fix(retirement): isolate retirement goals from savings goal routes

Addresses Codex P2 on #2044. A Goal::Retirement row lives in
Current.family.goals, so the shared GoalsController and
GoalPledgesController loaded it through `family.goals.find(...)` —
never calling Goal::Retirement#editable_by?. Any preview-enabled
family member could therefore open /goals/:id and edit/archive/delete
another member's owner-scoped retirement plan, hit its pledge routes,
and see it listed in the savings Goals grid.

Adds `Goal.savings` (base type only) and scopes both savings
controllers to it, so retirement goals are unreachable through the
shared routes (RecordNotFound -> goals_path redirect) and absent from
the savings index. Owner-only retirement access stays in
RetirementController; editable_by? is retained for it.

Tests: savings scope excludes retirement; retirement goal absent from
goals index; show + pledge routes redirect not-found for retirement.

(The Codex schema.rb null:false finding is a false positive — this
branch's schema.rb retains null:false on all IBKR payload columns and
the diff vs the base branch touches no IBKR lines; Codex compared
against main rather than the PR base.)

test/models/goal_test.rb

@@ -261,4 +261,15 @@ class GoalTest < ActiveSupport::TestCase
     assert_not @goal.editable_by?(foreign_user)
     assert_not @goal.editable_by?(nil)
   end
+
+  test "savings scope excludes retirement subtype" do
+    retirement = Goal::Retirement.create!(
+      family: @family, owner: users(:family_admin),
+      name: "Retire", target_amount: 1_000_000, currency: "USD"
+    )
+
+    savings_ids = Goal.savings.pluck(:id)
+    assert_includes savings_ids, @goal.id
+    assert_not_includes savings_ids, retirement.id
+  end
 end