feat(fifa17): own club/stats/staff (empty stat set) in Rust

Migrate GET club/stats/staff from the Python proxy to a Rust static handler.
The production oracle returns {} for the staff-bonus stat set (deliberately
empty); the Rust host now owns it (owner=RUST route=club-stats-staff). Updates
classify(), the pre-existing near-miss test (now club/stats/year), the ownership
matrix test, and the no-fallback integration test. club/stats/{year,consumables}
remain Python (aggregation) pending the Core-derived club-stats migration.

openfut-utas-host/src/lib.rs

@@ -114,6 +114,9 @@ pub enum Route {
     /// `GET/POST/PUT …/phishing/{trusteddevice,question,validate}` — the retired
     /// FUT security-question service, owned in Rust as a stateless ack.
     SecurityQuestion,
+    /// `GET …/club/stats/staff` — Rust-owned static `{}` (production oracle body;
+    /// FIFA's staff-bonus stat set is deliberately empty).
+    ClubStatsStaff,
     /// Anything else — proxied verbatim to the Python oracle.
     Passthrough,
 }
@@ -153,6 +156,7 @@ pub fn classify(method: &str, path: &str) -> Route {
         Some("leaderboards/options") if get => Route::LeaderboardOptions,
         Some("match/reset") if put => Route::MatchReset,
         Some(tail) if tail.starts_with("phishing/") => Route::SecurityQuestion,
+        Some("club/stats/staff") if get => Route::ClubStatsStaff,
         _ => Route::Passthrough,
     }
 }
@@ -2265,6 +2269,10 @@ impl Server {
                 eprintln!("utas-host owner=RUST route=match-reset status=200");
                 json_status(200, &non_economy::match_reset_body())
             }
+            Route::ClubStatsStaff => {
+                eprintln!("utas-host owner=RUST route=club-stats-staff status=200");
+                json_status(200, &non_economy::club_stats_staff_body())
+            }
             Route::SecurityQuestion => self.handle_security_question(method, target, headers),
             Route::Passthrough => {
                 let resp = match self.pass.forward(method, target, headers, body) {
@@ -2983,9 +2991,10 @@ mod tests {
         assert_eq!(classify("get", "/ut/game/fifa18/club"), Route::Club);
         // method must be GET
         assert_eq!(classify("PUT", "/ut/game/fifa17/club"), Route::Passthrough);
-        // near-misses stay on Python
+        // near-misses stay on Python (club/stats/year still proxied; staff is now
+        // its own Rust arm, tested in non_economy_route_ownership)
         assert_eq!(
-            classify("GET", "/ut/game/fifa17/club/stats/staff"),
+            classify("GET", "/ut/game/fifa17/club/stats/year"),
             Route::Passthrough
         );
         assert_eq!(
@@ -3479,6 +3488,11 @@ mod tests {
                 "/ut/game/fifa17/phishing/validate",
                 Route::SecurityQuestion,
             ),
+            (
+                "GET",
+                "/ut/game/fifa17/club/stats/staff",
+                Route::ClubStatsStaff,
+            ),
         ];
         for (m, p, want) in owned {
             assert_eq!(classify(m, p), *want, "OWN: {m} {p}");