server: keep request/access log out of the pySim output capture

The HTTP access log (log_message) and the --log-requests REQUEST/RESPONSE
lines wrote to the rebindable sys.stderr, so a concurrent card-free request
(the 2s /api/status poll) dropped its log line into the StringIO a card
command was capturing - corrupting file content read during a snapshot scan
(the access-log line appeared inside the file hex).

- Add _log_stderr(): write the request/access log to fd 2 directly (the same
  bypass the APDU tracer already uses), so it can never enter a capture.
  Route log_message, _log_req and _log_resp through it.
- Add _capture_app_output() context manager and deduplicate the six handlers
  (cardinfo/command/help/read/write/tree) that did the inline
  app.stdout/sys.stderr = out save/restore dance.

Bumps VERSION to 3.40.5 and the SW cache to simple-v491.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pysim-simple-server"
-version = "3.40.4"
+version = "3.40.5"
 description = "HTTP REST server wrapping pysim for the SIMple PWA"
 license = { text = "GPL-2.0-or-later" }
 requires-python = ">=3.9"