fifa17-python: commit working FUT backend deployment (client/server split)

Freeze the running offline FUT backend into version control as
fifa17-recon/docker/fifa17-python/ - declarative and rebuildable from a
fresh checkout:

* OPENFUT_BIND / OPENFUT_ADVERTISE client/server split in the responders
  (lsx, blaze, roster, utas, pow) + entrypoint.sh; OPENFUT_ADVERTISE is
  required for remote mode (compose and entrypoint fail without it)
* docker-compose.yml reproducing the frozen baseline container exactly
  (env, ports incl. the 8085->8080 POW-content remap, /state bind, restart)
* .env.example / .env for site config - the LAN IP is never hardcoded in source
* tools/ + data/ staged from openfut-fut-backend:python-baseline-2026-08-10,
  verified byte-identical to the running container at freeze time
* client_arm.sh (the 105 client-side arming counterpart)
* Dockerfile bakes /app/SHA256SUMS.txt so any image is self-identifying
* docs/BASELINE-python-2026-08-10.md: frozen image/container/hash record,
  restore instructions and rebuild-equivalence procedure

Secrets (redir key/cert, .env) and runtime state (docker/state) stay gitignored.
The live container is untouched pending the .105 launcher audit.

fifa17-recon/docker/fifa17-python/.env.example

@@ -0,0 +1,11 @@
+# Copy to .env in this directory. Required for remote deployment.
+#
+# OPENFUT_ADVERTISE — the address of THIS host as seen from the game machine
+# (105). The responders advertise it to the client for every next hop (Blaze,
+# roster, UTAS, POW). Compose refuses to start without it.
+OPENFUT_ADVERTISE=10.10.0.120
+
+# OPENFUT_BIND — address the listeners bind inside the container.
+# Defaults to 0.0.0.0 (container-facing); the original all-on-localhost flow
+# uses the loopback default baked into the responders when unset.
+OPENFUT_BIND=0.0.0.0