Feat settings cascade with user_overridable flag

Three-tier settings resolution (global → team → user) with per-key
user_overridable flag in package manifests. Admins can lock settings
that team admins and users cannot override.

- Add package_team_settings table (migration 010)
- Add GetTeamSettings/SetTeamSettings/DeleteTeamSettings to PackageStore
- Add ResolveSettings, ParseSettingsSchema, FilterOverridableKeys
- Rewrite Starlark settings.get() to use cascade resolver
- Add TeamID to RunContext for team-aware resolution
- Enforce user_overridable on user settings save
- Add team package settings API (GET/PUT/DELETE)
- 12 unit tests for cascade resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/sqlite/packages.go

@@ -388,6 +388,36 @@ func (s *PackageStore) SetPackageSettings(ctx context.Context, id string, settin
 	return nil
 }
 
+// ── Team-level settings (v0.2.0) ─────────────────
+
+func (s *PackageStore) GetTeamSettings(ctx context.Context, pkgID, teamID string) (json.RawMessage, error) {
+	var settings string
+	err := DB.QueryRowContext(ctx,
+		`SELECT settings FROM package_team_settings WHERE package_id = ? AND team_id = ?`,
+		pkgID, teamID).Scan(&settings)
+	if err != nil {
+		return nil, err
+	}
+	return json.RawMessage(settings), nil
+}
+
+func (s *PackageStore) SetTeamSettings(ctx context.Context, pkgID, teamID string, settings json.RawMessage) error {
+	_, err := DB.ExecContext(ctx, `
+		INSERT INTO package_team_settings (package_id, team_id, settings, updated_at)
+		VALUES (?, ?, ?, datetime('now'))
+		ON CONFLICT (package_id, team_id)
+		DO UPDATE SET settings = EXCLUDED.settings, updated_at = datetime('now')`,
+		pkgID, teamID, string(settings))
+	return err
+}
+
+func (s *PackageStore) DeleteTeamSettings(ctx context.Context, pkgID, teamID string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM package_team_settings WHERE package_id = ? AND team_id = ?`,
+		pkgID, teamID)
+	return err
+}
+
 func nullStrPtr(s *string) sql.NullString {
 	if s == nil {
 		return sql.NullString{}