Add server-side APDU decoder (decode.py)

Pure Python, no dependencies. Decodes raw TPDU bytes into
structured JSON: CLA bitfield, INS->name via APDU_SPEC table,
P1/P2 field breakdown, body extraction, SW name lookup.
~40 command types, 40+ SW codes, known FID notes.

database.py: _row_to_message() calls decode_message() for tpdu
messages, adding 'decoded' field to API responses.

Decoding happens at query time, not storage time — no schema
migration, all past sessions get decode retroactively.

simtrace2_pysniff/server/database.py

@@ -167,11 +167,16 @@ class Database:
         return [{'type': r[0], 'count': r[1]} for r in rows]
 
     def _row_to_message(self, row):
-        return {
+        data_blob = row[4]
+        msg = {
             'id': row[0],
             'session_id': row[1],
             'elapsed': row[2],
             'type': row[3],
-            'data': row[4].hex(),
+            'data': data_blob.hex(),
             'flags': row[5],
         }
+        if row[3] == 'tpdu' and data_blob:
+            from .decode import decode_message
+            msg['decoded'] = decode_message(data_blob)
+        return msg