feat: Phase 3 — polish & settings complete

Card pool:
- TOTW cards (5): overall 88-92, rarity "totw"
- Hero cards (5): overall 85-88, rarity "hero"
- Icon cards (5): overall 93-95, rarity "icon" (permanent, non-loan)

Packs:
- TOTW Pack (30,000 coins): 5 TOTW cards guaranteed
- Icon Pack (50,000 coins): 3 icon cards guaranteed
- Hero Pack (20,000 coins): 5 hero cards guaranteed

Objectives:
- Milestone objectives (6): win 10/50, score 100/500 goals, 10 SBCs, 25 packs

Formations:
- GET /formations returns 12 valid formation strings

Multiple named squads (#20):
- POST /squad with no squad_id always creates a new squad
- POST /squad with squad_id updates that specific squad
- GET /squads: list all squads for the club (metadata only)
- GET /squads/🆔 squad with players + chemistry
- DELETE /squads/🆔 remove a squad

Per-position goal stats (#41):
- Migration 0003: position_goals table
- POST /matches/result accepts optional goal_positions: ["ST","CAM",...]
- GET /statistics now includes position_goals map

Settings (#44-46):
- GET /settings: { difficulty, preferred_formation } with defaults
- PUT /settings: upsert any key-value combination

Draft mode skeleton (#38):
- GET /draft/squad?difficulty=... returns a randomly generated 11-player squad

Integration tests:
- 9 new tests covering: formations, pack buy/open, SBC submit, settings R/W,
  multiple squads, draft endpoint, goal position tracking, win streak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/draft.rs

@@ -0,0 +1,32 @@
+use axum::{
+    extract::{Query, State},
+    Json,
+};
+use serde::Deserialize;
+use serde_json::{json, Value};
+
+use crate::{app::AppState, error::AppResult, services::match_service};
+
+#[derive(Deserialize)]
+pub struct DraftQuery {
+    pub difficulty: Option<String>,
+}
+
+/// Returns a randomly generated draft squad from the card pool.
+/// Difficulty controls minimum card overall. The front-end is responsible
+/// for presenting per-position pick choices; this endpoint provides the pool.
+pub async fn get_draft_squad(
+    State(state): State<AppState>,
+    Query(query): Query<DraftQuery>,
+) -> AppResult<Json<Value>> {
+    let difficulty = query.difficulty.as_deref().unwrap_or("beginner");
+    let generated = match_service::generate_opponent(&state.card_db, difficulty);
+
+    Ok(Json(json!({
+        "mode": "draft",
+        "difficulty": difficulty,
+        "squad_rating": generated["squad_rating"],
+        "formation": generated["formation"],
+        "cards": generated["cards"],
+    })))
+}