fix: accept comprehension-required tag variants everywhere (v3.6.40)

The TERMINAL PROFILE chain parsed the SET UP MENU title with 'tag == 0x05'
only, so the live Alfa card's title (CR-set 0x85, 'Alfa Mobile') was
dropped: /api/menu returned items without a title and the PWA showed
'No menu set by the card' - card-specific only because cards pick the tag
variant (this one sends plain 0x8F items and a CR-set title in the same
command).

- _parse_setup_menu_command (pure, tested with the live FETCH bytes)
  replaces the inline parse; the PWA shows a title-less menu as 'STK: Menu'
  instead of 'No menu set by the card' (stkMenuLabel, pure).
- _cmd_tlv is now the single lookup helper: exact tag, then tag ^ 0x80
  (bit 8 is the CR flag, TS 101 220 7.1.1); the old '| 0x80'-only helper and
  the duplicate _cmd_tlv_any are gone.
- Remaining single-style checks fixed: _parse_setup_menu_items (0x8F/0x0F),
  _parse_select_item title (0x85/0x05), _find_sms_tpdu (0x8B/0x0B - the
  plain variant lost the SEND SHORT MESSAGE PoR TPDU), the response
  scripting parsers (R-APDU 0x23/0xA3, executed count 0x80/0x00) and the
  FF21 resource tags (0x81-0x83/0x01-0x03).
- tests/test_tag_variants.py flips the CR flag on every top-level tag of
  real command fixtures and asserts identical parse results for all
  parsers (verified to fail when a single-style lookup is reintroduced).

sw cache simple-v313; tests: 524 Python / 675 Node.

frontend/tests/stk_menu.test.js

@@ -26,6 +26,7 @@ code += extractFunc(html, 'stkNoPendingError') + '\n';
 code += extractFunc(html, 'stkMenuPanelReset') + '\n';
 code += extractFunc(html, 'stkMenuNaiSuffix') + '\n';
 code += extractFunc(html, 'stkMenuItemsHtml') + '\n';
+code += extractFunc(html, 'stkMenuLabel') + '\n';
 code += extractFunc(html, 'stkInputHtml') + '\n';
 code += extractFunc(html, 'stkInputHint') + '\n';
 code += extractFunc(html, 'stkInputValidate') + '\n';
@@ -181,3 +182,15 @@ test('stkInputValidate mirrors the server input rules', () => {
 	assert.strictEqual(stkInputValidate({ type: 'get_inkey', digits_only: true }, '*').ok, true);
 	assert.strictEqual(stkInputValidate({ type: 'get_inkey', digits_only: true }, 'a').ok, false);
 });
+
+test('stkMenuLabel shows the card title or a generic label', () => {
+	globalThis.t = s => s;
+	// the card's title when it sent one
+	assert.strictEqual(stkMenuLabel({ title: 'Alfa Mobile', items: [{ id: 1 }] }), 'Alfa Mobile');
+	// a title-less SET UP MENU still shows the menu (TS 102 223 6.6.7)
+	assert.strictEqual(stkMenuLabel({ items: [{ id: 1 }] }), 'Menu');
+	// no items = no menu, whatever the title
+	assert.strictEqual(stkMenuLabel({ title: 'x', items: [] }), '');
+	assert.strictEqual(stkMenuLabel({ items: [] }), '');
+	assert.strictEqual(stkMenuLabel(null), '');
+});