server: guarantee a TERMINAL RESPONSE for paused proactive commands

Every FETCHed proactive command must be answered, otherwise the card is
left in an unfinished session and stops issuing commands (e.g. it will
not deliver a PoR for SEND SM). The menu handlers now share
_menu_send_response, and a server-side watchdog (_arm_menu_timeout /
_menu_timeout_fire, --menu-timeout, default 60s, 0 disables) sends the
timeout result (0x12) when the user never answers. The timer is armed
while a command is pending and cancelled on any response, equip, rescue
and card disconnect.

Also fixes docs/api.md, which had back (0x11) and timeout (0x12) codes
swapped. Tests for arm/cancel/clamping and the flat timeout TR. SW cache
v89 -> v90.

pysim_otaman_server/__main__.py

@@ -12,7 +12,7 @@ from pySim.cards import UiccCardBase
 
 from .shell import load_pysim_app
 from . import fastinit
-from .server import PysimHandler, StderrApduTracer, _LoggingApduTracer, VERSION, _send_terminal_profile, _DefaultProactiveHandler, _handle_proactive_chain, _send_status, _init_proactive_session, _timing_on, _tlog
+from .server import PysimHandler, StderrApduTracer, _LoggingApduTracer, VERSION, _send_terminal_profile, _DefaultProactiveHandler, _handle_proactive_chain, _send_status, _init_proactive_session, _timing_on, _tlog, _set_menu_timeout
 
 
 _server_start = 0
@@ -52,11 +52,15 @@ def main():
                         help='Log phase durations, card resets and APDU counters with elapsed timestamps')
     parser.add_argument('--fast-init', action='store_true', default=False,
                         help='Init/equip without redundant card resets (reset only on explicit equip/reset)')
+    parser.add_argument('--menu-timeout', type=int, default=60, metavar='SECS',
+                        help='Auto-send a timeout TERMINAL RESPONSE if a paused STK command is not answered (default: 60, 0 disables)')
 
     opts = parser.parse_args()
     opts.skip_card_init = opts.no_card_init
     if opts.timing:
         _timing_on()
+    if opts.menu_timeout is not None:
+        _set_menu_timeout(opts.menu_timeout)
     sl = None
     scc = None
     card = None