Phase 21: auth status + full game reset

GET /auth/status returns { has_profile: true/false } without erroring,
so the dashboard can check on load whether an onboarding flow is needed.

POST /auth/reset wipes every user-data table (profiles, clubs, owned_cards,
packs, squads, matches, statistics, achievements, notifications, seasons,
market_listings, sbc_submissions, draft_sessions, fut_champs_sessions,
objective_progress, position_goals, events, settings) in reverse-dependency
order, leaving the schema intact. A fresh POST /auth/local creates a new
club on the clean slate.

4 new tests: status before/after profile creation, reset clears profile
and allows a new one. Core now at 86 tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/auth.rs

@@ -28,3 +28,54 @@ pub async fn post_auth_local(
         "message": "Welcome to OpenFUT FC! Your club has been created."
     })))
 }
+
+/// GET /auth/status — lightweight check: does a profile exist?
+/// Returns 200 `{ "has_profile": true/false }` without erroring.
+pub async fn get_auth_status(State(state): State<AppState>) -> AppResult<Json<Value>> {
+    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM profiles")
+        .fetch_one(&state.pool)
+        .await?;
+    Ok(Json(json!({ "has_profile": count > 0 })))
+}
+
+/// POST /auth/reset — wipe all game data and start fresh.
+/// Deletes every user-data table in dependency order. The schema tables
+/// (migrations) are left intact; calling POST /auth/local afterwards
+/// creates a new profile.
+pub async fn post_auth_reset(State(state): State<AppState>) -> AppResult<Json<Value>> {
+    // Delete in reverse-dependency order to satisfy FK constraints
+    // (SQLite FK enforcement is opt-in, but we follow the order anyway)
+    let tables = [
+        "player_achievements",
+        "notifications",
+        "fut_champs_sessions",
+        "sbc_submissions",
+        "objective_progress",
+        "position_goals",
+        "statistics",
+        "seasons",
+        "matches",
+        "market_listings",
+        "squad_players",
+        "squads",
+        "owned_cards",
+        "packs",
+        "events",
+        "draft_sessions",
+        "settings",
+        "clubs",
+        "profiles",
+    ];
+
+    for table in &tables {
+        sqlx::query(&format!("DELETE FROM {table}"))
+            .execute(&state.pool)
+            .await?;
+    }
+
+    tracing::info!("Full game reset performed");
+    Ok(Json(json!({
+        "reset": true,
+        "message": "All progress has been wiped. Call POST /auth/local to start a new club."
+    })))
+}