scp81 passthru, proactive decoders, ADM badge, file manager layout (v2.2.1)

SCP81:
- New listener mode "passthru": no local listener - the card's BIP
  channels connect straight to a configured external platform
  (host/port required), which terminates TLS and runs the dialog.
  The status API reports mode/target (_SCP81_MODE/_SCP81_TARGET) and
  clears them on stop. PWA mode select, hint, Start validation; TLS PSK
  stays the default.

Proactive command decoding (Phone tab log):
- SEND SHORT MESSAGE (0x13) is now decoded: alpha, address (TON/NPI +
  number), 3GPP-SMS TPDU (type, TP-MR, TP-DA, TP-PID 0x7F flagged as
  SIM data download, TP-DCS, TP-VP, TP-UDL), UDH concatenation IEs, and
  the TP-UD as text (GSM-7 with a septet unpacker, UCS2, 8-bit) or as a
  TS 31.115 secured packet for PID 0x7F; malformed TPDUs fall back to
  the raw hex line.
- PROVIDE LOCAL INFORMATION qualifier names completed per TS 102 223
  V18.3.0: ESN (07), MEID (0B), Supported RATs (1A); 05 relabelled
  "Reserved for GSM (Timing Advance)". Fixed in the server dict and
  both frontend tables.

Header:
- Compact ADM badge next to the card indicator: "ADM ✓" green when
  pySim's adm_verified is set, "ADM ✗" red otherwise, hidden without a
  card session or when the server is down; updated ahead of the card
  state-key early return so it never disturbs the connect/reset flow.

File manager:
- Sort pills (FID/Name), Probe all files button and progress line are
  pinned above the tree instead of scrolling with it; the tree box cap
  grows from 420px to 65vh.

SW cache otaman-v165; help EN/RU updated; tests 234 Python + 361 frontend.

docs/api.md

@@ -473,13 +473,23 @@ Returns the updated dictionary.
 
 Starts or stops the local target the card's BIP channel is redirected to.
 
-Dump mode (default) captures whatever the card sends (e.g. its TLS
-ClientHello) without answering:
+Dump mode captures whatever the card sends (e.g. its TLS ClientHello)
+without answering:
 
 ```json
 {"action": "start", "mode": "dump", "host": "127.0.0.1", "port": 8443}
 ```
 
+Pass-through mode (`mode: "passthru"`) starts **no local listener**: every BIP
+channel the card opens is connected to the configured external platform
+(`host`/`port` are required — no defaults), which terminates TLS and runs the
+administration dialog; the address the card requests is only logged. The
+status API reports `mode: "passthru"` with the target while it runs.
+
+```json
+{"action": "start", "mode": "passthru", "host": "203.0.113.10", "port": 10174}
+```
+
 TLS mode runs the Phase B PSK TLS server (GPC v2.2 Amendment B): the PSK
 table is applied to the TLS handshake, and the GP HTTP administration dialog
 (`X-Admin-*` headers, 200 with a command string or 204 No Content) is served.
@@ -514,6 +524,11 @@ Stop either mode with `{"action": "stop"}` (also disables the BIP terminal).
               "identity_seen": "89012345678901234567", "identity_matched": true}}
 ```
 
+Listener modes: `tls` (local PSK TLS server), `dump` (capture-only TCP
+listener) and `passthru` (no local listener; the BIP channels go straight to
+`host:port`, e.g. an external HTTP OTA platform — reported as
+`{"mode": "passthru", "host": ..., "port": ..., "target": "host:port"}`).
+
 `psk_identities` lists the identities the listener accepts (keys are never
 exposed); `psk_wildcard` marks the legacy single-key mode. `identity_seen` /
 `identity_matched` reflect the last handshake: an unknown identity is logged