feat(host): migrate item-defs + marketdata UTAS reads to Rust

Two more real client-hit reads move off the Python proxy:

- GET /item/resource, /defid (Route::ItemDefs): build {itemData:[item_def…]}
  for every >=3-digit id in the query, replicating the oracle's item_def
  (assetId = resourceId & 0xffffff; hardcoded Ronaldo asset 20801 + a generic
  "Player" 75 CM placeholder). The client renders the real card from its local
  DB, so the placeholder is exact parity.
- GET /marketdata (+ /marketdata/pricelimits) (Route::MarketData): suggested
  pricing, constant band 150..15000. /pricelimits returns a BARE ARRAY (one
  {defId,minPrice,maxPrice} per queried defId); plain /marketdata returns an
  OBJECT {minPrice,maxPrice}. The container type is load-bearing — object-where-
  array froze a live client at the listing screen, so the handler picks it from
  the path.

Adds extract_long_ints / extract_defid_param query parsers, shape+parser unit
tests (incl. the freeze-critical container-type assertions), and classify-table
coverage. Deployed to prod-host 2026-08-17; verified owner=RUST 200 for all four
(Ronaldo/placeholder resolve, pricelimits=array, marketdata=object).

Docs: PRODUCTION_AUTHORITY_MATRIX + PYTHON_RETIREMENT_PLAN updated. Remaining
Python tail is now only mutation (user/club), no-Core-model (squad/<n>), and
unimplemented modes (draft/leaderboards/sbs).

openfut-adapter-fifa17/src/fut/non_economy.rs

@@ -56,6 +56,78 @@ pub fn feature_off_body() -> Value {
     json!({})
 }
 
+/// One FUT item-definition for a requested `resource_id`, replicating the Python
+/// oracle's `item_def`: `assetId = resource_id & 0xffffff`; a single hardcoded
+/// card (Ronaldo, asset 20801) and a generic placeholder (`"Player"`, 75, CM,
+/// attrs 70) for every other asset. The FIFA client renders the real card from
+/// its LOCAL DB from the `(rareflag, resourceId)` pair, so this route only needs
+/// a valid-shaped record — the placeholder is exactly what the oracle itself
+/// returns for all but the one hardcoded asset. Key order is irrelevant (the
+/// client's deserializer is key-addressed and skip-safe).
+pub fn item_def(resource_id: i64) -> Value {
+    let asset = resource_id & 0xff_ffff;
+    // (name, rating, position, nation, leagueId, teamid, [6 attrs])
+    let (name, rating, pos, nation, league, team, attrs): (&str, i64, &str, i64, i64, i64, [i64; 6]) =
+        if asset == 20801 {
+            ("Ronaldo", 94, "ST", 38, 53, 243, [90, 93, 82, 91, 33, 80])
+        } else {
+            ("Player", 75, "CM", 0, 0, 0, [70, 70, 70, 70, 70, 70])
+        };
+    let attribute_list: Vec<Value> = attrs
+        .iter()
+        .enumerate()
+        .map(|(i, v)| json!({ "index": i, "value": v }))
+        .collect();
+    json!({
+        "id": resource_id,
+        "resourceId": resource_id,
+        "definitionId": resource_id,
+        "assetId": asset,
+        "cardassetid": asset,
+        "commodityId": asset,
+        "cardsubtypeid": 0,
+        "cardType": 0,
+        "itemType": "player",
+        "rareflag": 1,
+        "rating": rating,
+        "preferredPosition": pos,
+        "nation": nation,
+        "leagueId": league,
+        "teamid": team,
+        "playStyle": 250,
+        "attributeList": attribute_list,
+        "name": name,
+        "commonName": name,
+        "lastName": name,
+        "itemState": "free",
+        "untradeable": true,
+    })
+}
+
+/// `GET …/item/resource`, `…/defid` — `{itemData:[…]}` with one [`item_def`] per
+/// requested id (mirrors the oracle's `defs_route`). No ids → an empty list.
+pub fn item_defs_body(ids: &[i64]) -> Value {
+    json!({ "itemData": ids.iter().map(|&id| item_def(id)).collect::<Vec<_>>() })
+}
+
+/// `GET …/marketdata/pricelimits?defId=a,b,c` — FutGetSuggestedPricing. The root
+/// MUST be a BARE ARRAY (one element per defId): returning an object here froze a
+/// live client (object-where-array busy loop at the listing screen). Constant
+/// band 150..15000 (placeholder pricing; not a freeze concern).
+pub fn marketdata_pricelimits_body(def_ids: &[i64]) -> Value {
+    json!(def_ids
+        .iter()
+        .map(|&d| json!({ "defId": d, "minPrice": 150, "maxPrice": 15000 }))
+        .collect::<Vec<_>>())
+}
+
+/// `GET …/marketdata` (NOT `/pricelimits`) — the price-comparison endpoint, which
+/// takes an OBJECT `{minPrice,maxPrice}`. Array-where-object would be the same
+/// freeze in reverse, so the container type is load-bearing. Constant band.
+pub fn marketdata_object_body() -> Value {
+    json!({ "minPrice": 150, "maxPrice": 15000 })
+}
+
 /// The phishing/security-question action, parsed from the URL tail.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SecurityAction {