pcsc: guide by PolicyKit actions, not a pcscd group

A headless/SSH box can show a world-writable /run/pcscd/pcscd.comm
(srw-rw-rw- root root) and still be denied: pcscd enforces its PolicyKit
policy, whose defaults allow only active local sessions.  The startup
report, the start.sh pre-flight and the README troubleshooting now name
the exact rule (99-pcscd-allow.rules, org.debian.pcsc-lite.access_pcsc
and access_card) and explain why the socket mode does not matter.  The
pcscd-group instruction is gone: there may be no such group, and it is
not the gate.  The group route stays only as a note for a pcscd built
without PolicyKit.

Tests: tests/test_pcsc_startup.py asserts the polkit action IDs, the
rule filename and the 0666-socket explanation.
1088 Python + 1075 frontend.

CHANGELOG.md

@@ -32,9 +32,11 @@ every change carries a descriptive commit message.
   the user may not use `pcscd`), the error was swallowed and pySim fell back to
   the serial transport, failing on `/dev/ttyUSB0` while the server still printed
   "listening".  The startup now probes PC/SC and reports **`PC/SC access
-  denied`** (with the `pcscd` group/polkit guidance and the `pcsc_scan`
-  cross-check), **`pcscd is not running`** or **`no PC/SC reader found`**, then
-  exits 2; `start.sh` runs the same access pre-flight before launching.  An
+  denied`** (naming the pcsc-lite PolicyKit actions and the
+  `99-pcscd-allow.rules` rule — a world-writable `pcscd.comm` does not bypass
+  polkit's active-session policy — plus the `pcsc_scan` cross-check),
+  **`pcscd is not running`** or **`no PC/SC reader found`**, then exits 2;
+  `start.sh` runs the same access pre-flight before launching.  An
   explicit `-d <device>` keeps the serial path, and a reader present but no card
   is still a normal cardless start.
 - **`setup.sh`/`setup.bat` recover from an incomplete `.venv`.**  A failed venv