feat(achievements): opt-in, privacy controls & data-min gate (epic PR2) (#591)

Sharing earned Feats on the (forthcoming) public wall is strictly opt-in,
default OFF, with a binding data-minimization contract.

- Onboarding (static/v3/profile.js): a new opt-in step (now a 5-step wizard)
  after song-directory / before paths — publishes only display name + earned
  Feats, never songs/skills/scores; off by default.
- Settings (plugins/achievements/settings.html, System tab via
  settings.category): the same toggle + a "Remove me from the wall" button
  (POST remove-me — wipes local synced state offline + enqueues removal).
- Core (server.py): achievements_enabled (bool, default false) in
  _default_settings + /api/settings validation + _RESETTABLE_SETTINGS_KEYS;
  mirrored to localStorage in app.js loadSettings().
- Data-minimization gate: engine.build_wall_payload is the single explicit-dict
  serializer; key-set is EXACTLY {display_name, player_hash, achievement_id,
  unlocked_at}, achievement_id always a Feat id. Enqueue is gated on
  opted-in AND profile identity (reused player_hash); competency never
  enqueues (integration law).

Verified natively: settings round-trip + validation + remove-me; opted-in
activity enqueues exactly one 4-field Feat payload; Playwright confirms the
5-step wizard + opt-in card (default unchecked), zero console errors.
29 plugin tests + new settings tests pass.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server.py

@@ -5388,6 +5388,11 @@ def _default_settings():
         "countdown_before_song": False,
         "miss_penalty": "none",
         "fail_behavior": "continue",
+        # Achievements epic: opt-in to publishing earned Feats (name + Feat id
+        # only) to the hosted wall. Default OFF — nothing leaves the device
+        # until the user opts in. Read by the bundled achievements plugin to
+        # gate its wall-sync enqueue.
+        "achievements_enabled": False,
     }
 
 
@@ -5524,6 +5529,12 @@ def save_settings(data: dict):
             if not isinstance(raw, bool):
                 return {"error": "countdown_before_song must be a boolean"}
             updates["countdown_before_song"] = raw
+    if "achievements_enabled" in data:
+        raw = data["achievements_enabled"]
+        if raw is not None:
+            if not isinstance(raw, bool):
+                return {"error": "achievements_enabled must be a boolean"}
+            updates["achievements_enabled"] = raw
     if "miss_penalty" in data:
         raw = data["miss_penalty"]
         if raw is not None:
@@ -5614,6 +5625,7 @@ _RESETTABLE_SETTINGS_KEYS = frozenset({
     "default_arrangement", "demucs_server_url", "master_difficulty",
     "av_offset_ms", "countdown_before_song", "miss_penalty", "fail_behavior",
     "reference_pitch", "instrument", "string_count", "tuning",
+    "achievements_enabled",
 })