v3.14.1: the counter probe demands its PoR

_counter_probe_params validates SPI2, forces b1 (PoR required; a caller's
00 becomes 01) and defaults to the RAM listing transport 21; the no-PoR
error names the effective SPI2, and ramSyncCounter posts
ramListingSpi2('40') for the RAM view (the failed operation's transport).

Live 2026-10-02 (NP BAP): the probe had sent the plain SCP80 form's 00
(no PoR) - the card answered the ENVELOPE 9000 and sent nothing, so the
probe stopped after one packet with "card verdict: no PoR".

Docs: docs/api.md, repo AGENTS.  sw cache simple-v376.
Tests: 670 Python + 798 frontend green.

docs/api.md

@@ -297,12 +297,14 @@ the packet's, TS 102 225 §5.2 Table 3), which is why this probe exists.
 
 All fields except `preset_id` are optional: `kvn` picks a keyset (the first
 otherwise), `tar` defaults to the preset's ISD entry and `spi1` to that TAR's
-MSL, `spi2` to `01`, `cntr` to the
+MSL, `spi2` to the RAM listing transport `21`, `cntr` to the
 keyset's counter, `ceiling` to `FFFFFFFF` (must stay below `FFFFFFFFFF`) and
-`max_attempts` to 40 (clamped to 1–64).  The probe always sends the read-only
-`SELECT MF` - the counter advances on the packet's security acceptance whatever
-the applet answers (`6A86`/`6D00` are normal there).  A SPI1 without a counter
-check is refused (400).
+`max_attempts` to 40 (clamped to 1–64).  The probe needs the PoR verdict, so
+bit b1 of `spi2` is always set (a caller's `00` becomes `01`; the transport
+bits are kept) - without a PoR the probe is blind.  The probe always sends the
+read-only `SELECT MF` - the counter advances on the packet's security
+acceptance whatever the applet answers (`6A86`/`6D00` are normal there).  A
+SPI1 without a counter check is refused (400).
 
 **Response:** `{"success": true, "accepted_cntr": "0001000000",
  "stored_cntr": "0001000001", "packets": 3, "stopped": "accepted",