fifa17-recon: match rewards, POW online layer, account backend, quick sell

Second session. FUT core loop, the EASFC/POW online layer, a central account
backend, and a lot of corrections. Everything risky is behind an env flag with
the default set to whatever was live-proven.

WORKING END TO END (live-verified this session):
  * match loop -- POST/PUT/POST/DELETE ut/%s/match, rewards via FutDestroyMatch
    (0x180121b60). Play a match, get coins, W/D/L updates.
  * packs -- buy, cards land in the club, session survives (FUT_PACK_AUTOCLUB=1)
  * quick sell -- POST ut/delete/%s/item was UNMAPPED and paid NOTHING; six cards
    were destroyed for 0 coins. Now credits discardValue.
  * POW/EASFC online -- the "EA FC servers unreachable" banner is powdll's layer,
    a THIRD http api on :8094 nobody had served. Redirect needs no root: powdll
    FUN_18005a460 reads FIFA_POW_URL from the same client-config store as
    ROSTERUPDATE_URL. FUT_POW=1.
  * account backend -- fut_account.py replaces 7 hardcoded copies of the persona
    across 5 files; club/persona/online-profile editable via CLI.

CORRECTIONS TO ENDPOINT_MAP (all re-extracted from the deserializers):
  * FutStoreGetPackTypes: id/packType/isPremium/quantity/saleType/purchaseLimit/
    purchaseCount are NOT skipped no-ops -- all are parsed. extPrice inner objects
    take externalPriceId(0x11a), not amount/currency.
  * FutMoveCard 0x180128600 has NO skip handler (FUN_180135ff0 appears zero times,
    unique among FUT deserializers) and parses only itemData -> dreamSquads.
  * class -> deserializer resolution: the name literal is preceded by a 4-BYTE
    HEADER and the factory LEA points at the header, so look up name_addr - 4.
    Six attempts failed on this; now ghidra_env.class_deser(). Unlocked 11 SBC/
    Draft schemas.
  * live-only endpoints the request table never lists: ut/%s/squad/list,
    ut/%s/user/club, ut/%s/club/stats/*, ut/%s/clientdata/<key>. The template
    table is a floor, not a ceiling -- the log is the only ground truth.
  * 163 RS4 call names exist; we served 17. All now served.

FIXED: club/stats/* was answering with the entire 28-item club inventory on every
poll (it fell through to the generic /club route).

UNSOLVED: the pack reveal's "Send to Club" (PUT ut/%s/item) kills the FUT session
whatever we answer -- {} included -- while its sibling quick-sell endpoint accepts
a bare {}. Seven hypotheses eliminated by live test, documented in
REBUILD_RESEARCH.md S14c so none get re-walked. FUT_PACK_AUTOCLUB routes around it.
Also unfixed: store tiles render "unknown" (displayGroup is parsed RECURSIVELY by
the same element parser; sending it FROZE the store, so FUT_STORE_GROUPS=1 is
default off).

Tests: test_fut_contract.py 380 (live, read-only) + test_match_rewards.py 51 (pure).

Note: fut_store.py carries some pre-existing uncommitted changes from before this
session (pack catalogue ids, pending-pile behaviour) that could not be separated
from this session's additions in the same file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW

fifa17-recon/tools/lsx_responder_v2.py

@@ -100,17 +100,27 @@ import time
 
 from Crypto.Cipher import AES
 
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from fut_account import ACCOUNT  # noqa: E402
+
 # ---------------------------------------------------------------- identity
-# SHARED CONSTANTS -- must stay byte-identical to blaze_responder_v3.py.
-# A mismatch between what LSX reports here and what Blaze returns in
-# LoginResponse.SESS.PDTL is exactly what raises AUTH_ERR_INVALID_PERSONA /
-# AUTH_ERR_USER_DOES_NOT_MATCH_PERSONA / AUTH_ERR_PERSONA_NOT_FOUND.
-PERSONA_ID = 33068179
-PERSONA_NAME = "CAGE"
-USER_ID = 33068179
-CONTENT_ID = "1027460"          # FIFA 17 EA offer id
-ENTITLEMENT_TAG = "ONLINE_ACCESS"
-LOCALE = "en_US"
+# SOURCED FROM fut_account.ACCOUNT, shared with blaze_responder_v3b.py,
+# fut_store.py, fut_seed.py and utas_server.py.
+#
+# THE CONSTRAINT IS CROSS-LAYER CONSISTENCY, NOT ANY PARTICULAR VALUE: what LSX
+# reports here must equal what Blaze returns in LoginResponse.SESS.PDTL and what
+# UTAS serves as userInfo.personaId. (The previous comment blamed a mismatch for
+# AUTH_ERR_INVALID_PERSONA / AUTH_ERR_USER_DOES_NOT_MATCH_PERSONA /
+# AUTH_ERR_PERSONA_NOT_FOUND -- those are Blaze *server* error codes and we are
+# the server. Neither "CAGE" nor "33068179" appears in FIFA17.exe, CardsDLL or
+# dbdata.dll; 33068179 lives only in stp-origin_emu.dll's own ini default. They
+# stay the defaults because they are what the working stack asserts.)
+PERSONA_ID = ACCOUNT.persona_id
+PERSONA_NAME = ACCOUNT.persona_name
+USER_ID = ACCOUNT.user_id            # derived from persona_id
+CONTENT_ID = ACCOUNT.CONTENT_ID      # FIFA 17 EA offer id
+ENTITLEMENT_TAG = ACCOUNT.ENTITLEMENT_TAG
+LOCALE = ACCOUNT.locale
 
 AUTHCODE_FILE = "/tmp/openfut_authcode.txt"
 CLIENTID_FILE = "/tmp/openfut_lsx_clientid.txt"
@@ -397,6 +407,10 @@ def build_reply(mid, req_name, attrs, conn, recipient=""):
         # (OriginGetDefaultUser @0x1470da6d0 / OriginGetDefaultPersona
         # @0x1470da680 are bare reads of those fields, written only by
         # OriginSDK::Initialize @0x1470e5ad5/0x1470e5ae1).  Keep it complete.
+        # ONLY PersonaId/UserId/Persona are substituted from ACCOUNT; the rest
+        # of this template (Country/CommerceCountry/GeoCountry/CommerceCurrency/
+        # AvatarId/IsSubscriber/IsUnderAge) is byte-exact per REPACK_INTEL 1.4
+        # and is latched into OriginSDK[+0x3a0]/[+0x3a8] -- leave it verbatim.
         return resp(mid,
                     f'GetProfileResponse IsSubscriber="true" PersonaId="{PERSONA_ID}" '
                     f'AvatarId="" Country="US" CommerceCountry="US" GeoCountry="US" '