Fix review findings: timer value nibble order, TIMER MGMT qualifier bits

Self-review of 174df8a/d0f8fb8 found two real bugs plus smaller items:

- _decode_timer_value read semi-octets high-nibble first; TS 23.040
  coding (referenced by §8.38) puts the first digit in the LOW nibble
  — "09:25:03" decoded as "90:25:03". Regression test added with an
  asymmetric vector; the original symmetric vectors masked the bug.
- TIMER MANAGEMENT qualifier used bits b2-b3 instead of the spec's
  bits 1-2 (q & 0x03): '01' deactivate was hidden, '02' printed
  "deactivate timer", RFU '04' printed "get current timer value".
  Decoder fixed and wrong expectations corrected.
- Stale text_note: a compliant 8D Text String arriving after the
  non-standard '10' quirk TLV now clears the note.
- Proprietary type format unified to uppercase ("Proprietary (0xF2)").
- GET INKEY: Yes/No bit now suppresses the b1/b2 character-set parts,
  matching §8.6 ("character sets ... are disabled").
- Frontend renders string timer_id values verbatim instead of NaN.

Tests: +4 regressions, expectations corrected — 320 total.

frontend/index.html

@@ -682,7 +682,8 @@ function cmdRows(cmd) {
     if (cmd.response_length) rows.push(['Response length', cmd.response_length.min + '…' + cmd.response_length.max]);
     if (cmd.item_id !== undefined) rows.push(['Item id', '0x' + hx(cmd.item_id, 2)]);
     if (cmd.help) rows.push(['Help', 'requested']);
-    if (cmd.timer_id !== undefined) rows.push(['Timer id', '0x' + hx(cmd.timer_id, 2)]);
+    if (cmd.timer_id !== undefined) rows.push(['Timer id',
+        typeof cmd.timer_id === 'number' ? '0x' + hx(cmd.timer_id, 2) : cmd.timer_id]);
     if (cmd.timer_value) rows.push(['Timer value', cmd.timer_value]);
     if (cmd.ussd) rows.push(['USSD string', cmd.ussd]);
     if (cmd.encapsulated && cmd.encapsulated.type) {