feat: Phase 3 — polish & settings complete

Card pool:
- TOTW cards (5): overall 88-92, rarity "totw"
- Hero cards (5): overall 85-88, rarity "hero"
- Icon cards (5): overall 93-95, rarity "icon" (permanent, non-loan)

Packs:
- TOTW Pack (30,000 coins): 5 TOTW cards guaranteed
- Icon Pack (50,000 coins): 3 icon cards guaranteed
- Hero Pack (20,000 coins): 5 hero cards guaranteed

Objectives:
- Milestone objectives (6): win 10/50, score 100/500 goals, 10 SBCs, 25 packs

Formations:
- GET /formations returns 12 valid formation strings

Multiple named squads (#20):
- POST /squad with no squad_id always creates a new squad
- POST /squad with squad_id updates that specific squad
- GET /squads: list all squads for the club (metadata only)
- GET /squads/🆔 squad with players + chemistry
- DELETE /squads/🆔 remove a squad

Per-position goal stats (#41):
- Migration 0003: position_goals table
- POST /matches/result accepts optional goal_positions: ["ST","CAM",...]
- GET /statistics now includes position_goals map

Settings (#44-46):
- GET /settings: { difficulty, preferred_formation } with defaults
- PUT /settings: upsert any key-value combination

Draft mode skeleton (#38):
- GET /draft/squad?difficulty=... returns a randomly generated 11-player squad

Integration tests:
- 9 new tests covering: formations, pack buy/open, SBC submit, settings R/W,
  multiple squads, draft endpoint, goal position tracking, win streak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/services/match_service.rs

@@ -148,6 +148,10 @@ pub async fn process_match(
     )
     .await?;
 
+    if let Some(positions) = &req.goal_positions {
+        statistics::record_position_goals(pool, profile_id, positions).await?;
+    }
+
     let mut objectives_updated = Vec::new();
 
     let mut completed =

src/services/mod.rs

@@ -6,5 +6,6 @@ pub mod objective;
 pub mod pack;
 pub mod profile;
 pub mod sbc;
+pub mod settings;
 pub mod squad;
 pub mod statistics;

src/services/settings.rs

@@ -0,0 +1,23 @@
+use crate::{db::Pool, error::AppResult};
+use std::collections::HashMap;
+
+pub async fn get_all(pool: &Pool) -> AppResult<HashMap<String, String>> {
+    let rows: Vec<(String, String)> = sqlx::query_as("SELECT key, value FROM settings")
+        .fetch_all(pool)
+        .await?;
+    Ok(rows.into_iter().collect())
+}
+
+pub async fn upsert(pool: &Pool, key: &str, value: &str) -> AppResult<()> {
+    let now = chrono::Utc::now().to_rfc3339();
+    sqlx::query(
+        "INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?) \
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at",
+    )
+    .bind(key)
+    .bind(value)
+    .bind(&now)
+    .execute(pool)
+    .await?;
+    Ok(())
+}

src/services/squad.rs

@@ -11,24 +11,55 @@ use uuid::Uuid;
 
 pub async fn get_squad(pool: &Pool, club_id: &str) -> AppResult<(Squad, Vec<SquadPlayer>)> {
     let squad = sqlx::query_as::<_, Squad>(
-        "SELECT id, club_id, name, formation, created_at, updated_at FROM squads WHERE club_id = ? ORDER BY created_at DESC LIMIT 1"
+        "SELECT id, club_id, name, formation, created_at, updated_at FROM squads WHERE club_id = ? ORDER BY updated_at DESC LIMIT 1"
     )
     .bind(club_id)
     .fetch_optional(pool)
     .await?
     .ok_or_else(|| AppError::NotFound("no squad found for this club".into()))?;
 
-    let players = sqlx::query_as::<_, SquadPlayer>(
-        "SELECT id, squad_id, owned_card_id, position_index, is_captain, is_on_bench FROM squad_players WHERE squad_id = ?"
-    )
-    .bind(&squad.id)
-    .fetch_all(pool)
-    .await?;
-
+    let players = get_players(pool, &squad.id).await?;
     Ok((squad, players))
 }
 
-/// Validate that the squad has exactly 11 starters with exactly one GK.
+pub async fn get_squad_by_id(
+    pool: &Pool,
+    club_id: &str,
+    squad_id: &str,
+) -> AppResult<(Squad, Vec<SquadPlayer>)> {
+    let squad = sqlx::query_as::<_, Squad>(
+        "SELECT id, club_id, name, formation, created_at, updated_at FROM squads WHERE id = ? AND club_id = ?",
+    )
+    .bind(squad_id)
+    .bind(club_id)
+    .fetch_optional(pool)
+    .await?
+    .ok_or_else(|| AppError::NotFound(format!("squad '{squad_id}' not found")))?;
+
+    let players = get_players(pool, &squad.id).await?;
+    Ok((squad, players))
+}
+
+pub async fn list_squads(pool: &Pool, club_id: &str) -> AppResult<Vec<Squad>> {
+    let squads = sqlx::query_as::<_, Squad>(
+        "SELECT id, club_id, name, formation, created_at, updated_at FROM squads WHERE club_id = ? ORDER BY updated_at DESC",
+    )
+    .bind(club_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(squads)
+}
+
+async fn get_players(pool: &Pool, squad_id: &str) -> AppResult<Vec<SquadPlayer>> {
+    let players = sqlx::query_as::<_, SquadPlayer>(
+        "SELECT id, squad_id, owned_card_id, position_index, is_captain, is_on_bench FROM squad_players WHERE squad_id = ?",
+    )
+    .bind(squad_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(players)
+}
+
 pub async fn validate_formation(
     pool: &Pool,
     card_db: &CardDb,
@@ -74,7 +105,6 @@ pub async fn validate_formation(
     Ok(())
 }
 
