fix: Explore Apps listing uses the SMS-submit PoR transport (v3.6.10)

The Apps query (P1=40) was sent with SPI2=0x01 while only the ELF queries
(P1=20/10) used SPI2=0x21.  The Apps listing can exceed the ENVELOPE
response, and the card then answers the envelope PoR with
`actual_response_sms_submit` - the actual response would follow as an
SMS-SUBMIT, which is never sent unless the PoR is requested in submit mode.
The paginate only accepted `por_ok`, so the Explore reported the raw status
as an error ("Partial - Apps: actual_response_sms_submit") and the Apps list
never rendered (live 2026-09-28).

- `ramListingSpi2(p1)`: 40/20/10 -> '21', else '01'; the paginate uses it.
- the paginate accepts `actual_response_sms_submit` via `spPorAccepted` and,
  when no data arrived, notes "response via SMS not captured" instead of
  reporting the card status as a failure.
- the Explore delete verdict follows the same acceptance rule (an accepted
  SMS-submit delete no longer shows "Failed" while its counter advanced) and
  no longer prints a dangling " -> " without a SW.
- tests: ramListingSpi2 + the delete-accepted-via-sms-submit flow.

633 frontend / 496 Python green; version 3.6.10; sw simple-v283.

frontend/tests/ram_counter_flow.test.js

@@ -98,6 +98,17 @@ test('a refused DELETE still advances the counter but does not re-explore', asyn
 	assert.strictEqual(calls.explored, null);
 });
 
+test('a delete accepted via actual_response_sms_submit advances and re-explores', async () => {
+	// The card consumed the packet and will deliver the remote result as an
+	// SMS-SUBMIT; the counter must advance and the re-explore must run (the
+	// remote SW is unknown, so no SW is shown).
+	const { els, calls } = fakeEnv({ response_status: 'actual_response_sms_submit' });
+	await ramDeleteFromExplorer('F0414C46416101', false);
+	assert.strictEqual(cards[0].cntr, '0000000006');
+	assert.strictEqual(calls.explored, '0000000006');
+	assert.strictEqual(els['ram-result'].textContent, 'OK');
+});
+
 test('a send failure leaves the preset untouched', async () => {
 	const { calls } = fakeEnv({ response_status: 'por_ok' }, false);
 	await ramDeleteFromExplorer('F0414C46416101', false);