v3.26.0: per-TAR default keysets (the preset/SCP80/RAM rework)

Every preset TAR entry carries `keyset` (int 1-15) - the keyset every
operation addressed to that TAR uses: mandatory for any non-zero MSL
(the counters are keyset-linked), optional for MSL 00 (allowed: some
cards reject the no-security 00/00 KIc/KID form).  The store fills it
automatically when the preset has a single keyset, the validation
refuses an entry naming an undefined keyset, and the schema is 6 (a v5
file loads leniently; editing it forces the fix).

The keyset selectors are gone: the SCP80 TAR field became a select of
the preset's entries (applying the TAR's keyset to the form and seeding
the SPI1 from its MSL); the RAM operations use the preset's ISD role
entry (the PWA sends only the preset id, the ISD TAR, SPI and the
counter override - the server resolves the keyset and the keys:
presets.tar_keyset, _preset_tar_keyset, _resolve_operation_keyset,
_op_keyset, used by send-ota's APDU path, ram-install, ram-install-app
and cap-compat); the counter probe and the test runner's scp80 steps
default to their TAR's keyset (an explicit kvn stays an override).  A
security TAR without a keyset refuses the operation ("set it in the
Cards tab") - never a silent keyless send - and the start buttons wait
for a usable operation-TAR keyset.

The TAR probe checks the preset's TAR list only (the standard
TAR_PROBE_TARS list and the custom-TAR localStorage are gone; a `tars`
list selects a subset, a TAR outside the preset is refused), each row
using its own MSL and default keyset.  The Cards editor's TAR table
gained a Keyset column (the only keyset preselected, an amber marker
when a security MSL lacks one).

Docs: help EN/RU, api.md's tar-probe contract, both AGENTS.  Tests: the
store (the field, the auto-fill, the schema, the string forms), the
server resolution (send-ota + the refusal, the probe's per-row keysets
and refusals), the PWA (the TAR select, the RAM ISD resolution, the
keyset-free requests) - several fixtures updated for the new schema.
891 frontend + 885 Python; sw cache simple-v434.

tests/test_testscript.py

@@ -25,11 +25,12 @@ def _resolver(name):
     return {n.upper(): c for c, n in S.PROACTIVE_TYPE_NAMES.items()}.get(name.upper())
 
 
-def preset_tars(isd='000000', msl='16'):
-    """The three mandatory role entries of a card preset's TAR table."""
-    return [{'role': 'isd', 'tar': isd, 'msl': msl, 'desc': ''},
-            {'role': 'uiccRfm', 'tar': 'B00000', 'msl': '16', 'desc': ''},
-            {'role': 'usimRfm', 'tar': 'B00001', 'msl': '16', 'desc': ''}]
+def preset_tars(isd='000000', msl='16', keyset=1):
+    """The three mandatory role entries of a card preset's TAR table (v3.26.0:
+    each carries its default keyset - the fixtures name keyset 1)."""
+    return [{'role': 'isd', 'tar': isd, 'msl': msl, 'desc': '', 'keyset': keyset},
+            {'role': 'uiccRfm', 'tar': 'B00000', 'msl': '16', 'desc': '', 'keyset': keyset},
+            {'role': 'usimRfm', 'tar': 'B00001', 'msl': '16', 'desc': '', 'keyset': keyset}]
 
 
 class TestValidation(unittest.TestCase):
@@ -1974,7 +1975,8 @@ class TestSuiteRunner(SuiteRunnerTestCase):
         preset = {'id': 'p1',
                   'keysets': [{'kic': '15', 'kid': '15', 'kicKey': '00' * 16,
                                'kidKey': '00' * 16, 'cntr': '0000000010'}],
-                  'tars': [{'role': 'isd', 'tar': 'B00000', 'msl': '16'}]}
+                  'tars': [{'role': 'isd', 'tar': 'B00000', 'msl': '16',
+                            'keyset': 1}]}
         members = [({'script_id': 'a' * 32, 'role': 'member', 'on_fail': 'stop'}, script),
                    ({'script_id': 'b' * 32, 'role': 'member', 'on_fail': 'stop'}, script)]
         with mock.patch.object(S, '_build_secured_packet',