v3.28.4: the Custom-mode FCI editor + the shared ADM pattern

The profile rule editor rendered the same "FCI hex (raw SELECT response)"
field for Exact and Custom, although the custom check never reads
`fciHex` (it compares the data objects against the card's live FCI) - so
the field looked like an expectation it was not.

- The raw-FCI field and its decoded preview are exact-mode-only now; the
  Custom mode shows just its data-object editor.
- Switching a rule to Custom seeds the data objects from its captured FCI
  when the list is empty (the same all-'value' seeding a captured profile
  gets); the "load from the captured FCI" link refills an emptied list,
  and a rule without a captured FCI still starts empty for manual rows.

From the v3.28.3 review: the ADM's byte-pair rule now lives in one
place, presets.ADM_PATTERN, used by /api/verify-adm and the outfile
import - two literals could drift and an imported ADM could silently
become unverifiable.  The RU help's ADM wording is "4-16 hex-цифр
(чётное число)".

Docs: help EN/RU, the repo AGENTS.  Tests: the mode switch (seed / keep /
no FCI / switch-away), the field-gating source pin, the pattern's shape
and the both-users pin.  917 frontend + 927 Python; sw cache simple-v442.

pysim_simple_server/presets.py

@@ -103,6 +103,10 @@ TAR_ROLE_DEFAULTS = {
 COUNTER_BITS = 40      # the SCP80 counter is 5 bytes (TS 31.115)
 COUNTER_WIDTH = 10     # ... shown as 10 hex digits
 KVN_MAX = 0x0F         # keyset number '00' is reserved: no key set, no counter
+# The ADM's shape: 4-16 hex digits in byte pairs (the verifier pads it with 'f'
+# to the 8 CHV bytes, so an odd length or a longer value can never verify).
+# Shared by /api/verify-adm and the outfile import so the two cannot drift.
+ADM_PATTERN = r'(?:[0-9A-F]{2}){2,8}'
 
 
 def default_path():