net-sim: network-condition simulation in the Phone tab (v2.5.0)

Server (pysim_simple_server/netsim.py + POST /api/net-sim):
- pure builders for the observed phone write vocabulary (UICC_NAA.md §13):
  EPSNSC (A0 TLV with KSI/KASME/counts/algo, padded to the card's FCP record
  size; invalidate-wipe and invalidate-keep-key), LOCI/PSLOCI/EPSLOCI real
  and dummy forms (PLMN kept, LAC FFFE, status 01/02), Kc/KcGPRS (9-byte
  USIM and 33-byte GSM forms, 07 invalidates), EF.SMSstatus counter bump
  (read-modify-write), CBMI/CBMIR, the Location status event (9B 01 <st>,
  with the optional 13 07 location info for normal service) and the
  AUTHENTICATE APDU (TS 31.102 7.1.2.1) with DB/DC response parsing
- scenario runner executes the recipes under _CARD_LOCK, picks the first
  existing candidate path (ADF.USIM vs DF.GSM/DF.TELECOM), reads FCP/current
  records where the format is card-specific, skips the event unless the card
  subscribed to Location status, honours the scenario toggles and returns a
  per-step log; only D6/DC, ENVELOPE and AUTHENTICATE are ever sent
- GET /api/mcc-mnc serves the optional worldwide operator list
  (--mcc-mnc-list, default <workspace>/samples/mcc-mnc-list.json): ?q=
  search and ?random=1&exclude= for roaming; the list stays out of the repo

PWA:
- Phone pill gains a 'Network simulation' fieldset: one button per scenario
  (cold boot, EPS/2G attach, service lost, limited service, roaming denied,
  churn, SMS received, CB reconfig, AUTHENTICATE), a collapsed Parameters
  block (operator search + random roaming, LAC/Cell ID/TAC/RAC, optional
  identities, toggles, churn count/delay) and a step log with SWs
- i18n EN/RU, help/README/api.md/AGENTS.md updated; version 2.5.0,
  SW cache simple-v193

Tests: tests/test_netsim.py (19), frontend/tests/netsim.test.js (3) and
html guards - 423 frontend / 280 Python, all passing

docs/api.md

@@ -40,6 +40,8 @@ a 2.x PWA).
 | `/api/stk-status` | GET | STK session state (active/pending/type) |
 | `/api/events` | GET | Event list from SET UP EVENT LIST |
 | `/api/event-send` | POST | Send ENVELOPE(Event Download) |
+| `/api/net-sim` | POST | Run a network-condition scenario (attach, service loss, roaming, churn, 2G, SMS, CB, AUTHENTICATE) |
+| `/api/mcc-mnc` | GET | Search the optional MCC/MNC operator list (`?q=`; `?random=1&exclude=`) |
 | `/api/proactive-log` | GET | Last 50 proactive commands |
 | `/api/status-poll` | POST | Manual STATUS poll + FETCH if 91XX |
 | `/api/rescue` | POST | Re-send TERMINAL PROFILE to recover CAT session |
@@ -95,6 +97,15 @@ Runs pySim's `cardinfo` command and returns its output as `{"output": "..."}`
 (card type, ATR, ICCID and other information pySim reports for the equipped
 card). A shortcut for `POST /api/command` with `{"cmd": "cardinfo"}`.
 
+### `GET /api/mcc-mnc`
+
+Searches the optional worldwide operator list loaded from
+`--mcc-mnc-list` (default `<workspace>/samples/mcc-mnc-list.json`).
+`?q=<text>` matches country, country code, MCC/MNC, brand and operator
+(compact results, max 50); `?random=1[&exclude=MCCMNC]` returns one random
+entry (for roaming tests). When the list is not configured or missing the
+response is `{"available": false}`.
+
 ### `POST /api/command`
 
 Execute any pysim-shell command.
@@ -405,6 +416,28 @@ event byte values, or `[]` when none was received).
 
 Sends an `ENVELOPE(Event Download)` for a subscribed event.
 
+### `POST /api/net-sim`
+
+Runs one network-condition scenario from `projects/UICC_NAA.md` section 13
+against the equipped card and returns the step log:
+
+```json
+{"scenario": "service_lost", "mcc": "262", "mnc": "01", "lac": "6CD7",
+ "send_event": true, "dummy_locations": true, "keep_kasme": true}
+```
+
+Scenarios: `cold_boot`, `attach_eps`, `attach_2g`, `service_lost`,
+`limited_service`, `roaming_denied`, `churn`, `sms_received`, `cb_reconfig`,
+`authenticate`. Optional parameters: `mcc`/`mnc` (or `plmn`), `lac`,
+`cell_id`, `tac`, `rac`, `tmsi`, `ptmsi`, `ptmsi_sig`, `guti`, `ksi`,
+`kasme`, `ul`, `dl`, `algo`, `kc`, `rand`, `autn`, `churn_count`,
+`churn_delay_ms`, and the toggles `send_event`, `dummy_locations`,
+`invalidate_epsnsc`, `keep_kasme`, `write_kc`, `sms_location`, `cb_clear`
+(empty identity values are randomized). The event step is skipped when the
+card did not subscribe to Location status; only UPDATE BINARY/RECORD,
+ENVELOPE and AUTHENTICATE are sent (never FPLMN/5GS location files). The
+response is `{success, error, steps:[{action, file, path, data, sw, ok}]}`.
+
 ```json
 {"event_type": 4, "event_data": "01A0"}
 ```