Feat settings cascade with user_overridable flag

Three-tier settings resolution (global → team → user) with per-key
user_overridable flag in package manifests. Admins can lock settings
that team admins and users cannot override.

- Add package_team_settings table (migration 010)
- Add GetTeamSettings/SetTeamSettings/DeleteTeamSettings to PackageStore
- Add ResolveSettings, ParseSettingsSchema, FilterOverridableKeys
- Rewrite Starlark settings.get() to use cascade resolver
- Add TeamID to RunContext for team-aware resolution
- Enforce user_overridable on user settings save
- Add team package settings API (GET/PUT/DELETE)
- 12 unit tests for cascade resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/package_iface.go

@@ -83,6 +83,17 @@ type PackageStore interface {
 
 	// SetPackageSettings stores admin-configured package-level settings.
 	SetPackageSettings(ctx context.Context, id string, settings json.RawMessage) error
+
+	// ── Team-level settings (v0.2.0) ─────────────────
+
+	// GetTeamSettings returns team-scoped overrides for a package.
+	GetTeamSettings(ctx context.Context, pkgID, teamID string) (json.RawMessage, error)
+
+	// SetTeamSettings upserts team-scoped overrides for a package.
+	SetTeamSettings(ctx context.Context, pkgID, teamID string, settings json.RawMessage) error
+
+	// DeleteTeamSettings removes team-scoped overrides, reverting to global defaults.
+	DeleteTeamSettings(ctx context.Context, pkgID, teamID string) error
 }
 
 // PackageRegistration is a row from the packages table.
@@ -123,3 +134,11 @@ type PackageUserSettings struct {
 	Settings  json.RawMessage `json:"settings" db:"settings"`
 	IsEnabled bool            `json:"is_enabled" db:"is_enabled"`
 }
+
+// PackageTeamSettings stores team-scoped overrides for a package (v0.2.0).
+type PackageTeamSettings struct {
+	PackageID string          `json:"package_id" db:"package_id"`
+	TeamID    string          `json:"team_id" db:"team_id"`
+	Settings  json.RawMessage `json:"settings" db:"settings"`
+	UpdatedAt string          `json:"updated_at" db:"updated_at"`
+}