hook: in-process RE instrumentation + LSX redirect + capture tooling

Hook-side tooling for the LSX/Blaze reverse-engineering effort:

- probe.rs (new, `probe` feature): passive logging detours on FIFA's online-flow
  functions via the unhook/rehook pattern (no trampoline/relocation, works on
  RIP-relative prologues). Deferred install waits for anadius64.dll to load, then
  logs enter/return for GoOnline + GetInternetConnectedState (anadius) and the
  OnlineStatusEvent/Login deserializers (FIFA23.exe). Revealed that our pushed LSX
  events reach FIFA and parse OK, while GoOnline never fires — localizing the online
  gate to FIFA's game-side event consumer.
- connect_hook.rs: redirect FIFA's LSX connect :3216 → :3217 so it lands on the
  native openfut-bridge LSX server (slips past anadius's in-process :3216 intercept);
  gated off under the `capture_baseline` feature.
- recv_hook.rs: boundary-safe trampolines + LSX peer filtering for the
  capture_baseline path (log anadius's real LSX frames when the redirect is off).

Build the instrumented DLL with `--features probe` (or `--features capture_baseline`
for the anadius-baseline capture). Both features are off by default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

openfut-hook/src/connect_hook.rs

@@ -9,6 +9,15 @@ const PORT_HTTPS_NBO: u16            = 0xBB01;  // 443   big-endian
 const PORT_BRIDGE_NBO: u16           = 0xFB20;  // 8443  big-endian
 const PORT_BLAZE_REDIRECTOR_NBO: u16 = 0x3927;  // 10041 big-endian
 const PORT_BLAZE_MAIN_NBO: u16       = 0x8FA4;  // 42127 big-endian
+// EA App LSX. anadius handles :3216 in-process before it reaches the host TCP
+// stack (keyed on port 3216 specifically), so redirecting FIFA's LSX connect to a
+// *different* host port (:3217) slips past that interception and lands on the
+// native openfut-bridge LSX server. This is the load-bearing redirect that routes
+// LSX to our bridge; without it FIFA uses anadius's in-process emu instead.
+#[allow(dead_code)] // unused when built with the `capture_baseline` feature
+const PORT_LSX_NBO: u16              = 0x900C;  // 3216  big-endian (EA App LSX)
+#[allow(dead_code)]
+const PORT_LSX_TARGET_NBO: u16       = 0x910C;  // 3217  big-endian (bridge LSX target)
 const ADDR_LOOPBACK_NBO: u32 = 0x0100_007F; // 127.0.0.1 big-endian
 
 #[repr(C)]
@@ -62,6 +71,8 @@ unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u8; 16], i32
 
     let new_port_nbo = match sa.sin_port {
         PORT_HTTPS_NBO            => PORT_BRIDGE_NBO,
+        #[cfg(not(feature = "capture_baseline"))]
+        PORT_LSX_NBO              => PORT_LSX_TARGET_NBO,
         PORT_BLAZE_REDIRECTOR_NBO => PORT_BLAZE_REDIRECTOR_NBO,
         PORT_BLAZE_MAIN_NBO       => PORT_BLAZE_MAIN_NBO,
         _                         => return None,