v3.26.0 review: the keyless-TAR path

An MSL 00 TAR without a default keyset is a legitimate keyless entry, but
_resolve_operation_keyset left the request's KIc/KID empty and the RAM /
APDU builds failed with "invalid literal for int() with base 16: ''".
The resolution now fills the spec's no-security 00/00 KIc/KID form for a
preset entry without a keyset, and refuses a TAR outside the preset with
a hint (the old silent '25' default was arbitrary).  The PWA's TAR change
resets the form the same way - a stale previous TAR's KIc/KID would
otherwise travel explicitly and build a non-keyless packet.

Also: the dead _preset_tar_keyset helper removed; tests for both keyless
paths.  892 frontend + 886 Python; sw cache simple-v435.

frontend/index.html

@@ -5075,6 +5075,10 @@ function spTarChanged() {
 	if (entry) {
 		const ks = entry.keyset ? spKeysetFor(preset, entry.keyset) : null;
 		if (ks) spKeysetApply(ks);
+		// A TAR without a default keyset (MSL 00) gets the spec's no-security
+		// values - a stale previous TAR's KIc/KID would otherwise travel
+		// explicitly and build a non-keyless packet (v3.26.0 review).
+		else spKeysetApply({ kic: '00', kid: '00', kicKey: '', kidKey: '' });
 		if (entry.msl) spSpi1Seed(entry.msl);
 	}
 	spInvalidate();