PLI: return the 7-byte location object, bound every proactive chain

The PLI answer used the 5-byte form 13 05 <MCC/MNC> <LAC> with LAC 0000
and no Cell ID.  That is the *Network Rejection event download* form
(TS 31.111 8.19.1); a PLI location for GERAN is 7 bytes - MCC/MNC, LAC
and Cell ID.  A card applet that re-reads its location (the Alfa
MultiIMSI applet, after a *LOCI status change) treated it as empty and
re-requested PLI on every STATUS tick.

The default is now 13 07 00F110 0001 0001: PLMN 001/01 (the test
network), LAC 0001, Cell ID 0001.  _build_tr injects it after the
Result; the TR data is pinned by a test.

While verifying a live PLI, the manual /api/status-poll chain turned
out to be unbounded: it looped on the PLI storm while holding
_CARD_LOCK, so the request never returned and every card operation
waited.  _handle_proactive_chain's max_rounds now defaults to
_POLL_CHAIN_MAX (the background poll always passed it; the manual poll,
ENVELOPE, menu and TP chains did not), and the manual poll passes it
explicitly.  A card that re-queues a command can no longer wedge the
card lock from any call site.

Tests: the PLI default + the built TR, the default chain bound and the
manual-poll call pin.  1061 Python + 1069 frontend; sw cache simple-v477.

docs/api.md

@@ -1769,13 +1769,16 @@ Lists the PROVIDE LOCAL INFORMATION qualifier codes with their names.
 
 Returns the effective PLI data dictionary as a qualifier-code map: the
 operator's override, else the built-in default (the qualifiers whose objects
-the pinned ETSI specs define - location as the test network 001/01, the test
-IMEI/IMEISV, language, access technology, search mode, battery; v3.23.1).
+the pinned ETSI specs define - location as the test network 001/01 with test
+LAC 0001 and Cell ID 0001 (the 7-byte PLI form per TS 31.111 8.19.1; the
+5-byte form without the Cell ID belongs to the Network Rejection event
+download), the test IMEI/IMEISV, language, access technology, search mode,
+battery; v3.23.1, the PLI location form fixed in v3.37.0).
 The date/time qualifier stays empty - the host clock answers it while no
 override is set.
 
 ```json
-{"00": "930500F1100000", "0A": "630104", "03": ""}
+{"00": "130700F11000010001", "0A": "630104", "03": ""}
 ```
 
 ### `POST /api/pli-dict`