v3.28.4: the Custom-mode FCI editor + the shared ADM pattern

The profile rule editor rendered the same "FCI hex (raw SELECT response)"
field for Exact and Custom, although the custom check never reads
`fciHex` (it compares the data objects against the card's live FCI) - so
the field looked like an expectation it was not.

- The raw-FCI field and its decoded preview are exact-mode-only now; the
  Custom mode shows just its data-object editor.
- Switching a rule to Custom seeds the data objects from its captured FCI
  when the list is empty (the same all-'value' seeding a captured profile
  gets); the "load from the captured FCI" link refills an emptied list,
  and a rule without a captured FCI still starts empty for manual rows.

From the v3.28.3 review: the ADM's byte-pair rule now lives in one
place, presets.ADM_PATTERN, used by /api/verify-adm and the outfile
import - two literals could drift and an imported ADM could silently
become unverifiable.  The RU help's ADM wording is "4-16 hex-цифр
(чётное число)".

Docs: help EN/RU, the repo AGENTS.  Tests: the mode switch (seed / keep /
no FCI / switch-away), the field-gating source pin, the pattern's shape
and the both-users pin.  917 frontend + 927 Python; sw cache simple-v442.

pysim_simple_server/outfile.py

@@ -272,7 +272,7 @@ def parse_outfile(text, name='', algorithm16='3des2', tars=None, tar_keyset=None
             # Byte pairs, exactly like /api/verify-adm: an odd length is a half
             # byte and the verifier would always refuse the stored value
             # (v3.28.3).
-            if re.fullmatch(r'(?:[0-9A-F]{2}){2,8}', adm):
+            if re.fullmatch(presets.ADM_PATTERN, adm):
                 entry['adm'] = adm
             else:
                 skip('line %d: ADM is not 4-16 hex digits in byte pairs - dropped'

pysim_simple_server/presets.py

@@ -103,6 +103,10 @@ TAR_ROLE_DEFAULTS = {
 COUNTER_BITS = 40      # the SCP80 counter is 5 bytes (TS 31.115)
 COUNTER_WIDTH = 10     # ... shown as 10 hex digits
 KVN_MAX = 0x0F         # keyset number '00' is reserved: no key set, no counter
+# The ADM's shape: 4-16 hex digits in byte pairs (the verifier pads it with 'f'
+# to the 8 CHV bytes, so an odd length or a longer value can never verify).
+# Shared by /api/verify-adm and the outfile import so the two cannot drift.
+ADM_PATTERN = r'(?:[0-9A-F]{2}){2,8}'
 
 
 def default_path():

pysim_simple_server/server.py

@@ -37,7 +37,7 @@ from osmocom.tlv import BER_TLV_IE
 from osmocom.utils import rpad
 
 
-VERSION = '3.28.3'
+VERSION = '3.28.4'
 
 MAX_ENVELOPE_SEGMENTS = 5  # max SMS segments for outgoing C-APDU in ENVELOPE
 
@@ -9088,7 +9088,7 @@ class PysimHandler(BaseHTTPRequestHandler):
             body = self._read_body()
             self._log_req(_redact_psk_fields(body))
             adm = re.sub(r'\s', '', str(body.get('adm') or '')).upper()
-            if not re.fullmatch(r'(?:[0-9A-F]{2}){2,8}', adm):
+            if not re.fullmatch(presets.ADM_PATTERN, adm):
                 resp = {'ok': False, 'error': 'adm must be 4-16 hex digits'}
                 self._send_json(resp, 400)
                 self._log_resp(resp)