feat(host): migrate non-economy UTAS routes to Rust + launcher redesign

Host/adapter (deployed to prod-host):
- POST /ut/auth (+/ut/delete/auth): Rust mints sid, opens Rust session, adopts
  persona from body; POST /openfut/account/sync full Rust envelope.
- GET /userMassInfo: full Rust (was proxy+overlay), shared build_user_mass_info.
- GET/PUT /clientdata/<key>: new clientdata_store.rs (JSON-persisted).
- GET /club/stats/{country,league,team}: context-aware club_stats_body
  (nation/league/team buckets).
- GET /store,/match/keepalive,/captcha,/tfa,/livemessage,/activeMessage: StaticAck.
- GET /watchList, /squad/0, /user: Rust handlers.
- host_test.rs updated for the new routing.

Launcher: bump gitlink to c277213 (shareholder-grade redesign + live account panel).

Docs: PRODUCTION_AUTHORITY_MATRIX, PYTHON_RETIREMENT_PLAN, MATCH_LIFECYCLE, and
route-shapes-2026-08-17 reference fixtures for the still-Python tail.

openfut-utas-host/src/config.rs

@@ -34,6 +34,11 @@ pub struct HostConfig {
     /// Durable FIFA17 item-pile metadata DB (host-owned SQLite). Required; must
     /// survive host restart. Env `OPENFUT_PILE_DB`.
     pub pile_db_path: String,
+    /// Durable client-data blob store (`clientdata`/`userHubData`), host-owned
+    /// JSON file. NOT required: defaults to env `OPENFUT_CLIENTDATA_DB`, else the
+    /// identity store's parent directory + `clientdata.json`. The blobs are
+    /// non-authoritative client UI state, so a default path is safe.
+    pub clientdata_path: String,
 }
 
 #[derive(Debug)]
@@ -68,6 +73,11 @@ fn required_i64_nonzero(key: &str) -> Result<i64, ConfigError> {
 
 impl HostConfig {
     pub fn from_env() -> Result<Self, ConfigError> {
+        let identity_store_path = required("OPENFUT_IDENTITY_STORE")?;
+        let clientdata_path = env::var("OPENFUT_CLIENTDATA_DB")
+            .ok()
+            .filter(|v| !v.is_empty())
+            .unwrap_or_else(|| default_clientdata_path(&identity_store_path));
         Ok(HostConfig {
             listen_addr: required("OPENFUT_UTAS_HOST_ADDR")?,
             python_upstream: required("OPENFUT_UTAS_PYTHON_URL")?,
@@ -76,10 +86,22 @@ impl HostConfig {
             tables_dir: env::var("OPENFUT_FIFA17_TABLES_DIR")
                 .unwrap_or_else(|_| "fifa17-recon/data/tables".into()),
             catalog_path: required("OPENFUT_FIFA17_CATALOG")?,
-            identity_store_path: required("OPENFUT_IDENTITY_STORE")?,
             persona_id: required_i64_nonzero("OPENFUT_PERSONA_ID")?,
             market_db_path: required("OPENFUT_MARKET_DB")?,
             pile_db_path: required("OPENFUT_PILE_DB")?,
+            identity_store_path,
+            clientdata_path,
         })
     }
 }
+
+/// Default client-data blob path: the identity store's parent directory +
+/// `clientdata.json` (co-located with the other host-owned durable state).
+fn default_clientdata_path(identity_store_path: &str) -> String {
+    std::path::Path::new(identity_store_path)
+        .parent()
+        .map(|p| p.join("clientdata.json"))
+        .unwrap_or_else(|| std::path::PathBuf::from("clientdata.json"))
+        .to_string_lossy()
+        .into_owned()
+}