fix: threaded HTTP server so the RAM modal progress is live (v3.6.39)

__main__ built a plain HTTPServer (single-threaded): during a RAM install
POST every other request waited in the accept queue, including the 2 s
/api/status poll that feeds the operation modal - its bar and step
headline never moved and the whole result appeared only at the end (live
2026-09-29).

_build_http_server() now returns a ThreadingHTTPServer (daemon threads).
Card access is unchanged: it is serialized by _CARD_LOCK, not by the
server - every POST is blanket-wrapped in do_POST, every /api/ GET except
/api/status and /api/test/status is wrapped in do_GET, and the background
threads (STATUS poll, _bip_data_available, test runner) take the lock;
the audit found no card-access holes.  do_GET also lets non-/api (static
PWA) paths bypass the lock, so page assets stay answerable during long
operations.

Regression test tests/test_http_concurrency.py: a fast request must
complete while a slow one is in flight (fails on HTTPServer with exactly
the reported symptom: 1.01 s vs 0.20 s); test_startup_cardless patches
the new factory.

sw cache simple-v312; tests: 519 Python / 674 Node.

tests/test_startup_cardless.py

@@ -77,7 +77,7 @@ class StartupNoCardTest(unittest.TestCase):
              mock.patch.object(srv_main, '_read_iccid', return_value=None), \
              mock.patch.object(srv_main, '_send_terminal_profile', return_value=(None, None)), \
              mock.patch.object(srv_main, '_send_status', return_value=('', '9000')), \
-             mock.patch.object(srv_main, 'HTTPServer') as fake_http, \
+             mock.patch.object(srv_main, '_build_http_server') as fake_http, \
              mock.patch.object(srv_main, 'CardHandler'), \
              mock.patch('sys.stderr', err), mock.patch('sys.stdout', out):
             fake_fastinit.init_card_fast.side_effect = init_side_effect
@@ -128,7 +128,7 @@ class StartupNoCardTest(unittest.TestCase):
         with mock.patch.object(srv_main, 'load_pysim_app', return_value=fake_mod), \
              mock.patch.object(srv_main, 'fastinit') as fake_fastinit, \
              mock.patch.object(srv_main, 'start_card_monitor'), \
-             mock.patch.object(srv_main, 'HTTPServer') as fake_http, \
+             mock.patch.object(srv_main, '_build_http_server') as fake_http, \
              mock.patch.object(srv_main, 'CardHandler'), \
              mock.patch('sys.stderr', err), mock.patch('sys.stdout', out):
             fake_fastinit.init_card_fast.side_effect = NoCardError()