test(host): pin the ?type= vocabulary to the client's own 30 arms

Decoded the vocabulary from the binary rather than trusting a case count:
FUN_18012ec50 is `cmp ecx,0x1d` plus a 30-entry jump table at 0x18012ed9c, each
case `mov ecx,<atom>; jmp <atom->string>`. Resolving those atoms against
fut_atoms.tsv yields the exact token list, and it matches club_type_filter
one-for-one — 30 implemented, none missing, none invented.

That is worth a test rather than a note. A MISSING arm answers a real tab with
unsupported_type and an empty screen; an INVENTED arm is worse, because it is
dead code that looks like coverage. Mutation-checked: renaming the leaguelogos
arm fails the test.

Two facts fall out that were previously guesswork. There is no
`playergoalkeeper` token — the client has only DEF/MID/FWD tabs — so a
goalkeeper appearing under playerdefender is CORRECT and not a filter bug, which
I had flagged as suspicious while sweeping. And `healing`/`contract`/`training`
exist as ?type= arms even though consumables have their own route.

Also completes the last unapplied item of plan section 7: the full vocabulary is
now written into ENDPOINT_MAP.md with how it was derived.

fifa17-recon/docs/ENDPOINT_MAP.md

@@ -979,7 +979,32 @@ bronze/silver/gold/any; `sort` = asc/desc; `rare` = the literal string `SP`, not
 a boolean; `state` = the itemState names plus `any` — and note the REQUEST spells
 it `onSale` where the RESPONSE value is `forSale`.
 
-`?type=` has 30 values (`FUN_18012ec50`: 29 cases plus a default of `any`).
+`?type=` has 30 values. Decoded 2026-08-21 from the jump table itself rather
+than from a case count: `FUN_18012ec50` is `cmp ecx,0x1d` + a 30-entry table at
+`0x18012ed9c`, and each case is `mov ecx,<atom>; jmp 0x180180cd0` (atom → string).
+Resolving those atoms against `fut_atoms.tsv` gives the vocabulary in table order:
+
+```
+ 0 any            1 player          2 manager         3 headcoach
+ 4 fitnesscoach   5 physio          6 development     7 custom
+ 8 unlocks        9 gkcoach        10 staff          11 badge
+12 kit           13 stadium        14 ball           15 equippables
+16 leaguelogos   17 offlinetrophy  18 onlinetrophy   19 featuredofflinetrophy
+20 featuredonlinetrophy            21 allofflinetrophy
+22 allonlinetrophy                 23 healing        24 contract
+25 training      26 misc           27 playerdefender
+28 playermidfielder                29 playerforward
+```
+
+Notes worth having: there is **no `playergoalkeeper`** — the client has only
+DEF/MID/FWD tabs, so goalkeepers belong to `playerdefender`, and a GK appearing
+there is correct rather than a filter bug. `healing`, `contract` and `training`
+exist here as `?type=` arms even though consumables have their own
+`club/consumables/<cat>` route. Six of the thirty are trophy arms.
+
+`openfut-utas-host`'s `club_type_filter` implements all 30 with no extras; a unit
+test pins the list so a missing arm (an empty real tab) or an invented one (dead
+code that looks like coverage) fails the build.
 
 **`/club/stats` has exactly seven forms**: `club`, `year`, `country/<id>`,
 `league/<id>`, `newcards`, `consumables`, and the separately-dispatched `staff`.