launcher: guided first-run flow, server-owned settings, hook-config reconcile

Release-readiness pass on the launcher, driven by the end state "open it,
create an account, launch the game".

Fixes a silent correctness bug. `openfut.cfg` in the game dir is the only
server address the *game* can see, but it was written only by Setup's deploy
and its "Save & Update hook" button. Changing the server anywhere else left
FIFA connecting to the previous host while every panel in the launcher showed
the new one online. Now:

  - `write_hook_config` reconciles the file from the live config, and runs
    fail-closed before every launch, so the file and the UI cannot disagree at
    the moment it matters;
  - saving Settings pushes the address into the hook immediately;
  - a `hook_config` preflight check reads the file back and warns, naming both
    addresses, instead of leaving the drift invisible;
  - Settings shows the same fact inline, and Save is enabled by drift alone —
    a message saying "Save to update it" beside a disabled button is a dead end.

Account creation is now server-authoritative. `account_sync::discover` POSTs
`/openfut/account/sync` with the persona fields *omitted*, which makes the host
answer with the persona it was started with, its club, and the Core coin
balance. The launcher adopts that answer, so it never invents an identity and
the persona the game authenticates with is by construction the one the server
expects. Claiming is gated on the address being valid, NOT on the health pill:
that pill probes the HTTPS port while this talks to the account port, so gating
on it disabled the button on servers that answer it perfectly well.

UX consolidation:

  - new Welcome ("Get started") tab: three numbered steps — connect, claim an
    account, connect FIFA — each showing live state, ending in the launch CTA;
    a fresh install opens on it and it leaves the nav rail once satisfied;
  - Config renamed Settings, and made the single owner of the server address:
    Setup's duplicate editors (same fields, different save semantics) are now a
    read-only summary with actions;
  - the dashboard offers account creation in place instead of naming a tab, and
    the stale "set the host in the Setup tab" pointers are corrected.

Locks move to parking_lot per project rule (already the convention in
openfut-utas-host and openfut-identity); 47 poisoning unwraps go away.

Verified: 58 tests pass, fmt clean, clippy clean apart from one pre-existing
lint. Driven through the real UI under Xvfb as a fresh install — typed a server,
clicked Create my account, and the config on disk came back with persona
33068179/CAGE claimed from the live host; clicking Save rewrote a stale
`openfut.cfg` from host=10.10.0.99 to host=127.0.0.1.

src/setup.rs

@@ -67,6 +67,9 @@ pub(crate) fn run_elevated(script: &str) -> anyhow::Result<()> {
 
 // ── DLL hook deployment ───────────────────────────────────────────────────────
 
+/// The file the injected hook reads its server address from, in the game dir.
+pub const HOOK_CFG_FILE: &str = "openfut.cfg";
+
 /// Deploy openfut_hook.dll into the FIFA 23 game directory and write
 /// openfut.cfg with the structured server configuration the hook reads.
 /// `cfg_contents` must be the full `openfut.cfg` body (see
@@ -85,14 +88,14 @@ pub fn deploy_hook_dll(dll_src: &Path, game_dir: &Path, cfg_contents: &str) -> a
     }
     std::fs::create_dir_all(game_dir)?;
     std::fs::copy(dll_src, game_dir.join("version.dll"))?;
-    std::fs::write(game_dir.join("openfut.cfg"), cfg_contents)?;
+    std::fs::write(game_dir.join(HOOK_CFG_FILE), cfg_contents)?;
     Ok(())
 }
 
 /// Update only openfut.cfg without redeploying the DLL. `cfg_contents` is the
 /// full structured `openfut.cfg` body.
 pub fn update_hook_config(game_dir: &Path, cfg_contents: &str) -> anyhow::Result<()> {
-    let cfg = game_dir.join("openfut.cfg");
+    let cfg = game_dir.join(HOOK_CFG_FILE);
     if !cfg.exists() {
         anyhow::bail!("Hook DLL not deployed yet — deploy first.");
     }
@@ -100,6 +103,15 @@ pub fn update_hook_config(game_dir: &Path, cfg_contents: &str) -> anyhow::Result
     Ok(())
 }
 
+/// Read the `openfut.cfg` the hook will actually load, if one is deployed.
+///
+/// The launcher's own health and account requests are built from the in-memory
+/// config, but the *game* only ever sees this file. Reading it back is the only
+/// way to tell whether the two agree.
+pub fn read_hook_config(game_dir: &Path) -> Option<String> {
+    std::fs::read_to_string(game_dir.join(HOOK_CFG_FILE)).ok()
+}
+
 /// Remove the deployed hook DLL from the FIFA game directory.
 pub fn remove_hook_dll(game_dir: &Path) -> anyhow::Result<()> {
     let dest = game_dir.join("version.dll");
@@ -127,13 +139,13 @@ pub const STEAM_LAUNCH_OPTIONS: &str = "WINEDLLOVERRIDES=\"version=n,b\" %comman
 pub fn launch_game(
     command: &str,
     workdir: &str,
-    log_buf: std::sync::Arc<std::sync::Mutex<crate::logs::LogBuffer>>,
+    log_buf: std::sync::Arc<parking_lot::Mutex<crate::logs::LogBuffer>>,
 ) -> anyhow::Result<()> {
     use std::io::{BufRead, BufReader};
     use std::process::{Command, Stdio};
 
     if command.trim().is_empty() {
-        anyhow::bail!("No game launch command configured (set it in the Config tab).");
+        anyhow::bail!("No game launch command configured (set it in Settings).");
     }
 
     let mut cmd = Command::new("sh");
@@ -145,7 +157,6 @@ pub fn launch_game(
 
     log_buf
         .lock()
-        .unwrap()
         .push(format!("[launcher] launching game: {command}"));
 
     let mut child = cmd.spawn()?;
@@ -154,7 +165,7 @@ pub fn launch_game(
         let buf = std::sync::Arc::clone(&log_buf);
         std::thread::spawn(move || {
             for line in BufReader::new(out).lines().map_while(Result::ok) {
-                buf.lock().unwrap().push(line);
+                buf.lock().push(line);
             }
         });
     }
@@ -162,7 +173,7 @@ pub fn launch_game(
         let buf = std::sync::Arc::clone(&log_buf);
         std::thread::spawn(move || {
             for line in BufReader::new(err).lines().map_while(Result::ok) {
-                buf.lock().unwrap().push(line);
+                buf.lock().push(line);
             }
         });
     }
@@ -172,7 +183,6 @@ pub fn launch_game(
         let _ = child.wait();
         log_buf
             .lock()
-            .unwrap()
             .push("[launcher] game process exited.".to_string());
     });