Feat settings cascade with user_overridable flag

Three-tier settings resolution (global → team → user) with per-key
user_overridable flag in package manifests. Admins can lock settings
that team admins and users cannot override.

- Add package_team_settings table (migration 010)
- Add GetTeamSettings/SetTeamSettings/DeleteTeamSettings to PackageStore
- Add ResolveSettings, ParseSettingsSchema, FilterOverridableKeys
- Rewrite Starlark settings.get() to use cascade resolver
- Add TeamID to RunContext for team-aware resolution
- Enforce user_overridable on user settings save
- Add team package settings API (GET/PUT/DELETE)
- 12 unit tests for cascade resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/database/migrations/postgres/010_settings_cascade.sql

@@ -0,0 +1,13 @@
+-- 010_settings_cascade.sql — v0.2.0
+-- Adds team-scoped package settings for the three-tier cascade:
+-- global (package_settings) → team (package_team_settings) → user (package_user_settings)
+
+CREATE TABLE IF NOT EXISTS package_team_settings (
+    package_id   TEXT        NOT NULL REFERENCES packages(id) ON DELETE CASCADE,
+    team_id      UUID        NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    settings     JSONB       NOT NULL DEFAULT '{}',
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (package_id, team_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_pkg_team_settings_team ON package_team_settings(team_id);

server/database/migrations/sqlite/010_settings_cascade.sql

@@ -0,0 +1,13 @@
+-- 010_settings_cascade.sql — v0.2.0
+-- Adds team-scoped package settings for the three-tier cascade:
+-- global (package_settings) → team (package_team_settings) → user (package_user_settings)
+
+CREATE TABLE IF NOT EXISTS package_team_settings (
+    package_id   TEXT NOT NULL REFERENCES packages(id) ON DELETE CASCADE,
+    team_id      TEXT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    settings     TEXT NOT NULL DEFAULT '{}',
+    updated_at   TEXT NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (package_id, team_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_pkg_team_settings_team ON package_team_settings(team_id);