fix: accept comprehension-required tag variants everywhere (v3.6.40)

The TERMINAL PROFILE chain parsed the SET UP MENU title with 'tag == 0x05'
only, so the live Alfa card's title (CR-set 0x85, 'Alfa Mobile') was
dropped: /api/menu returned items without a title and the PWA showed
'No menu set by the card' - card-specific only because cards pick the tag
variant (this one sends plain 0x8F items and a CR-set title in the same
command).

- _parse_setup_menu_command (pure, tested with the live FETCH bytes)
  replaces the inline parse; the PWA shows a title-less menu as 'STK: Menu'
  instead of 'No menu set by the card' (stkMenuLabel, pure).
- _cmd_tlv is now the single lookup helper: exact tag, then tag ^ 0x80
  (bit 8 is the CR flag, TS 101 220 7.1.1); the old '| 0x80'-only helper and
  the duplicate _cmd_tlv_any are gone.
- Remaining single-style checks fixed: _parse_setup_menu_items (0x8F/0x0F),
  _parse_select_item title (0x85/0x05), _find_sms_tpdu (0x8B/0x0B - the
  plain variant lost the SEND SHORT MESSAGE PoR TPDU), the response
  scripting parsers (R-APDU 0x23/0xA3, executed count 0x80/0x00) and the
  FF21 resource tags (0x81-0x83/0x01-0x03).
- tests/test_tag_variants.py flips the CR flag on every top-level tag of
  real command fixtures and asserts identical parse results for all
  parsers (verified to fail when a single-style lookup is reintroduced).

sw cache simple-v313; tests: 524 Python / 675 Node.

frontend/index.html

@@ -1732,7 +1732,7 @@
 // ===== Version =====
 // Single source of truth for the PWA version: shown in the header and used
 // by the server version check in pysimConnect().
-const SIMPLE_VERSION = '3.6.39';
+const SIMPLE_VERSION = '3.6.40';
 document.getElementById('app-version').textContent = 'v' + SIMPLE_VERSION;
 
 // ===== Tab switching =====
@@ -9599,13 +9599,23 @@ async function ramExecute() {
 // ===== STK Menu Browser =====
 let stkMenuStack = [];
 
+// The STK button label from /api/menu (pure): the card's title, or a generic
+// label when the SET UP MENU carried none (the alpha identifier is optional,
+// TS 102 223 6.6.7 - a title-less menu must not read as "No menu set by the
+// card").  Empty string = no menu.
+function stkMenuLabel(data) {
+	if (!data || !data.items || !data.items.length) return '';
+	return data.title || t('Menu');
+}
+
 async function stkCheckMenu() {
 	try {
 		const data = await pysimFetch('/api/menu');
 		const btn = document.getElementById('stk-menu-btn');
 		const none = document.getElementById('stk-menu-none');
-		if (data && data.title && data.items && data.items.length) {
-			document.getElementById('stk-menu-title').textContent = data.title;
+		const label = stkMenuLabel(data);
+		if (label) {
+			document.getElementById('stk-menu-title').textContent = label;
 			btn.style.display = '';
 			none.style.display = 'none';
 		} else {
@@ -17641,6 +17651,7 @@ const LANG_RU = {
 	'Yes': 'Да',
 	'No': 'Нет',
 	'Help': 'Справка',
+	'Menu': 'Меню',
 	'one character': 'один символ',
 	'characters': 'символов',
 	'up to': 'до',