fix: test-script review findings (v3.5.13)

PWA:
- The SCP80 "Source" switch sticks: the choice is stored in
  `params.source`, switching keeps both values (the server honors the
  explicit source when both are present, and the form validates only the
  selected one).
- The SW check field is empty by default (placeholder "default: 9000
  (91?? when polling)"), so the server defaults apply - previously the
  pre-filled 9000 defeated the polling STATUS default and a card that
  announced a command made the step fail with "expected 9000".
- Item text checks offer contains/exact only (the mask mode was rejected
  by the server validation).
- The SCP80 counter is written back to the preset even when the run is
  observed after a page reload or was started elsewhere (resolved by
  ICCID or preset name from the run snapshot).

Server:
- Step-entry mutations happen under `_TEST_LOCK`
  (`_test_entry_update`/`_test_finish_entry`): the status endpoint
  serializes the state with json.dumps, so entries must not change while
  it iterates them.
- The pending-command drains (unexpected command, error, stop) hold
  `_CARD_LOCK` like every other card conversation.
- `_int` accepts plain decimals with leading zeros and 0x hex.
- The scripted TERMINAL RESPONSE text string uses the CR-set tag `8D`
  (consistent with the other TR TLVs; both are legal).
- A script-driven menu selection mirrors `server.menu_active`.

Tests: frontend +4 (source switch/round-trip, status SW default, render
checks, item modes), Python +3 (integer parsing, menu_active, source
selection).  Help/docs unaffected beyond api.md's `source` note.

583 frontend / 470 Python green.

docs/api.md

@@ -394,9 +394,10 @@ suspended; only `/api/test/*`, `/api/status`, `/api/poll-status`,
 **Action steps** (`type: "action"`): `kind` is `envelope` (`event`, `data`),
 `menu-select` (`item_id` 1-255), `file-write` (`path`, `data`, `mode`
 `auto`/`binary`/`record`, `record`), `file-read` (same, verifies `check.data`),
-`apdu` (raw transport, no auto-handler), `scp80` (`apdu` or `sp`, optional
-`tar`/`spi1`/`spi2` overrides - KIc/KID and the counter always come from the
-`preset`, which must match the equipped card and be complete) or `status`
+`apdu` (raw transport, no auto-handler), `scp80` (`apdu` or `sp`, selected by
+the optional `source` field when both are present; optional `tar`/`spi1`/`spi2`
+overrides - KIc/KID and the counter always come from the `preset`, which must
+match the equipped card and be complete) or `status`
 (`attempts`, `interval_ms` - when `attempts > 1` the default SW check is the
 mask `91??`, i.e. poll until the card announces a command).