feat(hook): expand IAT hook coverage with TLS bypass, connect/recv hooks, and logging

Adds connect_hook, connectex_hook, recv_hook, ssl_patch, tls_bypass, lsx, ea_stub,
and origin_spy modules to intercept EA's TLS and socket layers in addition to
getaddrinfo. Adds DLL-level logging to C:\openfut_hook.log for debugging. Also
patches windows-sys feature flags to include Cryptography and Threading APIs needed
by the new hooks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openfut-hook/src/tls_bypass.rs

@@ -0,0 +1,35 @@
+use std::sync::OnceLock;
+use windows_sys::Win32::Foundation::BOOL;
+
+// CERT_CHAIN_POLICY_STATUS.dwError offset 0 = u32 error code; 0 = success.
+// We use raw pointers to avoid pulling in the full Cryptography struct tree.
+type CertVerifyChainPolicyFn = unsafe extern "system" fn(
+    *const u8,   // pszPolicyOID
+    *const (),   // pChainContext
+    *const (),   // pPolicyPara
+    *mut u32,    // &mut pPolicyStatus.dwError (first field)
+) -> BOOL;
+
+static REAL: OnceLock<CertVerifyChainPolicyFn> = OnceLock::new();
+
+pub fn set_real(f: CertVerifyChainPolicyFn) {
+    let _ = REAL.set(f);
+}
+
+/// Hooked CertVerifyCertificateChainPolicy — always reports success.
+/// This allows the bridge's self-signed TLS cert to be accepted by the game.
+pub unsafe extern "system" fn hooked_cert_verify_chain_policy(
+    psz_policy_oid: *const u8,
+    p_chain_context: *const (),
+    p_policy_para: *const (),
+    p_policy_status: *mut u32,
+) -> BOOL {
+    if let Some(real) = REAL.get().copied() {
+        real(psz_policy_oid, p_chain_context, p_policy_para, p_policy_status);
+    }
+    // Clear the error field of CERT_CHAIN_POLICY_STATUS regardless
+    if !p_policy_status.is_null() {
+        *p_policy_status = 0;
+    }
+    1 // TRUE = verified OK
+}