v3.28.3: the outfile ADM byte-pair rule

The review of v3.28.2 found the parser accepting an odd-length ADM (e.g.
12345), while /api/verify-adm requires byte pairs
((?:[0-9A-F]{2}){2,8}) - the stored value could never verify and was
refused with a misleading "adm must be 4-16 hex digits".

The parser now applies the verifier's exact rule: an odd length (a half
byte) or a value over 16 digits is dropped at import time with "ADM is
not 4-16 hex digits in byte pairs".

Docs: help EN/RU, api.md and the repo AGENTS say "4-16 hex digits in
byte pairs".  Tests: the odd-length and the over-16 drop cases (both
real samples are even-length and unaffected: BAP 3632333239463337,
AM0027 CFA3DD9C6B7F0F8C).  915 frontend + 925 Python; sw cache
simple-v441.

docs/api.md

@@ -345,8 +345,8 @@ Recognised columns (case-insensitive): `ICCID` (the digits + odd-nibble F
 pad, the plain digits, spaced digits or the raw nibble-swapped EF hex all
 normalise to the same value), `PIN1`/`PIN2`, `PUK1`/`PUK2` (4–8 digits; an
 invalid value is dropped and reported, the card is kept), `ADM` (the key's
-**hex value**, 4–16 hex digits — the length varies; this is the form the preset
-store and `/api/verify-adm` use), `PSK` (the SCP81 key,
+**hex value**, 4–16 hex digits in byte pairs — the rule `/api/verify-adm`
+applies), `PSK` (the SCP81 key,
 exactly 32 hex chars) and `KICn`/`KIDn` — one keyset per numbered pair, up to
 15.  The **KIc/KID bytes are never in the file**: the keyset number is the
 column number (`KIC2` → keyset 2) and the algorithm nibble follows the key