scp81: rename passthru to redirect, add a true passthru mode (v2.2.13)

The former 'passthru' mode is now 'redirect': it pins the configured target
and every BIP channel is connected there (the card's requested address is
only logged; host/port required). The name 'passthru' now means the new mode:
no listener and no target - each channel dials the destination the card
requests in OPEN CHANNEL (Other address + Transport level port, TCP client,
remote, 0x02 only). The specs define no default port (TS 102 223 8.59), so an
incomplete or non-TCP request fails the channel with result 3A and an
open-fail log reason.

BipTerminal gains a mode (enable(host, port, mode=...), open(..., proto=...)),
reports it in status(), and the control API/status expose redirect (target)
and passthru (per-channel targets). The PWA mode selector shows four modes
with per-mode notes and disables Host/Port in passthru; the status line shows
each channel's actual target. Docs, help (EN/RU), READMEs and the AGENTS notes
updated; SW cache otaman-v179.

Breaking API change: mode:'passthru' has the new semantics - use
mode:'redirect' for the previous behavior (no alias).

frontend/tests/html.test.js

@@ -168,3 +168,14 @@ test('every help anchor used by the UI exists in help.html', () => {
     assert.ok(html.includes("'scp81-listener' : 'scp81-scripts'"));
     assert.ok(html.includes("? 'scp81-scripts' : 'scp81-listener'"));
 });
+
+test('SCP81 listener exposes its four modes with the matching notes', () => {
+    for (const v of ['tls', 'redirect', 'passthru', 'dump']) {
+        assert.ok(html.includes('value="' + v + '"'), v);
+    }
+    assert.ok(html.includes('id="scp81-redirect-note"'));
+    assert.ok(html.includes('id="scp81-passthru-note"'));
+    // redirect needs the configured target; passthru uses the card's one
+    assert.ok(html.includes("mode === 'redirect' && (!hostVal || !portVal)"));
+    assert.ok(html.includes("el.disabled = (mode === 'passthru')"));
+});