feat: replace hosts file with DLL injection hook

Adds openfut-hook/, a Windows DLL (cdylib, x86_64-pc-windows-gnu) that
patches the IAT of FIFA 23 at load time to redirect getaddrinfo calls
for fut.ea.com / utas.*.fut.ea.com to 127.0.0.1, sending all FUT
traffic to the local bridge — no /etc/hosts changes needed.

Deployment: the launcher copies openfut_hook.dll into the FIFA 23 game
folder as version.dll (a DLL FIFA loads but delegates to system).
Proton picks up the local copy automatically when you set:
  WINEDLLOVERRIDES="version=n,b" %command%
in Steam launch options.

Also updates cert install to try the Wine/Proton cert store (wine
certutil) before falling back to the Linux system CA store, and removes
all hosts file code from setup.rs / app.rs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openfut-hook/src/hooks.rs

@@ -0,0 +1,44 @@
+/// Network hooks — redirect EA FUT hostnames to localhost.
+use std::{ffi::CStr, sync::OnceLock};
+
+use windows_sys::Win32::Networking::WinSock::{ADDRINFOA, getaddrinfo as sys_getaddrinfo};
+
+const INTERCEPT: &[&str] = &[
+    "fut.ea.com",
+    "utas.mob.v4.fut.ea.com",
+    "utas.s2.fut.ea.com",
+];
+
+type GetaddrinfoFn = unsafe extern "system" fn(
+    *const u8,
+    *const u8,
+    *const ADDRINFOA,
+    *mut *mut ADDRINFOA,
+) -> i32;
+
+static REAL: OnceLock<GetaddrinfoFn> = OnceLock::new();
+
+pub fn set_real(f: GetaddrinfoFn) {
+    let _ = REAL.set(f);
+}
+
+pub unsafe extern "system" fn hooked_getaddrinfo(
+    node_name: *const u8,
+    service_name: *const u8,
+    hints: *const ADDRINFOA,
+    result: *mut *mut ADDRINFOA,
+) -> i32 {
+    if !node_name.is_null() {
+        if let Ok(host) = CStr::from_ptr(node_name as *const i8).to_str() {
+            for target in INTERCEPT {
+                if host.eq_ignore_ascii_case(target) {
+                    let local = b"127.0.0.1\0";
+                    let real = REAL.get().copied().unwrap_or(sys_getaddrinfo);
+                    return real(local.as_ptr(), service_name, hints, result);
+                }
+            }
+        }
+    }
+    let real = REAL.get().copied().unwrap_or(sys_getaddrinfo);
+    real(node_name, service_name, hints, result)
+}