pcsc: guide by PolicyKit actions, not a pcscd group

A headless/SSH box can show a world-writable /run/pcscd/pcscd.comm
(srw-rw-rw- root root) and still be denied: pcscd enforces its PolicyKit
policy, whose defaults allow only active local sessions.  The startup
report, the start.sh pre-flight and the README troubleshooting now name
the exact rule (99-pcscd-allow.rules, org.debian.pcsc-lite.access_pcsc
and access_card) and explain why the socket mode does not matter.  The
pcscd-group instruction is gone: there may be no such group, and it is
not the gate.  The group route stays only as a note for a pcscd built
without PolicyKit.

Tests: tests/test_pcsc_startup.py asserts the polkit action IDs, the
rule filename and the 0666-socket explanation.
1088 Python + 1075 frontend.

start.sh

@@ -54,10 +54,13 @@ PY
         )" || {
             echo "Error: PC/SC is not accessible: ${PCSC_ERR:-unknown error}"
             echo "  The server will not fall back to a serial reader silently."
-            echo "  - add the user to the pcscd group: sudo usermod -aG pcscd \"$USER\" (then log out/in),"
-            echo "    or configure the polkit rule that allows the user to use pcscd;"
+            echo "  - pcscd uses PolicyKit (the default allows only active local sessions,"
+            echo "    so SSH/headless is denied even with a 0666 socket).  Allow the user in"
+            echo "    /etc/polkit-1/rules.d/99-pcscd-allow.rules: return polkit.Result.YES for"
+            echo "    org.debian.pcsc-lite.access_pcsc and access_card, subject.user == \"$USER\";"
+            echo "    then 'sudo systemctl restart polkit' (or log out/in);"
             echo "  - 'sudo systemctl start pcscd' if the service is not running;"
-            echo "  - 'pcsc_scan' shows the same 'Access denied' error when access is denied."
+            echo "  - 'pcsc_scan' shows the same 'Access denied' error until the rule is active."
             exit 2
         }
         READER_ARGS="-p 0"