wip(bridge): retained FIFA request/response mapper + docker packaging

RETAINED PRE-EXISTING WIP (brought forward after verification, not authored
here, not production-ready). Substantive mapper.rs proxy expansion plus a
multi-stage Dockerfile/.dockerignore (rustls, self-signed cert at startup).
No secrets/captures staged. Preserved off the detached base c58e7326a1.

Dockerfile

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1
+# ---- OpenFUT Bridge: FIFA integration / reverse-engineering proxy ----
+# Multi-stage build; slim Debian runtime. reqwest uses rustls-tls and the
+# bridge self-signs its own cert at startup (rcgen) — no OpenSSL needed.
+
+FROM rust:1-bookworm AS builder
+WORKDIR /build
+
+COPY Cargo.toml Cargo.lock* ./
+RUN mkdir -p src src/bin \
+    && echo 'fn main() {}' > src/main.rs \
+    && echo '' > src/lib.rs \
+    && echo 'fn main() {}' > src/bin/replay.rs \
+    && cargo build --release --bin openfut-bridge 2>/dev/null || true
+RUN rm -rf src
+
+COPY src ./src
+RUN touch src/main.rs src/lib.rs \
+    && cargo build --release --bin openfut-bridge
+
+# ---- Runtime ----
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd --system --uid 10002 --create-home --home-dir /app openfut
+WORKDIR /app
+
+COPY --from=builder /build/target/release/openfut-bridge /usr/local/bin/openfut-bridge
+
+# Captures are written at runtime — keep them on a named volume.
+RUN mkdir -p /app/captures && chown openfut:openfut /app/captures
+
+USER openfut
+
+ENV BRIDGE_LISTEN_ADDR=0.0.0.0:8443 \
+    CORE_URL=http://core:8080 \
+    CAPTURES_DIR=/app/captures \
+    PLACEHOLDER_MODE=true \
+    TLS_ENABLED=true \
+    RUST_LOG=openfut_bridge=info,tower_http=info
+
+EXPOSE 8443
+VOLUME ["/app/captures"]
+
+# The bridge serves TLS; -k because the cert is self-signed. /_bridge/health
+# is the bridge's own admin endpoint (not a proxied FIFA route).
+HEALTHCHECK --interval=15s --timeout=4s --start-period=8s --retries=5 \
+    CMD curl -fsSk https://127.0.0.1:8443/_bridge/health || exit 1
+
+ENTRYPOINT ["openfut-bridge"]