feat(fifa17): real player-contract consumable apply, replacing the probe

POST /ut/game/fifa17/item/resource/<rid> {"apply":[{"id":N}]} now performs a
durable atomic contract application instead of falling through to Python.

THE RULE. grant = fcc_contractcards[card][tier(TARGET.rating)], then
min(99, contract + grant). The column is keyed on the TARGET's tier, NOT the
card's own -- all 36 cells of EA's shipped table match the published FIFA 17
matrix, and staging discriminates the two readings outright: a bronze-RARE
card on a rating-89 player granted 3 (the gold column), where the card-level
reading predicts 15.

No client binary reads fcc_contractcards -- a string scan of every .exe/.dll
in the install finds it referenced nowhere, and CardsDLL reads only 14 fcc_
tables (fcc_discardcoins among them, which is why quick-sell prices locally).
Consumable effects are server-authoritative, so EA's shipped table is the only
non-invented source and the client renders whatever we persist and re-serve.

The host computes the grant, Core owns the mutation -- the same split
quick-sell already uses (host prices via discard_value, Core performs
sell_item), and what migration 0027 means by "Core defines NO per-category
formula".

FAILS CLOSED, never 200-and-do-nothing: manager contracts 409 because staff
ratings are unimported so the target tier is unknowable; every other family
409 as unproven; batch 400; unresolvable operand 404. Core's deterministic
refusals pass through with their own status instead of collapsing to 503,
which would tell the client to retry a request that can never succeed.

`contract: 7` stops being a hardcode in shape_item/shape_staff_item and
becomes the fallback for an instance Core tracks no contract for. `fitness: 99`
is the same class of hardcode and is deliberately untouched.

CLEAN CUTOVER: Route::ConsumableApplyProbe, its handler, apply_probe_enabled,
the OPENFUT_FIFA17_APPLY_PROBE gate and both probe scripts are deleted. A
handler no classifier can reach is this repo's recurring defect class, and the
new economy arm preempts the probe. fifa17-migration-rehearse.py also drove
the probe (spelled "apply probe", so an apply-probe grep missed it) and would
have eaten a card off the rehearsal profile; retargeted to a non-mutating
assertion.

Not implemented, on purpose: the stored-manager bonus (real mechanic, rule
appears in no shipped table -- guessing it would corrupt the proven part) and
contract decrement per match (nothing spends contracts yet).

openfut-utas-host/src/economy_store.rs

@@ -24,6 +24,7 @@ use rand::Rng;
 use serde_json::{json, Value};
 
 use openfut_adapter_fifa17::fut::club_response::shape_club_response;
+use openfut_adapter_fifa17::fut::contract_cards::PACK_FRESH_CONTRACT_MATCHES;
 use openfut_adapter_fifa17::fut::economy_policy::pack_price;
 use openfut_adapter_fifa17::fut::entities::Fifa17Entities;
 use openfut_adapter_fifa17::fut::item::{shape_item, CoreOwnedItem, ItemIdentityResolver};
@@ -106,6 +107,9 @@ fn core_owned(m: &Minted) -> CoreOwnedItem {
         league: m.card.league.clone(),
         club: m.card.club.clone(),
         attributes: m.card.attributes,
+        // Freshly minted by a pack/Store open, so Core tracks no contract for it
+        // yet: the shaper substitutes the pack-fresh default.
+        contract_matches: None,
     }
 }
 
@@ -167,6 +171,10 @@ fn shape_minted(deps: &StoreDeps<'_>, minted: &[Minted]) -> Vec<Value> {
                 id,
                 deps.entities,
                 deps.assets.discard_value(&item),
+                // A pack-pulled card is by definition pack-fresh, so it carries
+                // the default rather than a persisted count: Core has not yet
+                // stored this instance, let alone applied a contract to it.
+                item.contract_matches.unwrap_or(PACK_FRESH_CONTRACT_MATCHES),
             ))
         })
         .collect()
@@ -464,8 +472,8 @@ mod tests {
     use std::sync::atomic::{AtomicI64, AtomicU32, Ordering};
 
     use crate::{
-        CoreMatchCompletion, CoreMatchReceipt, EconomyEntitlement, EconomyPurchase, EconomySale,
-        EconomySaleReceipt,
+        ConsumableApplyOutcome, ConsumableApplyRequest, CoreMatchCompletion, CoreMatchReceipt,
+        EconomyEntitlement, EconomyPurchase, EconomySale, EconomySaleReceipt,
     };
 
     // ── Recording economy double ────────────────────────────────────────────
@@ -608,6 +616,13 @@ mod tests {
             // Match completion is not exercised by the Store/quick-sell paths.
             Err(CoreError::Status(501))
         }
+        fn apply_consumable(
+            &self,
+            _req: &ConsumableApplyRequest<'_>,
+        ) -> Result<ConsumableApplyOutcome, CoreError> {
+            // Consumable apply is not exercised by the Store/quick-sell paths.
+            Err(CoreError::Status(501))
+        }
     }
 
     // ── Identity / entity / lookup doubles ──────────────────────────────────
@@ -986,6 +1001,7 @@ mod tests {
             league: "Premier League".into(),
             club: "Arsenal".into(),
             attributes: [rating; 6],
+            contract_matches: None,
         }
     }