feat: Phase 3 — polish & settings complete

Card pool:
- TOTW cards (5): overall 88-92, rarity "totw"
- Hero cards (5): overall 85-88, rarity "hero"
- Icon cards (5): overall 93-95, rarity "icon" (permanent, non-loan)

Packs:
- TOTW Pack (30,000 coins): 5 TOTW cards guaranteed
- Icon Pack (50,000 coins): 3 icon cards guaranteed
- Hero Pack (20,000 coins): 5 hero cards guaranteed

Objectives:
- Milestone objectives (6): win 10/50, score 100/500 goals, 10 SBCs, 25 packs

Formations:
- GET /formations returns 12 valid formation strings

Multiple named squads (#20):
- POST /squad with no squad_id always creates a new squad
- POST /squad with squad_id updates that specific squad
- GET /squads: list all squads for the club (metadata only)
- GET /squads/🆔 squad with players + chemistry
- DELETE /squads/🆔 remove a squad

Per-position goal stats (#41):
- Migration 0003: position_goals table
- POST /matches/result accepts optional goal_positions: ["ST","CAM",...]
- GET /statistics now includes position_goals map

Settings (#44-46):
- GET /settings: { difficulty, preferred_formation } with defaults
- PUT /settings: upsert any key-value combination

Draft mode skeleton (#38):
- GET /draft/squad?difficulty=... returns a randomly generated 11-player squad

Integration tests:
- 9 new tests covering: formations, pack buy/open, SBC submit, settings R/W,
  multiple squads, draft endpoint, goal position tracking, win streak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/settings.rs

@@ -0,0 +1,30 @@
+use axum::{extract::State, Json};
+use serde_json::{json, Value};
+
+use crate::{app::AppState, error::AppResult, services::settings as settings_svc};
+
+fn defaults(settings: &std::collections::HashMap<String, String>) -> Value {
+    json!({
+        "difficulty": settings.get("difficulty").cloned().unwrap_or_else(|| "beginner".into()),
+        "preferred_formation": settings.get("preferred_formation").cloned().unwrap_or_else(|| "4-4-2".into()),
+    })
+}
+
+pub async fn get_settings(State(state): State<AppState>) -> AppResult<Json<Value>> {
+    let settings = settings_svc::get_all(&state.pool).await?;
+    Ok(Json(defaults(&settings)))
+}
+
+pub async fn put_settings(
+    State(state): State<AppState>,
+    Json(req): Json<Value>,
+) -> AppResult<Json<Value>> {
+    if let Some(difficulty) = req.get("difficulty").and_then(|v| v.as_str()) {
+        settings_svc::upsert(&state.pool, "difficulty", difficulty).await?;
+    }
+    if let Some(formation) = req.get("preferred_formation").and_then(|v| v.as_str()) {
+        settings_svc::upsert(&state.pool, "preferred_formation", formation).await?;
+    }
+    let settings = settings_svc::get_all(&state.pool).await?;
+    Ok(Json(defaults(&settings)))
+}