wip: checkpoint multi-game core work

src/services/squad.rs

@@ -63,6 +63,7 @@ async fn get_players(pool: &Pool, squad_id: &str) -> AppResult<Vec<SquadPlayer>>
 pub async fn validate_formation(
     pool: &Pool,
     card_db: &CardDb,
+    club_id: &str,
     players: &[SquadPlayerInput],
 ) -> AppResult<()> {
     let starters: Vec<&SquadPlayerInput> = players.iter().filter(|p| !p.is_on_bench).collect();
@@ -77,12 +78,13 @@ pub async fn validate_formation(
     let mut gk_count = 0usize;
     for sp in &starters {
         let owned = sqlx::query_as::<_, OwnedCard>(
-            "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, chemistry_style, position_override, training_bonus FROM owned_cards WHERE id = ?",
+            "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, chemistry_style, position_override, training_bonus FROM owned_cards WHERE id = ? AND club_id = ?",
         )
         .bind(&sp.owned_card_id)
+        .bind(club_id)
         .fetch_optional(pool)
         .await?
-        .ok_or_else(|| AppError::NotFound(format!("owned card {} not found", sp.owned_card_id)))?;
+        .ok_or_else(|| AppError::NotFound(format!("owned card {} not found or does not belong to this club", sp.owned_card_id)))?;
 
         if let Some(card) = card_db.get(&owned.card_id) {
             if card.position == "GK" {