Feat settings cascade (#3)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -15,6 +15,14 @@ All notable changes to Switchboard Core are documented here.
 - `SeedAdminsGroupMember()`, `SeedEveryoneGroupMember()` test helpers
 - System groups re-seeded after `TruncateAll` in test helper
 - OIDC `isIdPAdmin()` — maps IdP role claims to Admins group membership
+- **Settings cascade**: three-tier resolution (global → team → user) with
+  `user_overridable` flag per manifest setting key. Admins can lock settings
+  that team admins and users cannot override.
+- `package_team_settings` table for team-scoped package setting overrides
+- Team admin API: `GET/PUT/DELETE /api/v1/teams/:teamId/packages/:pkgId/settings`
+- `RunContext.TeamID` for team-aware Starlark settings resolution
+- `store.ResolveSettings()` / `store.FilterOverridableKeys()` pure functions
+- `store.ParseSettingsSchema()` extracts `user_overridable` from manifests
 
 ### Changed
 
@@ -35,6 +43,8 @@ All notable changes to Switchboard Core are documented here.
 - OIDC syncs Admins group on login (no role column writes)
 - Kernel permissions: 6 → 7 (added `surface.admin.access`)
 - Admin users UI: role dropdown removed, admin managed through groups
+- Starlark `settings.get()` uses cascade resolver instead of naive merge
+- User settings save (`POST /extensions/:id/settings`) strips non-overridable keys
 
 ### Removed