feat: Phase 3 — polish & settings complete

Card pool:
- TOTW cards (5): overall 88-92, rarity "totw"
- Hero cards (5): overall 85-88, rarity "hero"
- Icon cards (5): overall 93-95, rarity "icon" (permanent, non-loan)

Packs:
- TOTW Pack (30,000 coins): 5 TOTW cards guaranteed
- Icon Pack (50,000 coins): 3 icon cards guaranteed
- Hero Pack (20,000 coins): 5 hero cards guaranteed

Objectives:
- Milestone objectives (6): win 10/50, score 100/500 goals, 10 SBCs, 25 packs

Formations:
- GET /formations returns 12 valid formation strings

Multiple named squads (#20):
- POST /squad with no squad_id always creates a new squad
- POST /squad with squad_id updates that specific squad
- GET /squads: list all squads for the club (metadata only)
- GET /squads/🆔 squad with players + chemistry
- DELETE /squads/🆔 remove a squad

Per-position goal stats (#41):
- Migration 0003: position_goals table
- POST /matches/result accepts optional goal_positions: ["ST","CAM",...]
- GET /statistics now includes position_goals map

Settings (#44-46):
- GET /settings: { difficulty, preferred_formation } with defaults
- PUT /settings: upsert any key-value combination

Draft mode skeleton (#38):
- GET /draft/squad?difficulty=... returns a randomly generated 11-player squad

Integration tests:
- 9 new tests covering: formations, pack buy/open, SBC submit, settings R/W,
  multiple squads, draft endpoint, goal position tracking, win streak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/draft.rs

@@ -0,0 +1,32 @@
+use axum::{
+    extract::{Query, State},
+    Json,
+};
+use serde::Deserialize;
+use serde_json::{json, Value};
+
+use crate::{app::AppState, error::AppResult, services::match_service};
+
+#[derive(Deserialize)]
+pub struct DraftQuery {
+    pub difficulty: Option<String>,
+}
+
+/// Returns a randomly generated draft squad from the card pool.
+/// Difficulty controls minimum card overall. The front-end is responsible
+/// for presenting per-position pick choices; this endpoint provides the pool.
+pub async fn get_draft_squad(
+    State(state): State<AppState>,
+    Query(query): Query<DraftQuery>,
+) -> AppResult<Json<Value>> {
+    let difficulty = query.difficulty.as_deref().unwrap_or("beginner");
+    let generated = match_service::generate_opponent(&state.card_db, difficulty);
+
+    Ok(Json(json!({
+        "mode": "draft",
+        "difficulty": difficulty,
+        "squad_rating": generated["squad_rating"],
+        "formation": generated["formation"],
+        "cards": generated["cards"],
+    })))
+}

src/routes/health.rs

@@ -11,3 +11,13 @@ pub async fn get_health() -> (StatusCode, Json<Value>) {
         })),
     )
 }
+
+pub async fn get_formations() -> Json<Value> {
+    Json(json!({
+        "formations": [
+            "4-4-2", "4-3-3", "4-2-3-1", "4-5-1",
+            "3-5-2", "3-4-3", "5-3-2", "5-4-1",
+            "4-1-2-1-2", "4-3-2-1", "4-4-1-1", "4-2-2-2"
+        ]
+    }))
+}

src/routes/mod.rs

@@ -1,6 +1,7 @@
 pub mod auth;
 pub mod cards;
 pub mod club;
+pub mod draft;
 pub mod health;
 pub mod market;
 pub mod matches;
@@ -8,5 +9,6 @@ pub mod objectives;
 pub mod packs;
 pub mod profile;
 pub mod sbc;
+pub mod settings;
 pub mod squad;
 pub mod statistics;

src/routes/settings.rs

@@ -0,0 +1,30 @@
+use axum::{extract::State, Json};
+use serde_json::{json, Value};
+
+use crate::{app::AppState, error::AppResult, services::settings as settings_svc};
+
+fn defaults(settings: &std::collections::HashMap<String, String>) -> Value {
+    json!({
+        "difficulty": settings.get("difficulty").cloned().unwrap_or_else(|| "beginner".into()),
+        "preferred_formation": settings.get("preferred_formation").cloned().unwrap_or_else(|| "4-4-2".into()),
+    })
+}
+
+pub async fn get_settings(State(state): State<AppState>) -> AppResult<Json<Value>> {
+    let settings = settings_svc::get_all(&state.pool).await?;
+    Ok(Json(defaults(&settings)))
+}
+
+pub async fn put_settings(
+    State(state): State<AppState>,
+    Json(req): Json<Value>,
+) -> AppResult<Json<Value>> {
+    if let Some(difficulty) = req.get("difficulty").and_then(|v| v.as_str()) {
+        settings_svc::upsert(&state.pool, "difficulty", difficulty).await?;
+    }
+    if let Some(formation) = req.get("preferred_formation").and_then(|v| v.as_str()) {
+        settings_svc::upsert(&state.pool, "preferred_formation", formation).await?;
+    }
+    let settings = settings_svc::get_all(&state.pool).await?;
+    Ok(Json(defaults(&settings)))
+}

