fifa17-recon: reconcile authoritative tools with running backend (B)

- Add 8 files present in docker/fifa17-python/tools but missing from the
  top-level tree: fut_accounts.py + 7 test_*.py contracts (all committed in
  the server's docker tree; byte-identical to the running image).
- Preserve newer responder work already matching the running container:
  utas_server.py (offlineSeason), lsx_responder_v2.py (OPENFUT_BIND),
  blaze_responder_v3b.py, autopatch.py, pow_server.py, fut_store.py,
  test_fut_contract.py, fifa17-hook-m1.sh.
- Add 30 newer ghidra_queries (draft purchase/state, SBC 9-26, runtime
  registries). Local tree is now a strict superset of B with all shared
  files byte-identical.

fifa17-recon/tools/lsx_responder_v2.py

@@ -162,6 +162,22 @@ def log(*a):
     print("[lsx]", *a, flush=True)
 
 
+_SECRET_ATTR_RE = re.compile(
+    r'(?i)\b(AuthCode|AuthToken|SessionKey|Token|Sid)="[^"]*"')
+_AUTH_CODE_ATTR_RE = re.compile(r'(?i)\b(value|Code|Return)="[^"]*"')
+_CHALLENGE_ATTR_RE = re.compile(r'(?i)\b(response)="[^"]*"')
+
+
+def safe_xml_for_log(xml):
+    """Redact credential-bearing LSX attributes from ordinary diagnostics."""
+    safe = _SECRET_ATTR_RE.sub(lambda m: '%s="[REDACTED]"' % m.group(1), xml)
+    if "<AuthCode " in safe:
+        safe = _AUTH_CODE_ATTR_RE.sub(lambda m: '%s="[REDACTED]"' % m.group(1), safe)
+    if "<ChallengeAccepted " in safe:
+        safe = _CHALLENGE_ATTR_RE.sub(lambda m: '%s="[REDACTED]"' % m.group(1), safe)
+    return safe
+
+
 # ---------------------------------------------------------------- crypto
 # (verbatim from v1 -- verified end-to-end by decrypting captured
 #  captures/lsx/lsx_raw/C1_ENC-IN_*.bin.  DO NOT TOUCH.)
@@ -389,8 +405,7 @@ def build_reply(mid, req_name, attrs, conn, recipient=""):
             conn.stop_events = True
         log("*** GetAuthCode ISSUED ***")
         log(f"    ClientId={client_id!r}  Scope={scope!r}")
-        log(f"    code={code}  -- this must arrive as Blaze "
-            f"LoginRequest.AUTH in Authentication::login (1/0x0A)")
+        log("    code=[REDACTED] -- issued for Blaze Authentication::login (1/0x0A)")
         return resp(mid,
                     f'AuthCode value="{code}" Code="{code}" Return="{code}"')
 
@@ -489,8 +504,7 @@ def serve(sock, addr):
         client_resp = mr.group(1) if mr else ""
         h = challenge_response(client_key, client_resp)
         conn.key = derive_session_key(h)
-        log(f"client key={client_key} response={h[:16]}... "
-            f"session_key={conn.key.hex()}")
+        log("handshake accepted; session crypto initialized")
 
         # 3. plaintext ChallengeAccepted
         conn.send_plain(resp(1, f'ChallengeAccepted response="{h}"', "EALS"))
@@ -525,7 +539,7 @@ def serve(sock, addr):
                     continue
                 mm = REQ_RE.search(xml)
                 if not mm:
-                    log("<<", xml)
+                    log("<<", safe_xml_for_log(xml))
                     continue
                 mid, name, rest = mm.group(1), mm.group(2), mm.group(3)
                 attrs = dict(ATTR_RE.findall(rest))
@@ -533,7 +547,7 @@ def serve(sock, addr):
                 recip = rm.group(1) if rm else ""
                 reply = build_reply(mid, name, attrs, conn, recip)
                 log(f"<< id={mid} {name} recipient={recip!r} {attrs}")
-                log(f">> {reply}")
+                log(">>", safe_xml_for_log(reply))
                 conn.send_enc(reply)
 
                 why = PUSH_AFTER.get(name)
@@ -591,7 +605,12 @@ def selftest():
     # 'value' is the only attribute lsx::AuthCodeT's deserializer (0x1471312a0)
     # actually reads; Code=/Return= are legacy padding.
     assert '<AuthCode value=' in r, r
-    print("[ok] GetAuthCode ->", r)
+    redacted = safe_xml_for_log(
+        '<AuthCode value="secret" Code="secret" Return="secret"/>')
+    assert "secret" not in redacted and redacted.count("[REDACTED]") == 3, redacted
+    status = safe_xml_for_log('<ErrorSuccess Code="0" Description=""/>')
+    assert 'Code="0"' in status, status
+    print("[ok] GetAuthCode response shape and log redaction")
     print("[ok] selftest passed")