Initial commit: OpenFUT Core + Bridge scaffold

Two-repo monorepo for an offline FUT backend inspired by SPT.

openfut-core: game-independent REST API backend (Axum, SQLite, SQLx)
- 19 API endpoints: auth, profiles, clubs, cards, packs, squads,
  objectives, SBCs, match rewards, NPC market, statistics
- JSON-driven card/pack/objective/SBC data (fully moddable)
- SQLx migrations, weighted pack generator, SBC validation engine
- 5 integration tests passing

openfut-bridge: FIFA 23 traffic proxy + reverse-engineering scaffold
- Catch-all HTTP proxy with request capture to captures/
- Known-route mapper (FUT paths → Core API calls)
- Placeholder responses for unknown endpoints
- Admin endpoints: captures, unknown endpoint list
- 4 unit tests passing

cargo fmt ✓  cargo clippy -D warnings ✓  cargo test ✓

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openfut-bridge/TODO.md

@@ -0,0 +1,36 @@
+# OpenFUT Bridge — TODO
+
+## Reverse Engineering
+- [ ] #1 Set up mitmproxy and capture a real FIFA 23 FUT session
+- [ ] #2 Document all observed endpoints in `docs/endpoint-map.md`
+- [ ] #3 Document FIFA 23 auth flow (token format, headers, session lifecycle)
+- [ ] #4 Document request body formats for auth, squad, packs
+- [ ] #5 Identify which endpoints are mandatory vs optional for FUT to load
+- [ ] #6 Test hosts-file redirect approach on PC
+- [ ] #7 Research certificate pinning in FIFA 23 PC build
+- [ ] #8 Test RPCS3 network proxy configuration
+- [ ] #9 Document response formats EA uses (some differ from request format)
+- [ ] #10 Identify any binary/protobuf endpoints (most are JSON but verify)
+
+## Proxy
+- [ ] #11 Add TLS support (self-signed cert) so FIFA 23 connects via HTTPS
+- [ ] #12 Add replay CLI: `openfut-bridge replay captures/some_file.json`
+- [ ] #13 Add `DELETE /_bridge/captures` to wipe capture folder
+- [ ] #14 Add capture deduplication (same method+path within 1 second)
+- [ ] #15 Add request diff tool: show what changed between two captures
+
+## Mapper
+- [ ] #16 Implement actual auth endpoint mapping (static token response)
+- [ ] #17 Map squad read endpoint when confirmed
+- [ ] #18 Map pack details endpoint when confirmed
+- [ ] #19 Add X-UT-SID session header pass-through to Core
+- [ ] #20 Add phishing token passthrough
+
+## Admin UI
+- [ ] #21 Build a simple web dashboard for viewing captures
+- [ ] #22 Add endpoint status page (known vs unknown vs confirmed)
+- [ ] #23 Add live capture stream via SSE
+
+## Testing
+- [ ] #24 Add test for placeholder response format
+- [ ] #25 Add integration test that fires real HTTP at the Bridge