release: v3.9.1 - the counter probe sends a fixed read-only APDU

- The probe no longer takes a caller-supplied `apdu`: it always sends the
  read-only SELECT MF (the counter advances on the packet's security
  acceptance whatever the applet answers - 6A86/6D00 are normal there), so
  no caller can turn the sync probe into a write.
- Version 3.9.1: server VERSION, pyproject.toml and the PWA header; sw cache
  simple-v357; docs/api.md and the repo AGENTS.md updated, and the workspace
  AGENTS.md gains the v3.9.1 history entry (its "Currently" line was stale at
  v3.7.1).

frontend/index.html

@@ -1801,7 +1801,7 @@
 // ===== Version =====
 // Single source of truth for the PWA version: shown in the header and used
 // by the server version check in pysimConnect().
-const SIMPLE_VERSION = '3.9.0';
+const SIMPLE_VERSION = '3.9.1';
 document.getElementById('app-version').textContent = 'v' + SIMPLE_VERSION;
 
 // ===== Tab switching =====