fifa17-python: commit working FUT backend deployment (client/server split)

Freeze the running offline FUT backend into version control as
fifa17-recon/docker/fifa17-python/ - declarative and rebuildable from a
fresh checkout:

* OPENFUT_BIND / OPENFUT_ADVERTISE client/server split in the responders
  (lsx, blaze, roster, utas, pow) + entrypoint.sh; OPENFUT_ADVERTISE is
  required for remote mode (compose and entrypoint fail without it)
* docker-compose.yml reproducing the frozen baseline container exactly
  (env, ports incl. the 8085->8080 POW-content remap, /state bind, restart)
* .env.example / .env for site config - the LAN IP is never hardcoded in source
* tools/ + data/ staged from openfut-fut-backend:python-baseline-2026-08-10,
  verified byte-identical to the running container at freeze time
* client_arm.sh (the 105 client-side arming counterpart)
* Dockerfile bakes /app/SHA256SUMS.txt so any image is self-identifying
* docs/BASELINE-python-2026-08-10.md: frozen image/container/hash record,
  restore instructions and rebuild-equivalence procedure

Secrets (redir key/cert, .env) and runtime state (docker/state) stay gitignored.
The live container is untouched pending the .105 launcher audit.

fifa17-recon/docker/fifa17-python/tools/memtool.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Live FIFA17 /proc/mem reader + patcher.
+Usage:
+  memtool.py read  <va_hex> [nbytes]
+  memtool.py patch <va_hex> <hexbytes>      # saves original to /tmp/orig_<va>.bin
+  memtool.py restore <va_hex>
+"""
+import sys, os, glob
+
+def find_pid():
+    for d in glob.glob('/proc/[0-9]*'):
+        try:
+            if open(d+'/comm').read().strip() == 'FIFA17.exe':
+                return int(d.split('/')[-1])
+        except Exception:
+            pass
+    raise SystemExit("FIFA17.exe not found")
+
+def main():
+    cmd = sys.argv[1]
+    va = int(sys.argv[2], 16)
+    pid = find_pid()
+    path = f'/proc/{pid}/mem'
+    if cmd == 'read':
+        n = int(sys.argv[3]) if len(sys.argv) > 3 else 16
+        with open(path, 'rb') as f:
+            f.seek(va); data = f.read(n)
+        print(f"pid={pid} va={va:#x} : " + data.hex())
+    elif cmd == 'patch':
+        patch = bytes.fromhex(sys.argv[3])
+        with open(path, 'rb') as f:
+            f.seek(va); orig = f.read(len(patch))
+        open(f'/tmp/orig_{va:x}.bin', 'wb').write(orig)
+        with open(path, 'r+b') as f:
+            f.seek(va); f.write(patch)
+            f.seek(va); check = f.read(len(patch))
+        print(f"pid={pid} va={va:#x} orig={orig.hex()} -> now={check.hex()}")
+    elif cmd == 'restore':
+        orig = open(f'/tmp/orig_{va:x}.bin', 'rb').read()
+        with open(path, 'r+b') as f:
+            f.seek(va); f.write(orig)
+            f.seek(va); check = f.read(len(orig))
+        print(f"pid={pid} va={va:#x} restored={check.hex()}")
+
+main()