-/// Calculate chemistry for the starting XI. Returns total and per-player scores.
 pub async fn calculate_chemistry(
     pool: &Pool,
     card_db: &CardDb,
@@ -98,7 +128,6 @@ pub async fn calculate_chemistry(
         }
     }
 
-    // Per-player chemistry: club links (max 4) + league links (max 3) + nation links (max 3), capped at 10
     let player_chems: Vec<i64> = cards
         .iter()
         .enumerate()
@@ -137,27 +166,34 @@ pub async fn calculate_chemistry(
 pub async fn save_squad(pool: &Pool, club_id: &str, req: &SaveSquadRequest) -> AppResult<Squad> {
     let now = chrono::Utc::now().to_rfc3339();
 
-    let existing = sqlx::query_scalar::<_, Option<String>>(
-        "SELECT id FROM squads WHERE club_id = ? ORDER BY created_at DESC LIMIT 1",
-    )
-    .bind(club_id)
-    .fetch_one(pool)
-    .await?;
+    let squad_id = if let Some(ref id) = req.squad_id {
+        // Update existing squad — verify ownership
+        let verified =
+            sqlx::query_scalar::<_, String>("SELECT id FROM squads WHERE id = ? AND club_id = ?")
+                .bind(id)
+                .bind(club_id)
+                .fetch_optional(pool)
+                .await?
+                .ok_or_else(|| AppError::NotFound(format!("squad '{id}' not found")))?;
+
+        sqlx::query(
+            "UPDATE squads SET name = COALESCE(?, name), formation = COALESCE(?, formation), updated_at = ? WHERE id = ?",
+        )
+        .bind(req.name.as_deref())
+        .bind(req.formation.as_deref())
+        .bind(&now)
+        .bind(&verified)
+        .execute(pool)
+        .await?;
 
-    let squad_id = if let Some(id) = existing {
-        sqlx::query("UPDATE squads SET name = COALESCE(?, name), formation = COALESCE(?, formation), updated_at = ? WHERE id = ?")
-            .bind(req.name.as_deref())
-            .bind(req.formation.as_deref())
-            .bind(&now)
-            .bind(&id)
-            .execute(pool)
-            .await?;
         sqlx::query("DELETE FROM squad_players WHERE squad_id = ?")
-            .bind(&id)
+            .bind(&verified)
             .execute(pool)
             .await?;
-        id
+
+        verified
     } else {
+        // Create a new squad
         let squad = Squad::new(
             club_id,
             req.name.as_deref().unwrap_or("My Squad"),
@@ -201,3 +237,16 @@ pub async fn save_squad(pool: &Pool, club_id: &str, req: &SaveSquadRequest) -> A
 
     Ok(squad)
 }
+
+pub async fn delete_squad(pool: &Pool, club_id: &str, squad_id: &str) -> AppResult<()> {
+    let deleted = sqlx::query("DELETE FROM squads WHERE id = ? AND club_id = ?")
+        .bind(squad_id)
+        .bind(club_id)
+        .execute(pool)
+        .await?;
+
+    if deleted.rows_affected() == 0 {
+        return Err(AppError::NotFound(format!("squad '{squad_id}' not found")));
+    }
+    Ok(())
+}

src/services/statistics.rs

@@ -102,3 +102,31 @@ pub async fn increment_sbcs_completed(pool: &Pool, profile_id: &str) -> AppResul
     .await?;
     Ok(())
 }
+
+pub async fn record_position_goals(
+    pool: &Pool,
+    profile_id: &str,
+    positions: &[String],
+) -> AppResult<()> {
+    for position in positions {
+        sqlx::query(
+            "INSERT INTO position_goals (profile_id, position, goals) VALUES (?, ?, 1) \
+             ON CONFLICT(profile_id, position) DO UPDATE SET goals = goals + 1",
+        )
+        .bind(profile_id)
+        .bind(position)
+        .execute(pool)
+        .await?;
+    }
+    Ok(())
+}
+
+pub async fn get_position_goals(pool: &Pool, profile_id: &str) -> AppResult<Vec<(String, i64)>> {
+    let rows: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT position, goals FROM position_goals WHERE profile_id = ? ORDER BY goals DESC",
+    )
+    .bind(profile_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}