server+ui: auto-equip on card insertion; reset card views on session change

- _apply_equipped_card() centralizes the post-equip refresh + TERMINAL
  PROFILE (shared by the /api/command equip branch and auto-equip)
- server tracks card_session (bumped on equip and disconnect) and
  equipping; /api/status exposes connected, card_present, card_session,
  equipping, auto_equip and is exempt from _CARD_LOCK (pure cached state)
- auto-equip is on by default (--no-auto-equip; off with --no-card-init):
  the presence observer spawns a one-shot worker after insertion, which
  runs equip under _CARD_LOCK and applies the same refresh; the monitor
  starts after the startup init so pyscard's initial 'already present'
  event does not re-equip a fresh session
- UI: /api/status polls every 2s (other views stay at 5s); when
  card_session changes it runs pysimResetCardData() (STK overlay, file
  tree, events, proactive log, PLI, status) — the same reset as a manual
  Equip; messages: initializing / press Equip / no card

Tests for the observer and auto-equip rules, session bumps,
_apply_equipped_card, and the UI state machine. SW cache v91 -> v92.

README.md

@@ -628,6 +628,7 @@ pysim-otaman-server --http-port 8080
 | `--terminal-profile` | TERMINAL PROFILE payload hex (default 10-byte GSM profile) |
 | `--poll-interval` | Idle interval before automatic STATUS polling (default 30s; `0` disables polling) |
 | `--full-pysim-init` | Use pysim's stock init/equip (redundant card resets). The default init/equip is reset-free — only explicit equip/reset reconnect the card |
+| `--no-auto-equip` | Do not initialize a card automatically right after it is inserted (default: auto-equip on) |
 | `--menu-timeout` | Auto-answer a paused STK command with a timeout TERMINAL RESPONSE (default 60s; `0` disables) |
 | `--timing` | Log phase durations, card resets and APDU counters with elapsed timestamps |