[codex] Add World Cup soccer data sources

[arsalann]

Summary

Adds the selected World Cup soccer data source work for API-Football, BallDontLie FIFA, and football-data.org.

• Adds api-football:// for teams, stadiums, group standings, matches, players, and match events.
• Adds balldontlie-fifa:// with documented World Cup tables, cursor pagination, nested-object flattening, and clearer auth/plan-access errors.
• Adds football-data:// for teams, derived stadiums, group standings, matches, squad-derived players, and unfolded match events.
• Adds supported-source docs plus provider research docs and updates the docs sidebar / README support table.

Notes

• The real API keys used during live smoke testing are not committed.
• API-Football 2026 access was rejected by the provided free-plan key, while a 2022 teams smoke passed.
• BallDontLie free-tier smoke passed for teams and stadiums; group_standings returned plan-gated 401.
• football-data.org smoke passed for teams, matches, group_standings, stadiums with zero current venue rows, match_events with zero current event rows, and players --sql-limit=1; full players hit provider 429 during team hydration.

Validation

• go test ./pkg/source/api_football ./pkg/source/balldontlie_fifa ./pkg/source/football_data_org
• go test -short ./...
• npm run docs:build
• PATH="$(go env GOPATH)/bin:$PATH" make lint-ci

Self-review

• Checked that no provided live API keys are present in tracked source/docs.
• Confirmed all three sources are picked up by local registry generation.
• Fixed lint issues from mocked HTTP response writes before pushing the cleanup commit.
• Left known provider-tier and rate-limit caveats in docs/soccer-sources/handoff.md rather than hiding them in implementation details.