Feat settings cascade with user_overridable flag

Three-tier settings resolution (global → team → user) with per-key
user_overridable flag in package manifests. Admins can lock settings
that team admins and users cannot override.

- Add package_team_settings table (migration 010)
- Add GetTeamSettings/SetTeamSettings/DeleteTeamSettings to PackageStore
- Add ResolveSettings, ParseSettingsSchema, FilterOverridableKeys
- Rewrite Starlark settings.get() to use cascade resolver
- Add TeamID to RunContext for team-aware resolution
- Enforce user_overridable on user settings save
- Add team package settings API (GET/PUT/DELETE)
- 12 unit tests for cascade resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/runner.go

@@ -46,6 +46,10 @@ type RunContext struct {
 
 	// ChannelID is the context identifier, if any.
 	ChannelID string
+
+	// TeamID is the team context for settings cascade resolution (v0.2.0).
+	// When set, team-scoped package settings are included in the cascade.
+	TeamID string
 }
 
 // Runner executes Starlark package scripts with permission-gated modules.
@@ -337,12 +341,14 @@ func (r *Runner) buildModulesWithLibCtx(ctx context.Context, packageID string, m
 	}
 
 	// v0.30.0: settings module — always injected, no permission required.
-	// A package reads its own admin + user settings.
+	// A package reads its own admin + team + user settings (v0.2.0 cascade).
 	userID := ""
+	teamID := ""
 	if rc != nil {
 		userID = rc.UserID
+		teamID = rc.TeamID
 	}
-	modules["settings"] = BuildSettingsModule(ctx, r.stores, packageID, userID)
+	modules["settings"] = BuildSettingsModule(ctx, r.stores, packageID, userID, teamID)
 
 	// v0.38.2: lib module — always injected, no permission required.
 	// Allows any starlark package to load declared library dependencies.