feat: Phase 1 — core game loop complete

New endpoints:
- GET  /cards/:card_id       single card lookup
- POST /packs/buy            purchase pack with coins
- POST /objectives/claim     claim completed objective reward
- GET  /matches              match history (limit/mode query params)
- GET  /sbc/:sbc_id          single SBC lookup

Card pool expanded:
- Bronze: 11 → 30 cards (19 nations)
- Silver: 0 → 20 cards (20 nations)
- Rare Gold: 0 → 10 cards (10 nations)

SBC pool expanded:
- Added 5 new SBCs (tri_nations, silver_to_gold, league_loyalty,
  african_stars, gold_standard)

Infrastructure:
- SQLite WAL mode enabled on pool init
- Foreign key enforcement enabled

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/packs.rs

@@ -2,6 +2,7 @@ use axum::{
     extract::{Path, State},
     Json,
 };
+use serde::Deserialize;
 use serde_json::{json, Value};
 
 use crate::{
@@ -11,6 +12,29 @@ use crate::{
     services::{club as club_svc, objective, pack as pack_svc, profile as profile_svc, statistics},
 };
 
+#[derive(Deserialize)]
+pub struct BuyPackRequest {
+    pub pack_definition_id: String,
+}
+
+pub async fn post_buy_pack(
+    State(state): State<AppState>,
+    Json(req): Json<BuyPackRequest>,
+) -> AppResult<Json<Value>> {
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
+    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
+    let pack = pack_svc::buy_pack(
+        &state.pool,
+        &state.pack_defs,
+        &club.id,
+        &req.pack_definition_id,
+    )
+    .await?;
+    Ok(Json(
+        json!({ "pack": pack, "message": "Pack purchased successfully" }),
+    ))
+}
+
 pub async fn get_packs(State(state): State<AppState>) -> AppResult<Json<Value>> {
     let profile = profile_svc::get_active_profile(&state.pool).await?;
     let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;