fix(market): make the transfer market work end-to-end (live-verified)

Four defects found by driving a real FIFA 17 client. Each was independently
sufficient to break listing, so all four had to go:

1. Every owned card was shaped `untradeable: true` (adapter item.rs), so the
   client greyed out "Place/List on Transfer Market" for the whole club. Owned
   and pack-pulled cards are TRADEABLE in FIFA 17; the oracle forces this off
   for owned copies too (item_def keeps `true`; instances do not).

2. `POST /auctionhouse` required `itemData.resourceId`, which the client's
   FutISStart body never sends (the oracle lists by wire id ALONE). Missing it,
   the handler fail-closed and returned 200 while persisting NOTHING. It now
   resolves server-side: wire id -> Core owned instance -> its card_id (minted on
   a synthetic buy) + FIFA resourceId (the auction record). This also enforces
   that a listing can only name a card the club actually owns.

3. An auction record's `itemData` was a 4-field STUB, so the Transfer List had a
   row the client could not draw -> "1 item listed" but no visible sale. A
   listing now persists a full shaped-card SNAPSHOT (new `listings.item_json`,
   additive migration) built by the same `shape_item` shaper `/club` and the
   squad projection use, so the auction card renders identically to the club
   card. The seller's own pile stamps `itemState: listFS`; market search keeps
   `forSale` (the oracle distinguishes these).

4. `/tradePile/counts` shared a handler with `/tradePile`. They are DIFFERENT
   deserializers: `/counts` is FutGetAuctionCount, five scalar ints
   (count/maxAuctionsAllowed/offered/selling/sold) that it reads and skips
   everything else. Served the `auctionInfo` body it left every count at 0, so
   the Transfer List screen showed no active sale while the hub tile showed one.
   New Route::MarketCounts, classified BEFORE the base tradePile matcher (which
   also accepts the /counts path).

Also: a listed card no longer appears in the club. `/club` and the hub's
`clubPlayers` now exclude the transfer pile. Pile membership is host-owned state
Core cannot filter on, so when anything is hidden `/club` reuses the existing
local-filter path (the one `rare=SP` already needed) and paginates the
club-visible set -- letting Core paginate would return short pages. With nothing
hidden the fast Core-paginated path is untouched, and only an EXPLICIT non-club
pile hides a card, so no-pile-row items still default to the club.

Fixed 5 pre-existing test fixtures across 4 targets that listed FABRICATED wire
ids -- only "valid" because the old handler skipped the ownership check.

Tests: 14 targets green + clippy clean, incl. new coverage for the 5-int tally
(asserting it must NOT carry auctionInfo), the full-card snapshot + listFS, and
club pile-exclusion with full-width pagination. The differential test against the
live Python oracle passes.

Verified live on prod: listed=true with a 21-field snapshot; counts
{count:1,selling:1,maxAuctionsAllowed:100}; tradePile renders the 94-rated card;
clubPlayers 1966 -> 1961 (exactly the 5 trade-pile items); listed wire absent
from the club page. Operator confirmed the card is visible in the Transfer List.

openfut-utas-host/tests/economy_differential.rs

@@ -407,7 +407,7 @@ fn pack_ids(pg: &Value) -> Vec<u64> {
 fn run_differential(core_base: &str, oracle: &Oracle, dir: &std::path::Path) {
     wait_ready(core_base);
     let http = reqwest::blocking::Client::new();
-    let (server, client, sample_resource) = build_econ_server(core_base, dir);
+    let (server, client, _sample_resource) = build_econ_server(core_base, dir);
 
     // ── Fixture alignment: both sides own exactly one pack-70 entitlement. ──
     // Oracle: fresh profile already owns pack 70. Core: grant the "70" entitlement
@@ -847,7 +847,20 @@ fn run_differential(core_base: &str, oracle: &Oracle, dir: &std::path::Path) {
         None,
     );
     let o_trade_id = o_list["id"].as_i64().expect("oracle trade id");
-    let (r_ls, r_list) = rust(&server, "POST", "/ut/game/fifa17/auctionhouse", format!(r#"{{"itemData":{{"id":777,"resourceId":{sample_resource}}},"buyNowPrice":1000,"startingBid":500}}"#).as_bytes(), None);
+    // Same body shape as the oracle: the wire id ALONE (the server resolves the
+    // owned card's card_id + resourceId from inventory). `r_wire[1]` is the card
+    // moved to the trade pile in OP 9 — the Rust parallel of the oracle's o_wire[1].
+    let (r_ls, r_list) = rust(
+        &server,
+        "POST",
+        "/ut/game/fifa17/auctionhouse",
+        format!(
+            r#"{{"itemData":{{"id":{}}},"buyNowPrice":1000,"startingBid":500}}"#,
+            r_wire[1]
+        )
+        .as_bytes(),
+        None,
+    );
     let r_trade_id = r_list["id"].as_i64().expect("rust trade id");
     assert_eq!(o_ls, 200);
     assert_eq!(r_ls, 200, "market list status parity");
@@ -992,7 +1005,19 @@ fn run_differential(core_base: &str, oracle: &Oracle, dir: &std::path::Path) {
         "oracle cancelled listing gone from tradePile"
     );
     // Rust: list a fresh item, cancel it, then a buy is a 0-delta empty auction.
-    let clist = rust(&server, "POST", "/ut/game/fifa17/auctionhouse", format!(r#"{{"itemData":{{"id":888,"resourceId":{sample_resource}}},"buyNowPrice":1000,"startingBid":500}}"#).as_bytes(), None).1;
+    // A still-owned card (r_wire[0]/[3] were quick-sold, [1] is listed above).
+    let clist = rust(
+        &server,
+        "POST",
+        "/ut/game/fifa17/auctionhouse",
+        format!(
+            r#"{{"itemData":{{"id":{}}},"buyNowPrice":1000,"startingBid":500}}"#,
+            r_wire[2]
+        )
+        .as_bytes(),
+        None,
+    )
+    .1;
     let r_cancel_id = clist["id"].as_i64().unwrap();
     let (r_cs, _) = rust(
         &server,