docs: note the A4 CRT single-key-reference decoding; sw cache bump

Small code-review leftover: efArrSc() keeps only the last '83' key reference
of a malformed multi-reference AT control reference template (compliant CRTs
carry exactly one, ISO 7816-4 6.3.1) - now said so in the code.

The scp81-findings log needs no new rows: no new live SCP81 tests were run
(it is current through 2026-09-16h; the "load/store over SCP81" item in its
Next-tests list is already verified).

Comment-only index.html change -> sw cache simple-v257 (version stays 3.5.4).
549 frontend / 421 Python green.

frontend/index.html

@@ -14019,6 +14019,9 @@ function efArrSc(tlv) {
 	if (tag === 0x97) return 'never';
 	if (tag === 0x9E) return 'security condition 0x' + efHex(v);
 	if (tag === 0xA4) {
+		// An AT control reference template carries one key reference and one
+		// usage qualifier (ISO 7816-4 6.3.1); if a malformed CRT repeats the
+		// '83' tag, the last one wins here.
 		let ref = null, uq = null;
 		for (const t of efTlv(v)) {
 			if (t.tag === 0x83 && t.value.length) ref = t.value[0];

frontend/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'simple-v256';
+const CACHE = 'simple-v257';
 const URLS = [
   'index.html',
   'help.html',