feat(fifa17): report verified client patch capability

Launcher side of the verified patched-client capability handshake. When
autopatch proves the CardsDLL empty-My-Packs resolver guard is active for the
CURRENT FIFA process, the launcher advertises that to the backend so the backend
may drop the synthetic 65534 sentinel for that session only. Additive and
fail-closed: any parse/registration failure leaves the backend on its default
sentinel path.

- New src/fifa17_capability.rs:
  * Fifa17ClientCapabilities { empty_mypacks_resolver: Option<u32> } — per-FIFA-
    process state, UNKNOWN at each launch, discarded when that process ends
    (never persisted, so a prior launch's capability cannot leak).
  * parse_capability_line() / parse_fifa_pid() — pure parsers for autopatch's
    stdout token `[store-guard] verified capability fifa17.empty_mypacks_resolver=<v>
    fifa_pid=<pid>`; the non-advertising `guard status=...` line yields None.
  * register() — tiny stdlib-HTTP POST /openfut/fifa17/capability, modeled on
    account_sync::sync (Connection: close, 3s timeouts, 2xx check).
- local_services::spawn: autopatch stdout reader parses each raw line; on the
  first verified line it sets the shared capability sink, logs, and fires exactly
  one backend register() for this FIFA process. Capability wiring is bundled in a
  CapabilityWiring struct (Some for autopatch, None for LSX). LSX unchanged.
- app.rs: LauncherApp holds the shared Fifa17ClientCapabilities; it is reset to
  UNKNOWN at the start of launch_game (and when autopatch is stopped) so a new
  FIFA process never inherits a previous launch's capability.
- Tests: parse (verified/non-advertising/unrelated/version-2) + a register()
  round-trip against an in-process listener.

Design + contract: docs/plans/FIFA17_PATCHED_CLIENT_CAPABILITY.md (superproject).
Pre-existing openfut-hook/* working-tree changes are intentionally left uncommitted.

src/local_services.rs

@@ -23,6 +23,9 @@ use std::{
 
 use std::os::unix::process::CommandExt;
 
+use crate::fifa17_capability::{
+    parse_capability_line, parse_fifa_pid, register, Fifa17ClientCapabilities,
+};
 use crate::logs::LogBuffer;
 
 #[derive(Debug, PartialEq, Eq)]
@@ -212,15 +215,29 @@ impl Drop for ManagedService {
     }
 }
 
+/// Backend-registration wiring handed to the autopatch stdout reader so a
+/// verified resolver-guard line can advertise the per-FIFA-process capability to
+/// the backend. `Some(..)` for autopatch; `None` for LSX.
+pub struct CapabilityWiring {
+    pub server_host: String,
+    pub account_sync_port: u16,
+    pub sink: Arc<Mutex<Fifa17ClientCapabilities>>,
+}
+
 /// Spawn a companion service. `python` is the interpreter, `tools_dir` the
 /// directory holding the responder scripts. Streams stdout+stderr into `log`.
 /// Returns an error (without spawning) if the tools dir or script is missing.
+///
+/// `capability` is the backend-registration wiring + shared per-FIFA-process
+/// capability sink — `Some(..)` for autopatch (whose stdout advertises the
+/// verified resolver guard) and `None` for LSX.
 pub fn spawn(
     service: Service,
     python: &str,
     tools_dir: &str,
     persona_id: u64,
     persona_name: &str,
+    capability: Option<CapabilityWiring>,
     log: Arc<Mutex<LogBuffer>>,
 ) -> anyhow::Result<Child> {
     use std::io::{BufRead, BufReader};
@@ -279,9 +296,53 @@ pub fn spawn(
     if let Some(out) = child.stdout.take() {
         let buf = Arc::clone(&log);
         let lbl = label.to_string();
+        // Only autopatch carries capability wiring; LSX passes `None`.
+        let cap_wiring = capability;
+        let cap_persona = persona_id;
         std::thread::spawn(move || {
+            // Fires the backend registration at most once per FIFA process.
+            let mut registered = false;
             for line in BufReader::new(out).lines().map_while(Result::ok) {
+                // Every raw line is still mirrored into the log, as before.
                 buf.lock().unwrap().push(format!("[{lbl}] {line}"));
+
+                let Some(wiring) = cap_wiring.as_ref() else {
+                    continue;
+                };
+                if registered {
+                    continue;
+                }
+                let Some(version) = parse_capability_line(&line) else {
+                    continue;
+                };
+                registered = true;
+                let fifa_pid = parse_fifa_pid(&line).unwrap_or(0);
+                wiring.sink.lock().unwrap().empty_mypacks_resolver = Some(version);
+                {
+                    let mut log = buf.lock().unwrap();
+                    log.push(format!(
+                        "[fifa17] resolver capability verified for FIFA pid {fifa_pid}"
+                    ));
+                    log.push(format!(
+                        "[fifa17] registering capability for session (persona {cap_persona})"
+                    ));
+                }
+                match register(
+                    &wiring.server_host,
+                    wiring.account_sync_port,
+                    cap_persona,
+                    fifa_pid,
+                    version,
+                ) {
+                    Ok(()) => buf
+                        .lock()
+                        .unwrap()
+                        .push("[fifa17] capability registered with backend".to_string()),
+                    Err(error) => buf
+                        .lock()
+                        .unwrap()
+                        .push(format!("[fifa17] capability registration failed: {error}")),
+                }
             }
         });
     }