feat(utas): FIFA17 UTAS migration host + /club adapter mappings

openfut-utas-host: the first live UTAS host. Serves GET /ut/game/<title>/club
from OpenFUT Core via the FIFA17 adapter and reverse-proxies every other UTAS
route verbatim to the Python oracle. Plaintext HTTP/1.1 keep-alive (no TLS);
route classification before execution; a Core error on /club degrades to an
empty page and never falls back to Python. CoreAccess is a host-owned boundary
(the adapter stays transport-agnostic).

openfut-adapter-fifa17::fut: owned_query (wire parse + FIFA id->name mapping,
unknown id = hard error), entities (id<->name from committed tables), and
club_response (FIFA _item shaping; drops items lacking a real FIFA asset id,
never fabricates one).

openfut-core submodule advanced to the reconciled trunk (6acae54 = 8c8a4116
multi-game + eab522a replace_squad/SquadRules + the /club semantic query).
11 host tests + adapter fut tests; 10/10 host mutations killed. rare=SP UNKNOWN.
Retail rendering of Core inventory still blocked on the Core-card->asset-id
identity decision (next phase).

openfut-utas-host/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "openfut-utas-host"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+description = "FIFA 17 UTAS migration host: serves implemented routes (/club) from OpenFUT Core, transparently proxies everything else to the Python UTAS oracle"
+publish = false
+
+[dependencies]
+openfut-adapter-fifa17 = { path = "../openfut-adapter-fifa17" }
+openfut-http = { path = "../openfut-http" }
+serde_json = "1"
+# Plain-HTTP client for Core queries and Python passthrough. UTAS is plaintext
+# HTTP (worker D: no wrap_socket, no cert), so no TLS backend is linked.
+reqwest = { version = "0.11", default-features = false, features = ["blocking", "json"] }
+
+[dev-dependencies]
+parking_lot = "0.12"