esim: decode the notification operations from the card's TLV shape

ListNotification showed 'pmo' as the operation for every notification:
pySim's ProfileMgmtOperation is a Struct whose first (ignored) byte is
the padding-bits octet, so a TLV parsed from the card nests the flags
under 'pmo' while an object built from decoded flags (the unit-test path)
does not.  The mapping iterated the outer dict and reported the nested
dict as a truthy key.

- esim._profile_operations() accepts both shapes and returns the set
  flags in spec/bit order (install, enable, disable, delete).
- tests: a notification parsed from the card-shaped raw TLV (padding
  octet included) plus the helper's both-shapes/multi-flag cases.
- docs: /api/esim/notifications and the repo AGENTS note.

docs/api.md

@@ -232,7 +232,9 @@ lock; `GET /api/status` reports `euicc` and `eid` for the PWA.
   card sent no icon.
 - `GET /api/esim/notifications` — `{"notifications": [{"seq_number": 3,
   "operations": ["enable"], "address": "smdp.example.org",
-  "iccid": "8970…"}], "error": null}`.
+  "iccid": "8970…"}], "error": null}`.  `operations` are the decoded
+  `ProfileMgmtOperation` flags (`install`, `enable`, `disable`, `delete`, in
+  that order) — one or more per notification.
 - `POST /api/esim/profile` — `{"action": "enable"|"disable", "iccid"?: …,
   "isdp_aid"?: …, "refresh"?: true}` (one identifier required).  With the
   refresh flag set the ISD-R returns OK *before* the REFRESH (SGP.22 v2.6