feat: Phase 3 — polish & settings complete

Card pool:
- TOTW cards (5): overall 88-92, rarity "totw"
- Hero cards (5): overall 85-88, rarity "hero"
- Icon cards (5): overall 93-95, rarity "icon" (permanent, non-loan)

Packs:
- TOTW Pack (30,000 coins): 5 TOTW cards guaranteed
- Icon Pack (50,000 coins): 3 icon cards guaranteed
- Hero Pack (20,000 coins): 5 hero cards guaranteed

Objectives:
- Milestone objectives (6): win 10/50, score 100/500 goals, 10 SBCs, 25 packs

Formations:
- GET /formations returns 12 valid formation strings

Multiple named squads (#20):
- POST /squad with no squad_id always creates a new squad
- POST /squad with squad_id updates that specific squad
- GET /squads: list all squads for the club (metadata only)
- GET /squads/🆔 squad with players + chemistry
- DELETE /squads/🆔 remove a squad

Per-position goal stats (#41):
- Migration 0003: position_goals table
- POST /matches/result accepts optional goal_positions: ["ST","CAM",...]
- GET /statistics now includes position_goals map

Settings (#44-46):
- GET /settings: { difficulty, preferred_formation } with defaults
- PUT /settings: upsert any key-value combination

Draft mode skeleton (#38):
- GET /draft/squad?difficulty=... returns a randomly generated 11-player squad

Integration tests:
- 9 new tests covering: formations, pack buy/open, SBC submit, settings R/W,
  multiple squads, draft endpoint, goal position tracking, win streak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app.rs

@@ -12,7 +12,7 @@ use crate::{
 };
 use anyhow::Result;
 use axum::{
-    routing::{get, post},
+    routing::{delete, get, post, put},
     Router,
 };
 use std::sync::Arc;
@@ -103,6 +103,7 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
 
     let router = Router::new()
         .route("/health", get(routes::health::get_health))
+        .route("/formations", get(routes::health::get_formations))
         .route("/auth/local", post(routes::auth::post_auth_local))
         .route("/profile", get(routes::profile::get_profile))
         .route("/club", get(routes::club::get_club))
@@ -114,6 +115,9 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
         .route("/packs/open/:pack_id", post(routes::packs::post_open_pack))
         .route("/squad", get(routes::squad::get_squad))
         .route("/squad", post(routes::squad::post_squad))
+        .route("/squads", get(routes::squad::get_squads))
+        .route("/squads/:squad_id", get(routes::squad::get_squad_by_id))
+        .route("/squads/:squad_id", delete(routes::squad::delete_squad))
         .route("/objectives", get(routes::objectives::get_objectives))
         .route(
             "/objectives/claim",
@@ -123,8 +127,8 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
         .route("/matches/opponent", get(routes::matches::get_opponent))
         .route("/matches/result", post(routes::matches::post_match_result))
         .route("/sbc", get(routes::sbc::get_sbcs))
-        .route("/sbc/:sbc_id", get(routes::sbc::get_sbc))
         .route("/sbc/submit", post(routes::sbc::post_sbc_submit))
+        .route("/sbc/:sbc_id", get(routes::sbc::get_sbc))
         .route("/market", get(routes::market::get_market))
         .route("/market/buy", post(routes::market::post_market_buy))
         .route("/market/sell", post(routes::market::post_market_sell))
@@ -134,6 +138,9 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
             "/statistics/history",
             get(routes::statistics::get_statistics_history),
         )
+        .route("/settings", get(routes::settings::get_settings))
+        .route("/settings", put(routes::settings::put_settings))
+        .route("/draft/squad", get(routes::draft::get_draft_squad))
         .layer(TraceLayer::new_for_http())
         .layer(CorsLayer::permissive())
         .with_state(state);