v3.11.0 review fixes: ADM length, TAR re-render hygiene

- the ADM input capped the key at 8 chars, but the server's _verify_adm
  takes 4-16 hex digits (padded to 8 CHV bytes) and the old input had no
  limit; maxlength=16 now, with a static guard in html.test.js.
- cardsTarAdd/cardsTarRemove re-rendered the table from the save-path
  reader, so an emptied role field was silently refilled with its default.
  The renderer no longer invents defaults; a raw reader (cardsTarsFromTable)
  feeds Add/Remove and the language-switch refresh, while the save path
  (cardsTarsFromForm) keeps the default-filling for the mandatory roles.
- the editor's dynamic TAR/keyset rows now rebuild on a language switch
  (refreshDynamicI18n) from what is typed - their placeholders and titles
  carry t() strings.  (The title/Save label were already refreshed there.)
- dropped the now-unused cardsRoleMsl helper and its test references.
- docs: the ADM is documented as 4-16 hex digits (help EN/RU, api.md,
  AGENTS).  sw cache simple-v362.

Tests: 665 Python + 784 frontend green; the whole inline PWA script
syntax-checked.

frontend/tests/html.test.js

@@ -164,6 +164,16 @@ test('the card editor groups its fields into labelled fieldsets', () => {
     assert.ok(!fieldsets.some(f => f.includes('id="cards-name"')));
 });
 
+test('the ADM input allows the full 4-16 hex digit key', () => {
+    // the server's _verify_adm takes 4-16 hex digits (padded to 8 CHV bytes);
+    // the input must not cap it at the PIN length
+    const m = /<input id="cards-adm"[^>]*>/.exec(html);
+    assert.ok(m, 'the ADM input is missing');
+    const limit = /maxlength="(\d+)"/.exec(m[0]);
+    assert.ok(!limit || parseInt(limit[1], 10) >= 16,
+        'the ADM input must allow 4-16 hex digits (server _verify_adm)');
+});
+
 test('the Cards tab splits the preset list and the editor into views', () => {
     assert.match(html, /id="cards-list-view"/);
     assert.match(html, /id="cards-editor-view" class="hidden"/);