feat(host): migrate flag-off UTAS reads (season/tournament/champion/clubUser/user-list) to Rust

FUT modes (Seasons/Tournaments/FUT Champions) and the club-identity service are
disabled in this emulator, so these GET reads return {} verbatim from the Python
oracle. Serve them directly from Rust via a new Route::FeatureOffEmpty +
non_economy::feature_off_body() -> {} (byte-identical to the flag-off oracle),
reducing the proxied Python surface.

- The mutating club rename (user/club) stays on Python (needs a Core write).
- Enabling a mode later requires a real Rust handler here, never a Python
  fallback (no split authority).
- classify tests: 5 routes owned + user/club/wrong-method lookalikes stay
  Passthrough; updated the stale clubUser assertion.
- Deployed to prod-host 2026-08-17; verified owner=RUST 200 {} for all five.

Docs: PRODUCTION_AUTHORITY_MATRIX + PYTHON_RETIREMENT_PLAN updated.

openfut-adapter-fifa17/src/fut/non_economy.rs

@@ -46,6 +46,16 @@ pub fn club_stats_staff_body() -> Value {
     json!({})
 }
 
+/// The FUT modes (Seasons / Tournaments / FUT Champions) and the club-identity
+/// service are disabled in this emulator, so their read routes (`season`,
+/// `tournament`, `champion`, `clubUser`, `user/list`) return an empty object —
+/// byte-identical to the Python oracle with `FUT_MODES` / `FUT_CLUB_IDENTITY`
+/// off. Enabling a mode later requires a real Rust implementation here, never a
+/// Python fallback (which would reintroduce split authority).
+pub fn feature_off_body() -> Value {
+    json!({})
+}
+
 /// The phishing/security-question action, parsed from the URL tail.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SecurityAction {