Feat settings cascade with user_overridable flag

Three-tier settings resolution (global → team → user) with per-key
user_overridable flag in package manifests. Admins can lock settings
that team admins and users cannot override.

- Add package_team_settings table (migration 010)
- Add GetTeamSettings/SetTeamSettings/DeleteTeamSettings to PackageStore
- Add ResolveSettings, ParseSettingsSchema, FilterOverridableKeys
- Rewrite Starlark settings.get() to use cascade resolver
- Add TeamID to RunContext for team-aware resolution
- Enforce user_overridable on user settings save
- Add team package settings API (GET/PUT/DELETE)
- 12 unit tests for cascade resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -15,6 +15,14 @@ All notable changes to Switchboard Core are documented here.
 - `SeedAdminsGroupMember()`, `SeedEveryoneGroupMember()` test helpers
 - System groups re-seeded after `TruncateAll` in test helper
 - OIDC `isIdPAdmin()` — maps IdP role claims to Admins group membership
+- **Settings cascade**: three-tier resolution (global → team → user) with
+  `user_overridable` flag per manifest setting key. Admins can lock settings
+  that team admins and users cannot override.
+- `package_team_settings` table for team-scoped package setting overrides
+- Team admin API: `GET/PUT/DELETE /api/v1/teams/:teamId/packages/:pkgId/settings`
+- `RunContext.TeamID` for team-aware Starlark settings resolution
+- `store.ResolveSettings()` / `store.FilterOverridableKeys()` pure functions
+- `store.ParseSettingsSchema()` extracts `user_overridable` from manifests
 
 ### Changed
 
@@ -35,6 +43,8 @@ All notable changes to Switchboard Core are documented here.
 - OIDC syncs Admins group on login (no role column writes)
 - Kernel permissions: 6 → 7 (added `surface.admin.access`)
 - Admin users UI: role dropdown removed, admin managed through groups
+- Starlark `settings.get()` uses cascade resolver instead of naive merge
+- User settings save (`POST /extensions/:id/settings`) strips non-overridable keys
 
 ### Removed