feat(host): migrate item-defs + marketdata UTAS reads to Rust

Two more real client-hit reads move off the Python proxy:

- GET /item/resource, /defid (Route::ItemDefs): build {itemData:[item_def…]}
  for every >=3-digit id in the query, replicating the oracle's item_def
  (assetId = resourceId & 0xffffff; hardcoded Ronaldo asset 20801 + a generic
  "Player" 75 CM placeholder). The client renders the real card from its local
  DB, so the placeholder is exact parity.
- GET /marketdata (+ /marketdata/pricelimits) (Route::MarketData): suggested
  pricing, constant band 150..15000. /pricelimits returns a BARE ARRAY (one
  {defId,minPrice,maxPrice} per queried defId); plain /marketdata returns an
  OBJECT {minPrice,maxPrice}. The container type is load-bearing — object-where-
  array froze a live client at the listing screen, so the handler picks it from
  the path.

Adds extract_long_ints / extract_defid_param query parsers, shape+parser unit
tests (incl. the freeze-critical container-type assertions), and classify-table
coverage. Deployed to prod-host 2026-08-17; verified owner=RUST 200 for all four
(Ronaldo/placeholder resolve, pricelimits=array, marketdata=object).

Docs: PRODUCTION_AUTHORITY_MATRIX + PYTHON_RETIREMENT_PLAN updated. Remaining
Python tail is now only mutation (user/club), no-Core-model (squad/<n>), and
unimplemented modes (draft/leaderboards/sbs).

docs/PYTHON_RETIREMENT_PLAN.md

@@ -8,7 +8,7 @@ rollback-to-python-p2.sh, :p2-rollback image b1b929953f, profile 39bb3e83).
 ## A. LIVE PRODUCTION REQUIRED (still owns behavior in the live flow)
 | Component | Role | Rust status | Retire when |
 |---|---|---|---|
-| oracle utas_server.py (:8199) NON-ECONOMY | **remaining**: item-defs (item/resource,defid), user/club rename, non-active squad/<n>, draft, marketdata, mode-gated leaderboards + /sbs/* | **Most non-economy migrated 2026-08-17** (account/sync, auth, userMassInfo, user, clientdata, hub, club/stats/*, settings, accountinfo, phishing, match/reset, leaderboards/options, watchList, static acks, and the flag-off empty reads season/tournament/champion/clubUser/user/list → `{}` — all Rust). See PRODUCTION_AUTHORITY_MATRIX | remaining tail migrated (needs live captures for the data routes; mode-logic port for the gated ones) OR mode-gated ones kept Python |
+| oracle utas_server.py (:8199) NON-ECONOMY | **remaining**: user/club rename, non-active squad/<n>, draft/*, mode-gated leaderboards + /sbs/* | **Most non-economy migrated 2026-08-17** (account/sync, auth, userMassInfo, user, clientdata, hub, club/stats/*, settings, accountinfo, phishing, match/reset, leaderboards/options, watchList, static acks, item-defs (item/resource,defid), marketdata (+/pricelimits), and the flag-off empty reads season/tournament/champion/clubUser/user/list → `{}` — all Rust). See PRODUCTION_AUTHORITY_MATRIX | remaining tail is mutation (user/club), no-Core-model (squad/<n>), or unimplemented modes (draft/leaderboards/sbs) |
 | blaze_responder_v3b.py (:42130 Blaze) | FUT Blaze transport | Rust openfut-blaze-host COMPLETE, gate-proven (Gate 10) | container cutover (operator-gated deploy) |
 | blaze_responder_v3b.py (:42127 redirector TLS) | first-hop TLS redirect | Rust openfut-redirector-host COMPLETE (OpenSSL) | container cutover + cert consistency |
 | roster_server.py (:8081) | roster-update XML | Rust openfut-roster-host COMPLETE (unit-only) | container cutover |
@@ -34,10 +34,11 @@ rollback-to-python-p2.sh, :p2-rollback image b1b929953f, profile 39bb3e83).
 
 ## Retirement gating
 1. **Mostly DONE (2026-08-17)**: account/sync, ut/auth (Rust SID mint), userMassInfo (full), clientdata,
-   club/stats/{country,league,team}, watchList, static acks, and the flag-off empty reads
-   (season/tournament/champion/clubUser/user/list → `{}`) migrated + deployed. **Remaining on Python**:
-   item-defs, user/club rename, non-active squad/<n>, draft, marketdata (freeze-risk), and mode-gated
-   leaderboards + /sbs/* (need the mode logic ported). Migrate the data ones once live shapes are captured.
+   club/stats/{country,league,team}, watchList, static acks, the flag-off empty reads
+   (season/tournament/champion/clubUser/user/list → `{}`), item-defs (item/resource,defid), and
+   marketdata (+/pricelimits, container-type-exact) migrated + deployed. **Remaining on Python**:
+   user/club rename (mutating; needs a Core write), non-active squad/<n> (no multi-squad Core model),
+   and the unimplemented modes draft/* + leaderboards + /sbs/* (need the mode logic ported, not a proxy).
 2. Deploy Rust blaze/roster/redirector via container cutover (operator-gated) — then those Python responders
    are class D/E only.
 3. POW: build Rust host + reverse bodies (largest blocker) OR keep Python POW as class A indefinitely.