cards: read EF.ICCID at equip and auto-select the matching preset (v2.2.16)

- Server: _decode_iccid (nibble-swapped E.118 digits, trailing-F pad) and
  _read_iccid (best-effort MF/2FE2 read through the parent-scoped select
  helper; the previous selection is restored, the read never raises). The
  equip path records the digit string before the TERMINAL PROFILE, i.e.
  before any CAT session is active; a startup with a card does the same.
  The value is cleared on card removal and exposed as /api/status 'iccid'
  (only while connected).
- PWA: when a connected status update reports a *new* ICCID, the matching
  card preset is selected in both SCP80 views - Secured Packet (sp-card-sel
  + form fill) and RAM (ram-card-sel + _ramCardIdx). Matching normalizes
  digits and accepts the raw EF hex form, leading zeros ignored; a manual
  choice for the same card is kept until the next equip, and a card removal
  re-arms the auto-selection. The status line shows the ICCID.
- Tests: tests/test_iccid.py (decode variants, model + probe read, equip
  recording, disconnect clearing) and frontend/tests/cards_iccid.test.js
  (normalize, find, select, no-override, card swap); the card_state test
  harness stubs the new hook and covers the guard reset.
- Docs: api.md /api/status fields, help EN+RU (SCP80 intro + Cards tab),
  READMEs, AGENTS. SW cache otaman-v183.

docs/api.md

@@ -70,7 +70,18 @@ Returns server version for compatibility checking.
 
 ### `GET /api/status`
 
-Card reader, card type, current selection, and card state.
+Card reader, card type, current selection, and card state. Reported fields:
+`reader`, `connected`, `card_present`, `card_session` (increments on every
+equip/disconnect), `proactive_seq`, `equipping`, `auto_equip`, `card`,
+`profile`, `iccid`, `app_ready`, `adm_verified`, `atr`, `cla_byte`,
+`sel_ctrl`, `current_selection`, `channels`.
+
+`iccid` is the E.118 digit string read from EF.ICCID (MF/2FE2) when the card is
+equipped, or `null` when it is not connected / the card does not let the
+terminal read it. The equip path reads it **before** the TERMINAL PROFILE, so
+no CAT session is active yet; the read is best-effort and never fails an equip
+(and a card removal clears it). The PWA uses it to auto-select the card preset
+with the same ICCID in both SCP80 views (Secured Packet and RAM).
 
 ### `GET /api/commands`