v3.11.0 review fixes: ADM length, TAR re-render hygiene

- the ADM input capped the key at 8 chars, but the server's _verify_adm
  takes 4-16 hex digits (padded to 8 CHV bytes) and the old input had no
  limit; maxlength=16 now, with a static guard in html.test.js.
- cardsTarAdd/cardsTarRemove re-rendered the table from the save-path
  reader, so an emptied role field was silently refilled with its default.
  The renderer no longer invents defaults; a raw reader (cardsTarsFromTable)
  feeds Add/Remove and the language-switch refresh, while the save path
  (cardsTarsFromForm) keeps the default-filling for the mandatory roles.
- the editor's dynamic TAR/keyset rows now rebuild on a language switch
  (refreshDynamicI18n) from what is typed - their placeholders and titles
  carry t() strings.  (The title/Save label were already refreshed there.)
- dropped the now-unused cardsRoleMsl helper and its test references.
- docs: the ADM is documented as 4-16 hex digits (help EN/RU, api.md,
  AGENTS).  sw cache simple-v362.

Tests: 665 Python + 784 frontend green; the whole inline PWA script
syntax-checked.

docs/api.md

@@ -243,7 +243,7 @@ pass `spi1` itself, otherwise it is refused with `400` and a hint.
 **Card codes.**  The optional `pin1`/`puk1`/`pin2`/`puk2`/`adm` fields are
 stored for later use (nothing consumes them yet).  PIN/PUK must be **4–8
 decimal digits** when set (empty is fine; anything else is refused with `400`
-naming the field); the ADM key stays free-form (hex or ASCII digits).
+naming the field); the ADM key is 4–16 hex digits (a decimal PIN is fine).
 
 **Counters.**  The store is the source of truth for the SCP80 counters, one per
 keyset ("a dedicated counter shall be associated to each key version",