server: keep request/access log out of the pySim output capture

The HTTP access log (log_message) and the --log-requests REQUEST/RESPONSE
lines wrote to the rebindable sys.stderr, so a concurrent card-free request
(the 2s /api/status poll) dropped its log line into the StringIO a card
command was capturing - corrupting file content read during a snapshot scan
(the access-log line appeared inside the file hex).

- Add _log_stderr(): write the request/access log to fd 2 directly (the same
  bypass the APDU tracer already uses), so it can never enter a capture.
  Route log_message, _log_req and _log_resp through it.
- Add _capture_app_output() context manager and deduplicate the six handlers
  (cardinfo/command/help/read/write/tree) that did the inline
  app.stdout/sys.stderr = out save/restore dance.

Bumps VERSION to 3.40.5 and the SW cache to simple-v491.

CHANGELOG.md

@@ -9,6 +9,26 @@ every change carries a descriptive commit message.
 
 ## [Unreleased]
 
+## [3.40.5] — 2026-11-08
+
+### Fixed
+
+- **Server request/access log leaked into captured file content.**  The HTTP
+  access log (`log_message`) and the `--log-requests` `REQUEST`/`RESPONSE`
+  lines wrote to the rebindable `sys.stderr`, so a concurrent card-free request
+  (the 2 s `/api/status` poll) dropped its log line into the `StringIO` a
+  card command was capturing — corrupting file content read during a snapshot
+  scan (the log line appeared in the snapshot, e.g.
+  `127.0.0.1 - - […] "GET /api/status HTTP/1.1" 200 -ffff…`).  The log now
+  writes to fd 2 via `_log_stderr`, exactly as the APDU tracer already does.
+
+### Changed
+
+- **Deduplicated the pySim output capture.**  The six handlers that captured
+  pySim command output by rebinding `sys.stdout`/`sys.stderr` to a `StringIO`
+  now share one `_capture_app_output` context manager (the same save/set/
+  restore semantics, in one place).
+
 ## [3.40.4] — 2026-11-04
 
 ### Added