cursor_plugin, selection_plugin, card_plugin,
auto_complete_plugin, game_plugin, layout, and hud_plugin all swap
the four-suit list for `(0..4u8).map(PileType::Foundation)`.

next_auto_complete_move now prefers a slot whose claimed_suit matches
the candidate card before falling back to the first empty slot for
an Ace — so the same suit consistently auto-targets the same slot
across the whole game, matching player expectations.

The HUD selection label and the hint toast read claimed_suit() and
fall back to "Foundation N" / "move to foundation" only when the
slot is empty. Empty foundation pile markers no longer render the
suit-letter children — they're plain translucent rectangles, matching
empty tableau placeholders.

Save-format invalidation: GameState gains a schema_version field
(serde-default to 1 for back-compat parsing of old files), the
constant is bumped to 2, and load_game_state_from rejects mismatched
schemas. Old in-progress saves silently fall through to "fresh game
on launch" — the user accepted this loss given the mechanic change.
Stats / progress / achievements / settings live in separate files,
contain no PileType data, and are unaffected.

9 new tests pin the contract:
- Pile::claimed_suit returns None for empty / non-foundation, Some
  for non-empty foundation
- Any Ace lands in the first empty foundation; successive Aces
  distribute across slots 0..3
- Claim drops when the slot is emptied via undo
- Auto-complete picks the slot with a matching claim, not the first
  empty slot
- A v1-format game_state.json is rejected; sibling stats save/load
  is unaffected

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

solitaire_data/src/storage.rs

@@ -7,7 +7,7 @@ use std::fs;
 use std::io;
 use std::path::{Path, PathBuf};
 
-use solitaire_core::game_state::GameState;
+use solitaire_core::game_state::{GameState, GAME_STATE_SCHEMA_VERSION};
 
 use crate::stats::StatsSnapshot;
 
@@ -72,10 +72,21 @@ pub fn game_state_file_path() -> Option<PathBuf> {
 }
 
 /// Load an in-progress `GameState` from `path`. Returns `None` if the file is
-/// missing, corrupt, or represents a finished game.
+/// missing, corrupt, represents a finished game, or carries a save-schema
+/// version other than [`GAME_STATE_SCHEMA_VERSION`].
+///
+/// Schema mismatch is treated as "no save" so a player upgrading across an
+/// incompatible game-state format change starts fresh instead of seeing a
+/// half-loaded game (or a deserialiser error). v1 saves with the old
+/// `Foundation(Suit)` key shape will fail to parse outright; any v1 saves
+/// that happen to round-trip but report `schema_version: 1` are also rejected
+/// here.
 pub fn load_game_state_from(path: &Path) -> Option<GameState> {
     let data = fs::read(path).ok()?;
     let gs: GameState = serde_json::from_slice(&data).ok()?;
+    if gs.schema_version != GAME_STATE_SCHEMA_VERSION {
+        return None;
+    }
     if gs.is_won {
         None
     } else {
@@ -331,4 +342,49 @@ mod tests {
         let tmp = path.with_extension("json.tmp");
         assert!(!tmp.exists(), ".tmp must be cleaned up after rename");
     }
+
+    /// Pre-v2 save files used `Foundation(Suit)` keys and either fail to
+    /// parse outright or surface a `schema_version: 1`. Either path must
+    /// produce `None` so the player launches into a fresh game.
+    ///
+    /// Sibling assertion: the stats round-trip path is unaffected — only
+    /// the game-state schema bumped.
+    #[test]
+    fn save_format_v1_is_rejected() {
+        let path = gs_path("schema_v1");
+        let _ = fs::remove_file(&path);
+
+        // A pared-down v1 JSON literal: foundation pile keys use the old
+        // suit-tagged form and the file omits `schema_version` (so it
+        // deserialises with the default of 1). Even if a future change
+        // makes `Foundation(Suit)` parse-compatible, the schema-version
+        // gate keeps this case rejected.
+        let v1_json = r#"{
+            "piles": [
+                [{"Foundation": "Hearts"}, {"pile_type": {"Foundation": "Hearts"}, "cards": []}]
+            ],
+            "draw_mode": "DrawOne",
+            "score": 0,
+            "move_count": 0,
+            "elapsed_seconds": 0,
+            "seed": 42,
+            "is_won": false,
+            "is_auto_completable": false,
+            "undo_count": 0,
+            "undo_stack": []
+        }"#;
+        fs::write(&path, v1_json).expect("write v1 fixture");
+
+        assert!(
+            load_game_state_from(&path).is_none(),
+            "v1 game_state.json must be rejected (parse failure or schema bump)",
+        );
+
+        // Sibling sanity: stats files are independent and still round-trip.
+        let stats_path = tmp_path("schema_unrelated_stats");
+        let _ = fs::remove_file(&stats_path);
+        save_stats_to(&stats_path, &StatsSnapshot::default()).expect("save stats");
+        let loaded = load_stats_from(&stats_path);
+        assert_eq!(loaded, StatsSnapshot::default());
+    }
 }