v3.11.0 review fixes: ADM length, TAR re-render hygiene

- the ADM input capped the key at 8 chars, but the server's _verify_adm
  takes 4-16 hex digits (padded to 8 CHV bytes) and the old input had no
  limit; maxlength=16 now, with a static guard in html.test.js.
- cardsTarAdd/cardsTarRemove re-rendered the table from the save-path
  reader, so an emptied role field was silently refilled with its default.
  The renderer no longer invents defaults; a raw reader (cardsTarsFromTable)
  feeds Add/Remove and the language-switch refresh, while the save path
  (cardsTarsFromForm) keeps the default-filling for the mandatory roles.
- the editor's dynamic TAR/keyset rows now rebuild on a language switch
  (refreshDynamicI18n) from what is typed - their placeholders and titles
  carry t() strings.  (The title/Save label were already refreshed there.)
- dropped the now-unused cardsRoleMsl helper and its test references.
- docs: the ADM is documented as 4-16 hex digits (help EN/RU, api.md,
  AGENTS).  sw cache simple-v362.

Tests: 665 Python + 784 frontend green; the whole inline PWA script
syntax-checked.

frontend/tests/cards_form.test.js

@@ -41,10 +41,10 @@ for (const fn of ['cardsFormValues', 'cardsClearForm', 'cardsEdit',
 	'cardsKeysetAdd', 'cardsKeysetRemove', 'cardsKeysetKvnUpdate',
 	'cardsKeysetsFromForm', 'spKeysetSync', 'spKeysetApply', 'spKeysetChanged',
 	'ramKeysetChanged', 'ramPresetIdx', 'tarPresetIdx', 'spKeysetGuard', 'ramKeysetGuard',
-	'cardsTarList', 'cardsRoleDefault', 'cardsRoleTar', 'cardsRoleMsl',
+	'cardsTarList', 'cardsRoleDefault', 'cardsRoleTar',
 	'cardsTarEntry', 'cardsTarMsl', 'cardsTarText', 'spMslWarningText',
 	'cardsTarRowHtml', 'cardsTarRowsRender', 'cardsTarAdd', 'cardsTarRemove',
-	'cardsFreeTarsFromForm', 'cardsTarsFromForm', 'cardsTarsReset',
+	'cardsFreeTarsFromForm', 'cardsTarsFromTable', 'cardsTarsFromForm', 'cardsTarsReset',
 	'cardsShowList', 'cardsShowEditor', 'cardsSetFormMode', 'cardsNew',
 	'cardsCancelEdit']) {
 	code += extractFunc(html, fn, ASYNC_FNS.indexOf(fn) >= 0) + '\n';
@@ -181,7 +181,6 @@ test('the preset TAR table helpers read the role entries and the MSLs', () => {
 		{ role: 'usimRfm', tar: 'B00001', msl: '16' },
 		{ tar: 'AF4D02', msl: '0A', desc: 'applet' }] });
 	assert.strictEqual(cardsRoleTar(p, 'isd'), 'AF4D01');
-	assert.strictEqual(cardsRoleMsl(p, 'isd'), '1A');
 	assert.strictEqual(cardsTarMsl(p, 'af4d02'), '0A');
 	assert.strictEqual(cardsTarMsl(p, '123456'), '');
 	assert.strictEqual(cardsTarEntry(p, 'AF4D02').desc, 'applet');
@@ -538,7 +537,7 @@ test('the TAR table renders the role rows and adds/removes free rows', () => {
 	cardsTarRowsRender([{ tar: 'AF4D01', msl: '0A', desc: 'one' },
 		{ tar: 'AF4D02', msl: '0A', desc: 'two' }]);
 	assert.strictEqual(_cardsTarCount, 2);
-	assert.match(els['cards-tars'].innerHTML, /cards-tr-0-tar"[^>]*value="000000"/);
+	assert.match(els['cards-tars'].innerHTML, /cards-tr-0-tar"[^>]*value=""/);
 	assert.match(els['cards-tars'].innerHTML, /ISD compact format/);
 	assert.match(els['cards-tars'].innerHTML, /cards-tr-3-tar"[^>]*value="AF4D01"/);
 	assert.match(els['cards-tars'].innerHTML, /cards-tr-4-tar"[^>]*value="AF4D02"/);
@@ -560,6 +559,14 @@ test('the TAR table renders the role rows and adds/removes free rows', () => {
 	// the role rows are never removable
 	cardsTarRemove(0);
 	assert.strictEqual(_cardsTarCount, 2);
+	// an emptied role field survives a re-render (no silent default refill),
+	// while the save path still fills the default
+	tarRow(els, 0, { tar: '', msl: '' });
+	cardsTarRemove(3);
+	assert.strictEqual(_cardsTarCount, 0);
+	assert.match(els['cards-tars'].innerHTML, /cards-tr-0-tar"[^>]*value=""/);
+	assert.strictEqual(cardsTarsFromForm()[0].tar, '000000');
+	assert.strictEqual(cardsTarsFromForm()[0].msl, '16');
 });
 
 test('the list view opens the editor for a new preset and Cancel returns', () => {