pcsc: guide by PolicyKit actions, not a pcscd group

A headless/SSH box can show a world-writable /run/pcscd/pcscd.comm
(srw-rw-rw- root root) and still be denied: pcscd enforces its PolicyKit
policy, whose defaults allow only active local sessions.  The startup
report, the start.sh pre-flight and the README troubleshooting now name
the exact rule (99-pcscd-allow.rules, org.debian.pcsc-lite.access_pcsc
and access_card) and explain why the socket mode does not matter.  The
pcscd-group instruction is gone: there may be no such group, and it is
not the gate.  The group route stays only as a note for a pcscd built
without PolicyKit.

Tests: tests/test_pcsc_startup.py asserts the polkit action IDs, the
rule filename and the 0666-socket explanation.
1088 Python + 1075 frontend.

pysim_simple_server/__main__.py

@@ -65,10 +65,18 @@ def _report_pcsc_unavailable(kind, exc=None):
     if kind == 'access':
         user = os.environ.get('USER') or os.environ.get('LOGNAME') or '$USER'
         sys.stderr.write('INIT: PC/SC access denied - the current user may not use pcscd.\n')
-        sys.stderr.write('  Add the user to the pcscd group: sudo usermod -aG pcscd %s\n' % user)
-        sys.stderr.write('  (then log out and back in), or configure the polkit rule that\n')
-        sys.stderr.write('  allows the user to use pcscd.  `pcsc_scan` shows the same\n')
-        sys.stderr.write('  "SCardEstablishContext: Access denied" error.\n')
+        sys.stderr.write('  pcscd gates access through PolicyKit: the default policy allows\n')
+        sys.stderr.write('  only *active local* sessions, so an SSH/headless session is denied\n')
+        sys.stderr.write('  even when /run/pcscd/pcscd.comm is world-writable (0666).\n')
+        sys.stderr.write('  Allow the user in /etc/polkit-1/rules.d/99-pcscd-allow.rules:\n')
+        sys.stderr.write('    polkit.addRule(function(a, s) {\n')
+        sys.stderr.write('      if ((a.id == "org.debian.pcsc-lite.access_pcsc" ||\n')
+        sys.stderr.write('           a.id == "org.debian.pcsc-lite.access_card") &&\n')
+        sys.stderr.write('          s.user == "%s") return polkit.Result.YES;\n' % user)
+        sys.stderr.write('    });\n')
+        sys.stderr.write('  then restart polkit (sudo systemctl restart polkit) or log out/in;\n')
+        sys.stderr.write('  `pcsc_scan` shows the same "SCardEstablishContext: Access denied"\n')
+        sys.stderr.write('  error until the rule is active.\n')
     elif kind == 'service':
         sys.stderr.write('INIT: pcscd is not running or not reachable.\n')
         sys.stderr.write('  Start it (sudo systemctl start pcscd) and restart the server.\n')