feat(achievements): opt-in, privacy controls & data-min gate (epic PR2) (#591)

Sharing earned Feats on the (forthcoming) public wall is strictly opt-in,
default OFF, with a binding data-minimization contract.

- Onboarding (static/v3/profile.js): a new opt-in step (now a 5-step wizard)
  after song-directory / before paths — publishes only display name + earned
  Feats, never songs/skills/scores; off by default.
- Settings (plugins/achievements/settings.html, System tab via
  settings.category): the same toggle + a "Remove me from the wall" button
  (POST remove-me — wipes local synced state offline + enqueues removal).
- Core (server.py): achievements_enabled (bool, default false) in
  _default_settings + /api/settings validation + _RESETTABLE_SETTINGS_KEYS;
  mirrored to localStorage in app.js loadSettings().
- Data-minimization gate: engine.build_wall_payload is the single explicit-dict
  serializer; key-set is EXACTLY {display_name, player_hash, achievement_id,
  unlocked_at}, achievement_id always a Feat id. Enqueue is gated on
  opted-in AND profile identity (reused player_hash); competency never
  enqueues (integration law).

Verified natively: settings round-trip + validation + remove-me; opted-in
activity enqueues exactly one 4-field Feat payload; Playwright confirms the
5-step wizard + opt-in card (default unchecked), zero console errors.
29 plugin tests + new settings tests pass.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_settings_api.py

@@ -582,6 +582,22 @@ def test_api_post_settings_null_string_is_noop_via_testclient(api_client, tmp_pa
     assert _read_cfg(tmp_path)["master_difficulty"] == 50
 
 
+def test_achievements_enabled_persists_and_validates(api_client, tmp_path):
+    """The achievements-epic opt-in flag round-trips as a boolean and rejects
+    non-bools at the route level (mirrors countdown_before_song)."""
+    tc, _server = api_client
+    r = tc.post("/api/settings", json={"achievements_enabled": True})
+    assert r.status_code == 200
+    assert _read_cfg(tmp_path)["achievements_enabled"] is True
+    bad = tc.post("/api/settings", json={"achievements_enabled": "yes"})
+    assert bad.status_code == 200 and "error" in bad.json()
+
+
+def test_achievements_enabled_is_resettable(server_module):
+    """The flag is in the resettable allow-list so a Reset clears it to default."""
+    assert "achievements_enabled" in server_module._RESETTABLE_SETTINGS_KEYS
+
+
 def test_skip_startup_tasks_drives_startup_to_complete(api_client):
     """With FEEDBACK_SKIP_STARTUP_TASKS set, the startup hook must:
       * skip plugin loading and the background scan,