Phase 21: auth status + full game reset

GET /auth/status returns { has_profile: true/false } without erroring,
so the dashboard can check on load whether an onboarding flow is needed.

POST /auth/reset wipes every user-data table (profiles, clubs, owned_cards,
packs, squads, matches, statistics, achievements, notifications, seasons,
market_listings, sbc_submissions, draft_sessions, fut_champs_sessions,
objective_progress, position_goals, events, settings) in reverse-dependency
order, leaving the schema intact. A fresh POST /auth/local creates a new
club on the clean slate.

4 new tests: status before/after profile creation, reset clears profile
and allows a new one. Core now at 86 tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration_test.rs

@@ -1679,3 +1679,62 @@ async fn test_achievement_grants_coins() {
     // Should have gained match coins + at least the first_match achievement reward (500)
     assert!(coins_after > coins_before + 400, "expected achievement coin reward in total");
 }
+
+// ── Phase 21: Onboarding / Reset ─────────────────────────────────────────────
+
+#[tokio::test]
+async fn test_auth_status_before_profile() {
+    let app = build_test_app().await;
+    let (status, json) = json_get(&app, "/auth/status").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(json["has_profile"], false);
+}
+
+#[tokio::test]
+async fn test_auth_status_after_profile() {
+    let app = build_test_app().await;
+    auth(&app, "StatusPlayer").await;
+    let (status, json) = json_get(&app, "/auth/status").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(json["has_profile"], true);
+}
+
+#[tokio::test]
+async fn test_auth_reset_clears_profile() {
+    let app = build_test_app().await;
+    auth(&app, "ResetPlayer").await;
+
+    // Play a match to generate some state
+    json_post(&app, "/matches/result", serde_json::json!({
+        "squad_id": "dummy", "opponent_name": "Bot",
+        "goals_for": 1, "goals_against": 0, "mode": "squad_battles"
+    })).await;
+
+    // Reset
+    let (status, json) = json_post(&app, "/auth/reset", serde_json::json!({})).await;
+    assert_eq!(status, StatusCode::OK, "{json}");
+    assert_eq!(json["reset"], true);
+
+    // Profile should be gone
+    let (s, _) = json_get(&app, "/profile").await;
+    assert_eq!(s, StatusCode::NOT_FOUND, "profile should not exist after reset");
+
+    // Status should reflect no profile
+    let (_, status_json) = json_get(&app, "/auth/status").await;
+    assert_eq!(status_json["has_profile"], false);
+}
+
+#[tokio::test]
+async fn test_auth_reset_allows_new_profile() {
+    let app = build_test_app().await;
+    auth(&app, "FirstProfile").await;
+
+    json_post(&app, "/auth/reset", serde_json::json!({})).await;
+
+    // Should be able to create a new profile after reset
+    let (status, json) = json_post(&app, "/auth/local",
+        serde_json::json!({ "username": "NewProfile" })
+    ).await;
+    assert_eq!(status, StatusCode::OK, "{json}");
+    assert_eq!(json["profile"]["username"], "NewProfile");
+}