v3.29.1: the per-row keysets in the outfile preview

The import applied one global default keyset to every TAR entry of every
imported card.  The preview's TAR table (TAR + MSL, the three role rows +
"+ TAR") now has a keyset select per row, mirroring the preset editor: an
empty "— none —" plus the keysets found in the file with their KIc/KID,
the first preselected, and the editor's amber warning when a non-zero MSL
has no keyset.  Each TAR's packets then use exactly the chosen keyset.

- PWA: the global "Default keyset for the TARs" select (and the request's
  tar_keyset) is gone; cardsOutfileTarsFromDom/FromForm carry each row's
  keyset; cardsOutfileKeysets() became cardsOutfileKeysetOptions() (the
  union with the KIc/KID bytes for the labels).
- Server: a `tars` entry's own `keyset` (1-15; an unusable value is a 400)
  wins, then the optional global `tar_keyset` (the API shorthand), then the
  card's first keyset - parse_outfile no longer clobbers per-entry keysets
  with the card-level fallback.  presets.normalise_keyset_ref() is
  module-level (one rule for the store and the parser).
- Docs: help EN/RU, api.md (the tars entry keyset + the global fallback),
  the repo AGENTS.  Tests: the per-entry/global/card fallbacks, the
  bad-keyset 400, the options helper, the row select and round-trip, the
  import body.  925 frontend + 944 Python; sw cache simple-v448.

docs/api.md

@@ -336,10 +336,14 @@ into a preview.
 - `tars` — the TAR table every imported card gets (defaults to the three role
   entries with their spec TARs and MSL 16).  A malformed table (a non-3-byte
   TAR, a non-1-byte MSL, a duplicate) is refused with `400`.
-- `tar_keyset` — one **global default keyset** (1–15) written into every TAR
-  entry of every imported card.  Without it the card's first keyset is used
-  (a multi-keyset card would otherwise fail the store's "a non-zero MSL needs
-  a default keyset" rule).
+- `tars` entries may carry their own `keyset` (1–15 — the preview's per-row
+  choice, v3.29.1): it wins; the entries without one fall back to
+  `tar_keyset`, and without that to the card's first keyset (a multi-keyset
+  card would otherwise fail the store's "a non-zero MSL needs a default
+  keyset" rule).  A keyset outside 1–15 is refused with `400`.
+- `tar_keyset` — an optional **global default keyset** (1–15) for the TAR
+  entries that do not name one (the API's shorthand; the PWA sends per-row
+  keysets instead).
 
 Recognised columns (case-insensitive): `ICCID` (the digits + odd-nibble F
 pad, the plain digits, spaced digits or the raw nibble-swapped EF hex all