net: network-state monitor and permanent-rejection FPLMN (v2.7.0)

server:
- netsim: LOCI/PSLOCI dummy builders take a status; the EPSLOCI dummy is
  wiped to 0B F6 + FF per UICC_NAA.md C3; roaming_denied now emulates the
  permanent 'PLMN not allowed' rejection (C3a): status 010, EPSNSC dropped,
  EF.FPLMN append with TS 31.102 4.2.16 shift semantics and a home-PLMN
  guard (HPLMNwAcT/EHPLMN, IMSI fallback), optional 'Rejection: write FPLMN'
  toggle; write steps carry the logical key; SCENARIO_SERVICE map;
  insert_fplmn/fplmn_entries/parse_imsi helpers
- netstate.py: cached per-session monitor state for the 12 network EFs,
  step-based patch, simulated service state, derived location with country/
  operator (optional MCC/MNC list) and roaming class
- server: monitor read at equip right after a readable ICCID (skipped
  otherwise), cleared on card removal; GET /api/net-state and POST
  /api/net-state-refresh; net-sim patches the cache from the written bytes
  and re-reads EF.IMSI; Location-status events set the service state and
  re-read EF.IMSI (multi-IMSI applets)

frontend:
- Phone tab: 'Network state' panel next to Network simulation with the
  simulated service badge (Undefined until simulated; normal/limited/no
  service + rejection marker), location/roaming line, compact per-file
  summaries with full-decode tooltips and a Refresh button; no card polling
- EF decoders: EF.FPLMN (FFFFFF gaps are not terminators) and EF.EHPLMN
- i18n EN/RU, help updated; SW cache simple-v203

tests: 295 Python / 453 frontend

frontend/tests/html.test.js

@@ -70,6 +70,16 @@ test('card-dependent profiler buttons show the ICCID and need a readable one', (
     assert.match(html, /id="snapshot-new-btn"[\s\S]*?<span class="profiler-iccid-label" data-iccid-sep=": "><\/span><\/button>/);
 });
 
+test('network state monitor panel lives next to the network simulation', () => {
+    assert.match(html, /data-l10n="Network state"/);
+    assert.match(html, /id="netstate-badge"/);
+    assert.match(html, /id="netstate-refresh-btn" data-needs="card"/);
+    assert.match(html, /id="netstate-body"/);
+    assert.match(html, /id="netsim-write-fplmn"/);
+    // the monitor is rendered from the cached server state (no file polling)
+    assert.ok(html.includes("netStateFetch()"));
+});
+
 test('labelled containers use fieldsets with embedded legends', () => {
     const legendCls = '<legend class="px-1 text-xs font-medium text-gray-500 dark:text-slate-400"';
     for (const label of ['STK menu', 'STATUS and Polling', 'TERMINAL PROFILE',