fifa17-python: commit working FUT backend deployment (client/server split)

Freeze the running offline FUT backend into version control as
fifa17-recon/docker/fifa17-python/ - declarative and rebuildable from a
fresh checkout:

* OPENFUT_BIND / OPENFUT_ADVERTISE client/server split in the responders
  (lsx, blaze, roster, utas, pow) + entrypoint.sh; OPENFUT_ADVERTISE is
  required for remote mode (compose and entrypoint fail without it)
* docker-compose.yml reproducing the frozen baseline container exactly
  (env, ports incl. the 8085->8080 POW-content remap, /state bind, restart)
* .env.example / .env for site config - the LAN IP is never hardcoded in source
* tools/ + data/ staged from openfut-fut-backend:python-baseline-2026-08-10,
  verified byte-identical to the running container at freeze time
* client_arm.sh (the 105 client-side arming counterpart)
* Dockerfile bakes /app/SHA256SUMS.txt so any image is self-identifying
* docs/BASELINE-python-2026-08-10.md: frozen image/container/hash record,
  restore instructions and rebuild-equivalence procedure

Secrets (redir key/cert, .env) and runtime state (docker/state) stay gitignored.
The live container is untouched pending the .105 launcher audit.

fifa17-recon/docker/fifa17-python/data/positions_curated.json

@@ -0,0 +1,19 @@
+{
+"155862": "CB",
+"158023": "RW",
+"167495": "GK",
+"176580": "ST",
+"177003": "CM",
+"182521": "CM",
+"183277": "LM",
+"183907": "CB",
+"184941": "CB",
+"188545": "ST",
+"189332": "LB",
+"190871": "LW",
+"192985": "RM",
+"197445": "LB",
+"200389": "GK",
+"202126": "ST",
+"20801": "LW"
+}