src/routes/squad.rs

@@ -1,4 +1,7 @@
-use axum::{extract::State, Json};
+use axum::{
+    extract::{Path, State},
+    Json,
+};
 use serde_json::{json, Value};
 
 use crate::{
@@ -15,28 +18,27 @@ pub async fn get_squad(State(state): State<AppState>) -> AppResult<Json<Value>>
     let (squad, players) = squad_svc::get_squad(&state.pool, &club.id).await?;
     let chemistry = squad_svc::calculate_chemistry(&state.pool, &state.card_db, &players).await?;
 
-    let enriched: Vec<Value> = players
-        .iter()
-        .map(|sp| {
-            json!({
-                "squad_player_id": sp.id,
-                "owned_card_id": sp.owned_card_id,
-                "position_index": sp.position_index,
-                "is_captain": sp.is_captain,
-                "is_on_bench": sp.is_on_bench,
-            })
-        })
-        .collect();
+    Ok(Json(squad_response(&squad, &players, chemistry)))
+}
 
-    Ok(Json(json!({
-        "squad": {
-            "id": squad.id,
-            "name": squad.name,
-            "formation": squad.formation,
-        },
-        "players": enriched,
-        "chemistry": chemistry,
-    })))
+pub async fn get_squads(State(state): State<AppState>) -> AppResult<Json<Value>> {
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
+    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
+    let squads = squad_svc::list_squads(&state.pool, &club.id).await?;
+    Ok(Json(json!({ "squads": squads })))
+}
+
+pub async fn get_squad_by_id(
+    State(state): State<AppState>,
+    Path(squad_id): Path<String>,
+) -> AppResult<Json<Value>> {
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
+    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
+
+    let (squad, players) = squad_svc::get_squad_by_id(&state.pool, &club.id, &squad_id).await?;
+    let chemistry = squad_svc::calculate_chemistry(&state.pool, &state.card_db, &players).await?;
+
+    Ok(Json(squad_response(&squad, &players, chemistry)))
 }
 
 pub async fn post_squad(
@@ -53,3 +55,42 @@ pub async fn post_squad(
     let squad = squad_svc::save_squad(&state.pool, &club.id, &req).await?;
     Ok(Json(json!({ "squad": squad })))
 }
+
+pub async fn delete_squad(
+    State(state): State<AppState>,
+    Path(squad_id): Path<String>,
+) -> AppResult<Json<Value>> {
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
+    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
+    squad_svc::delete_squad(&state.pool, &club.id, &squad_id).await?;
+    Ok(Json(json!({ "deleted": squad_id })))
+}
+
+fn squad_response(
+    squad: &crate::models::squad::Squad,
+    players: &[crate::models::squad::SquadPlayer],
+    chemistry: Value,
+) -> Value {
+    let enriched: Vec<Value> = players
+        .iter()
+        .map(|sp| {
+            json!({
+                "squad_player_id": sp.id,
+                "owned_card_id": sp.owned_card_id,
+                "position_index": sp.position_index,
+                "is_captain": sp.is_captain,
+                "is_on_bench": sp.is_on_bench,
+            })
+        })
+        .collect();
+
+    json!({
+        "squad": {
+            "id": squad.id,
+            "name": squad.name,
+            "formation": squad.formation,
+        },
+        "players": enriched,
+        "chemistry": chemistry,
+    })
+}

src/routes/statistics.rs

@@ -8,14 +8,25 @@ use serde_json::{json, Value};
 use crate::{
     app::AppState,
     error::AppResult,
-    models::{match_result::Match, statistics::Statistics},
+    models::match_result::Match,
     services::{profile as profile_svc, statistics as stats_svc},
 };
 
-pub async fn get_statistics(State(state): State<AppState>) -> AppResult<Json<Statistics>> {
+pub async fn get_statistics(State(state): State<AppState>) -> AppResult<Json<Value>> {
     let profile = profile_svc::get_active_profile(&state.pool).await?;
     let stats = stats_svc::get_or_create(&state.pool, &profile.id).await?;
-    Ok(Json(stats))
+    let pos_goals = stats_svc::get_position_goals(&state.pool, &profile.id).await?;
+
+    let pos_map: serde_json::Map<String, Value> = pos_goals
+        .into_iter()
+        .map(|(pos, goals)| (pos, Value::Number(goals.into())))
+        .collect();
+
+    let mut val = serde_json::to_value(&stats)?;
+    if let Some(obj) = val.as_object_mut() {
+        obj.insert("position_goals".into(), Value::Object(pos_map));
+    }
+    Ok(Json(val))
 }
 
 #[derive(Deserialize)]