scp81: BER-encode the Command Scripting template lengths (v2.1.11)

The C-APDU TLV length was written as a raw byte: a 245-byte LOAD command
produced 'AE 80 22 F5 ...', which BER reads as a long-form marker, so the
card mis-parsed every script command over 127 bytes. Small commands worked,
which made a RAM install look alive: the card answered the LOAD steps with a
degenerate 'AF 80' body (no R-APDU), and the final INSTALL [for install]
failed with 6A88 because the package never loaded.

Both the indefinite ('22' TLV) and definite ('AA' outer) lengths are now
BER-encoded (same rule as the BIP channel data TLV fix). Tests: 245-byte
LOAD body, short form, definite variant (200 python, 346 frontend);
findings doc updated; service worker v148.

tests/test_scp81.py

@@ -790,3 +790,26 @@ class QueueScriptTest(unittest.TestCase):
             server._SCP81_SCRIPT = list(server._SCP81_SCRIPTS['explore'])
             server._SCP81_SCRIPT_SENT = 0
             server._SCP81_SCRIPT_KIND = 'explore'
+
+
+class ScriptBodyLengthTest(unittest.TestCase):
+    def test_long_c_apdu_uses_ber_long_form(self):
+        from pysim_otaman_server.server import _scp81_command_body
+        apdu = '80E80000F0' + 'AB' * 239 + '00'      # exactly 245-byte LOAD
+        body = _scp81_command_body(apdu)
+        # AE 80 22 81 F5 <245 bytes> 00 00
+        self.assertEqual(body[:5].hex().upper(), 'AE802281F5')
+        self.assertEqual(body[-2:].hex().upper(), '0000')
+        self.assertEqual(len(body), 5 + 245 + 2)
+
+    def test_short_apdu_stays_short_form(self):
+        from pysim_otaman_server.server import _scp81_command_body
+        self.assertEqual(_scp81_command_body('80CAFF2100').hex().upper(),
+                         'AE80220580CAFF21000000')
+
+    def test_definite_variant_ber_lengths(self):
+        from pysim_otaman_server.server import _scp81_command_body
+        apdu = 'AB' * 130
+        body = _scp81_command_body(apdu, definite=True)
+        # AA 81 85 22 81 82 <130 bytes>  (outer 1+2+130 = 133 = 0x85)
+        self.assertEqual(body[:6].hex().upper(), 'AA8185228182')