feat(fifa17): own club/stats/staff (empty stat set) in Rust

Migrate GET club/stats/staff from the Python proxy to a Rust static handler.
The production oracle returns {} for the staff-bonus stat set (deliberately
empty); the Rust host now owns it (owner=RUST route=club-stats-staff). Updates
classify(), the pre-existing near-miss test (now club/stats/year), the ownership
matrix test, and the no-fallback integration test. club/stats/{year,consumables}
remain Python (aggregation) pending the Core-derived club-stats migration.

openfut-adapter-fifa17/src/fut/non_economy.rs

@@ -40,6 +40,12 @@ pub fn match_reset_body() -> Value {
     json!({})
 }
 
+/// `GET …/club/stats/staff` — production oracle returns an empty object (FIFA's
+/// staff-bonus stat set is deliberately empty; the client tolerates `{}`).
+pub fn club_stats_staff_body() -> Value {
+    json!({})
+}
+
 /// The phishing/security-question action, parsed from the URL tail.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SecurityAction {
@@ -140,6 +146,7 @@ mod tests {
         assert_eq!(settings_body(), json!({ "configs": [] }));
         assert_eq!(leaderboard_options_body(), json!({}));
         assert_eq!(match_reset_body(), json!({}));
+        assert_eq!(club_stats_staff_body(), json!({}));
     }
 
     #[test]

openfut-utas-host/src/lib.rs

@@ -114,6 +114,9 @@ pub enum Route {
     /// `GET/POST/PUT …/phishing/{trusteddevice,question,validate}` — the retired
     /// FUT security-question service, owned in Rust as a stateless ack.
     SecurityQuestion,
+    /// `GET …/club/stats/staff` — Rust-owned static `{}` (production oracle body;
+    /// FIFA's staff-bonus stat set is deliberately empty).
+    ClubStatsStaff,
     /// Anything else — proxied verbatim to the Python oracle.
     Passthrough,
 }
@@ -153,6 +156,7 @@ pub fn classify(method: &str, path: &str) -> Route {
         Some("leaderboards/options") if get => Route::LeaderboardOptions,
         Some("match/reset") if put => Route::MatchReset,
         Some(tail) if tail.starts_with("phishing/") => Route::SecurityQuestion,
+        Some("club/stats/staff") if get => Route::ClubStatsStaff,
         _ => Route::Passthrough,
     }
 }
@@ -2265,6 +2269,10 @@ impl Server {
                 eprintln!("utas-host owner=RUST route=match-reset status=200");
                 json_status(200, &non_economy::match_reset_body())
             }
+            Route::ClubStatsStaff => {
+                eprintln!("utas-host owner=RUST route=club-stats-staff status=200");
+                json_status(200, &non_economy::club_stats_staff_body())
+            }
             Route::SecurityQuestion => self.handle_security_question(method, target, headers),
             Route::Passthrough => {
                 let resp = match self.pass.forward(method, target, headers, body) {
@@ -2983,9 +2991,10 @@ mod tests {
         assert_eq!(classify("get", "/ut/game/fifa18/club"), Route::Club);
         // method must be GET
         assert_eq!(classify("PUT", "/ut/game/fifa17/club"), Route::Passthrough);
-        // near-misses stay on Python
+        // near-misses stay on Python (club/stats/year still proxied; staff is now
+        // its own Rust arm, tested in non_economy_route_ownership)
         assert_eq!(
-            classify("GET", "/ut/game/fifa17/club/stats/staff"),
+            classify("GET", "/ut/game/fifa17/club/stats/year"),
             Route::Passthrough
         );
         assert_eq!(
@@ -3479,6 +3488,11 @@ mod tests {
                 "/ut/game/fifa17/phishing/validate",
                 Route::SecurityQuestion,
             ),
+            (
+                "GET",
+                "/ut/game/fifa17/club/stats/staff",
+                Route::ClubStatsStaff,
+            ),
         ];
         for (m, p, want) in owned {
             assert_eq!(classify(m, p), *want, "OWN: {m} {p}");

openfut-utas-host/tests/host_test.rs

@@ -1377,6 +1377,11 @@ fn non_economy_routes_rust_owned_no_python_no_core() {
             serde_json::json!({}),
         ),
         ("PUT", "/ut/game/fifa17/match/reset", serde_json::json!({})),
+        (
+            "GET",
+            "/ut/game/fifa17/club/stats/staff",
+            serde_json::json!({}),
+        ),
     ];
     for (m, p, want) in cases {
         let resp = server.handle(m, p, &[], b"");