v3.28.4: the Custom-mode FCI editor + the shared ADM pattern

The profile rule editor rendered the same "FCI hex (raw SELECT response)"
field for Exact and Custom, although the custom check never reads
`fciHex` (it compares the data objects against the card's live FCI) - so
the field looked like an expectation it was not.

- The raw-FCI field and its decoded preview are exact-mode-only now; the
  Custom mode shows just its data-object editor.
- Switching a rule to Custom seeds the data objects from its captured FCI
  when the list is empty (the same all-'value' seeding a captured profile
  gets); the "load from the captured FCI" link refills an emptied list,
  and a rule without a captured FCI still starts empty for manual rows.

From the v3.28.3 review: the ADM's byte-pair rule now lives in one
place, presets.ADM_PATTERN, used by /api/verify-adm and the outfile
import - two literals could drift and an imported ADM could silently
become unverifiable.  The RU help's ADM wording is "4-16 hex-цифр
(чётное число)".

Docs: help EN/RU, the repo AGENTS.  Tests: the mode switch (seed / keep /
no FCI / switch-away), the field-gating source pin, the pattern's shape
and the both-users pin.  917 frontend + 927 Python; sw cache simple-v442.

pysim_simple_server/server.py

@@ -37,7 +37,7 @@ from osmocom.tlv import BER_TLV_IE
 from osmocom.utils import rpad
 
 
-VERSION = '3.28.3'
+VERSION = '3.28.4'
 
 MAX_ENVELOPE_SEGMENTS = 5  # max SMS segments for outgoing C-APDU in ENVELOPE
 
@@ -9088,7 +9088,7 @@ class PysimHandler(BaseHTTPRequestHandler):
             body = self._read_body()
             self._log_req(_redact_psk_fields(body))
             adm = re.sub(r'\s', '', str(body.get('adm') or '')).upper()
-            if not re.fullmatch(r'(?:[0-9A-F]{2}){2,8}', adm):
+            if not re.fullmatch(presets.ADM_PATTERN, adm):
                 resp = {'ok': False, 'error': 'adm must be 4-16 hex digits'}
                 self._send_json(resp, 400)
                 self._log_resp(resp)