v3.24.0 review: the ARR cache on the startup init path

A card present when the server starts is initialized by the startup
path in __main__.py, which reads EF.ICCID and the network-state files
directly and never runs _apply_equipped_card - the only place the ARR
cache was read.  The cache therefore stayed empty for the whole
session (/api/arr {ok: false}) and the file manager showed no access
rules until an explicit Equip.

The startup init now reads the ARR copies in the same CAT-free window
(best effort, right after the netstate read, skipped without a readable
ICCID like the other reads) and stores them as server.arr, with an
INIT: EF.ARR log line.  A later equip still refreshes the cache through
_apply_equipped_card.

Test: the startup wiring (the read, the assignment and the import).
869 frontend + 857 Python; sw cache simple-v423.

tests/test_arr.py

@@ -147,6 +147,16 @@ class CacheTests(unittest.TestCase):
         seg = SRC[SRC.index("elif self.path == '/api/write':"):SRC.index("elif self.path == '/api/tree':")]
         self.assertIn('_arr_refresh_after_write', seg)
 
+    def test_the_startup_init_reads_the_arr(self):
+        # a card present at server start never runs _apply_equipped_card, so
+        # the startup init reads the ARR in its own CAT-free window (v3.24.0
+        # review - the cache was empty on a startup-equipped card)
+        src = (ROOT / 'pysim_simple_server' / '__main__.py').read_text(encoding='utf-8')
+        self.assertIn('arr_files = _read_arr(app)', src)
+        self.assertIn('server.arr = arr_files', src)
+        imp = src[src.index('from .server import'):]
+        self.assertIn('_read_arr', imp[:imp.index('\n')])
+
 
 class ArrRouteTests(unittest.TestCase):
     """GET /api/arr serves the session cache without touching the card."""