Initial commit: OpenFUT Core + Bridge scaffold

Two-repo monorepo for an offline FUT backend inspired by SPT.

openfut-core: game-independent REST API backend (Axum, SQLite, SQLx)
- 19 API endpoints: auth, profiles, clubs, cards, packs, squads,
  objectives, SBCs, match rewards, NPC market, statistics
- JSON-driven card/pack/objective/SBC data (fully moddable)
- SQLx migrations, weighted pack generator, SBC validation engine
- 5 integration tests passing

openfut-bridge: FIFA 23 traffic proxy + reverse-engineering scaffold
- Catch-all HTTP proxy with request capture to captures/
- Known-route mapper (FUT paths → Core API calls)
- Placeholder responses for unknown endpoints
- Admin endpoints: captures, unknown endpoint list
- 4 unit tests passing

cargo fmt ✓  cargo clippy -D warnings ✓  cargo test ✓

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openfut-bridge/docs/reverse-engineering.md

@@ -0,0 +1,85 @@
+# Reverse Engineering Notes — FIFA 23 FUT API
+
+This document tracks what is known and unknown about EA's FUT API as used by FIFA 23.
+
+---
+
+## Status
+
+🔴 Very early — almost nothing confirmed. All mappings in `src/mapper.rs` are speculative.
+
+---
+
+## Known / Suspected Endpoints
+
+These are guesses based on:
+- Common FUT API patterns from public research
+- Observations from older FIFA titles
+- Community reverse-engineering work
+
+| Method | Path | Purpose | Status |
+|---|---|---|---|
+| `POST` | `/ut/auth` | Authentication / session | Suspected |
+| `GET` | `/ut/game/fut/user/settings` | User settings | Suspected |
+| `GET` | `/ut/game/fut/usermassinfo` | Club + profile bulk | Suspected |
+| `GET` | `/ut/game/fut/squad/active` | Active squad | Suspected |
+| `GET` | `/ut/game/fut/store/packdetails` | Pack store | Suspected |
+| `GET` | `/ut/game/fut/transfermarket` | Transfer market | Suspected |
+
+---
+
+## Unknown Endpoints
+
+Run `GET /_bridge/unknown` after a game session to see what new routes appeared.
+Each entry represents a real FIFA 23 request that hasn't been mapped yet.
+
+---
+
+## Request Format Notes
+
+### Auth
+
+EA FUT auth appears to use a multi-step token flow:
+1. EA account auth (OAuth2-style)
+2. FUT-specific auth with a "nucleus ID"
+3. Session token issued
+
+For offline purposes, OpenFUT Bridge returns a static token that satisfies the client.
+
+### Headers
+
+Common headers seen in FUT traffic:
+- `X-UT-SID` — session token
+- `X-UT-PHISHING-TOKEN` — anti-CSRF token
+- `Content-Type: application/json`
+- `X-HTTP-Method-Override` — EA sometimes uses POST + this header instead of DELETE/PUT
+
+---
+
+## Tools
+
+- [mitmproxy](https://mitmproxy.org/) — HTTPS interception
+- [Fiddler](https://www.telerik.com/fiddler) — Windows-friendly proxy
+- Wireshark — low-level packet capture
+- OpenFUT Bridge `captures/` folder — automatic request logging
+
+---
+
+## Resources
+
+- Previous FIFA FUT API research: search GitHub for "fifa-ut-api", "easfc", "futapi"
+- ea.com documentation: none public
+- Community wikis: FUT Trading community resources
+
+---
+
+## TODO
+
+- [ ] Capture a real FIFA 23 session via mitmproxy
+- [ ] Document the auth flow completely
+- [ ] Map the squad endpoints
+- [ ] Map the pack opening endpoints
+- [ ] Map the objectives endpoints
+- [ ] Map the SBC endpoints
+- [ ] Map the transfer market endpoints
+- [ ] Identify which endpoints are critical vs optional