scp81: UI framing options, permissive TLS, drop the Apache-header mimicry (v2.2.14)

Listener Options block (applied at Start, persisted in localStorage, Reset to
defaults): HTTP framing - chunked body, chunk size (0 = one TLS record),
keep-alive, Connection header, compact headers, Next-URI (unchecked = omit);
script framing - indefinite/definite Command Scripting template, CR tag,
targeted app; link events (now parsed on the common start path, so every mode
honors them). scp81OptionsFromForm() is unit-tested.

TLS is automatic: 'auto' (min 1.0, max 1.2 + :@SECLEVEL=0) is the new
default, all six PSK suites are offered and OpenSSL negotiates the highest;
the negotiated version/cipher is logged (tls-handshake) and reported as
version_seen/cipher_seen in /api/scp81/status, and a handshake failing for a
TLS/cipher reason logs tls-handshake-failed (post-handshake record errors
stay tls-error). tls_version/cipher/keylog/answer_delay stay as API-only pins.

Dropped the Apache-style header mimicry completely: no Date/Server/
X-Powered-By, no Content-Length-before-Content-Type ordering, no Content-Type
on 204 - the minimal response set is X-Admin-Protocol (+ X-Admin-Next-URI /
Targeted-Application), Content-Type on 200s, and Transfer-Encoding or
Content-Length per the chunked flag. Docs, help (EN/RU), READMEs and the
AGENTS notes updated; SW cache otaman-v180.

docs/scp81-findings.md

@@ -174,9 +174,10 @@ All script attempts used the `explore` list, except #8-#17 which used only
 failures were caused by the BIP TLV length bug, not by the HTTP/TLS details;
 resume mode was a symptom (the working session even started as a resume). The
 key working recipe (also now the server default): one keep-alive connection,
-Apache-style headers, `Transfer-Encoding: chunked` body with the script in
+`Transfer-Encoding: chunked` body with the script in
 one TLS record, no Connection header, `X-Admin-Next-URI` with a query whose
-command id increments.
+command id increments. (2.2.14: the reference server's Date/Server/X-Powered-By
+headers were dropped — they were mimicry, the blocker was the BIP length bug.)
 
 **Also confirmed:** a TLS half-close (close_notify then keep reading for the
 card's POST which RFC 5246 leaves open in practice) cannot be done with