server+ui: detect card removal passively and reflect it within 2s

The UI only noticed a removed card when some user action ran a real card
command (e.g. Check status); /api/status is a cached-state read that kept
returning the old card, and _handle_card_disconnect() did not clear
app.card/rs.

- start_card_monitor() registers a pyscard CardObserver for our reader;
  it only polls SCardGetStatusChange (no APDU, no connection, no extra
  process), and on removal sets server.card_present=False and calls
  _handle_card_disconnect() under _CARD_LOCK
- /api/status now exposes connected (session usable) and card_present
  (physically inserted) and masks card/profile/atr/selection when not
  connected; _CARD_CONNECTED is initialized from card presence instead of
  being unconditionally True
- the 2s UI poll includes /api/status; on disconnect it switches to the
  existing 'No card detected. Insert card and click Equip' state, or the
  new 'Card inserted — press Equip' hint when the card is back; the old
  _hadData heuristic is gone

Tests for the observer (filtering, removal, insertion) and the UI state
transitions. SW cache v90 -> v91.

frontend/tests/card_state.test.js

@@ -0,0 +1,77 @@
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const html = fs.readFileSync(path.join(__dirname, '..', 'index.html'), 'utf8');
+
+function extractFunc(src, name) {
+	const re = new RegExp('function\\s+' + name + '\\s*\\([^)]*\\)\\s*\\{');
+	const m = re.exec(src);
+	if (!m) throw new Error('function ' + name + ' not found');
+	let i = m.index + m[0].length - 1;
+	let depth = 0;
+	for (; i < src.length; i++) {
+		if (src[i] === '{') depth++;
+		else if (src[i] === '}') {
+			depth--;
+			if (depth === 0) break;
+		}
+	}
+	return src.slice(m.index, i + 1);
+}
+
+let code = 'var _pysimLastConnected = null;\n';
+code += extractFunc(html, 'pysimCardStateUpdate') + '\n';
+code += '\nglobalThis.esc = s => s;\n';
+code += 'globalThis.t = s => s;\n';
+eval(code);
+
+function setup() {
+	const el = { textContent: 'status line', innerHTML: '' };
+	const calls = { connected: [], refresh: 0 };
+	globalThis.document = { getElementById: () => el };
+	globalThis.pysimSetConnected = v => calls.connected.push(v);
+	globalThis.pysimRefresh = () => { calls.refresh++; };
+	return { el, calls };
+}
+
+test('disconnect without card shows the no-card message', () => {
+	_pysimLastConnected = true;
+	const { el, calls } = setup();
+	pysimCardStateUpdate({ connected: false, card_present: false });
+	assert.deepStrictEqual(calls.connected, [false]);
+	assert.ok(el.innerHTML.includes('No card detected'), el.innerHTML);
+});
+
+test('disconnect with card present shows the Equip hint', () => {
+	_pysimLastConnected = true;
+	const { el } = setup();
+	pysimCardStateUpdate({ connected: false, card_present: true });
+	assert.ok(el.innerHTML.includes('Card inserted'), el.innerHTML);
+});
+
+test('unchanged state does not touch the UI again', () => {
+	_pysimLastConnected = false;
+	const { el, calls } = setup();
+	el.innerHTML = 'unchanged';
+	pysimCardStateUpdate({ connected: false, card_present: false });
+	assert.deepStrictEqual(calls.connected, []);
+	assert.strictEqual(el.innerHTML, 'unchanged');
+});
+
+test('reconnect restores the connected UI and refreshes', () => {
+	_pysimLastConnected = false;
+	const { calls } = setup();
+	pysimCardStateUpdate({ connected: true, card_present: true });
+	assert.deepStrictEqual(calls.connected, [true]);
+	assert.strictEqual(calls.refresh, 1);
+});
+
+test('payload without connected flag is ignored', () => {
+	_pysimLastConnected = null;
+	const { calls } = setup();
+	pysimCardStateUpdate({ reader: 'x' });
+	pysimCardStateUpdate(null);
+	assert.deepStrictEqual(calls.connected, []);
+});