Files view: per-file tracking (counters, image, device/card changes)

- new `simtrace_analyser/filetrack.py`: a single-pass tracker over a
  session's decoded messages, keyed by (DF, FID) and trace-wide (resets only
  wipe the per-channel selection): counters (`select`/`read`/`update`,
  successful operations only), a sparse image of the observed bytes
  (transparent files by offset, record files per record number) and the
  change log
- changes: **device** = an UPDATE seen in the trace (applied to the image,
  `no_change` flags a provable no-op); **card** = a READ whose bytes differ
  from the image on bytes already known (logged at the surfacing read with
  the changed ranges and the before/after hex; never-seen bytes just fill
  the image, they are an observation, not a change)
- SFI-addressed accesses join the same entry as path/FID ones: the SFI ↔ FID
  relations come from the normative tables and from every surfaced FCP `88`
  DO (including the spec's "SFI = 5 LSBs of the FID" rule when the DO is
  absent); an SFI used before its relation is learned stays provisional and
  merges into the resolved entry
- the DF identity follows TS 102 221 §8.4/Table 8.2: `selected_df_fid()` now
  resolves an EF path selection to its parent DF and returns `aid:<hex>` for
  applications selected by an unknown AID (named from EF.DIR when the trace
  surfaced it); `Database._decode_rows` gained an `on_message` hook and
  `track_files()`
- `GET /api/sessions/<id>/files`: the operation timeline, the per-file
  counters/coverage/change log, the SFI relations and the AID labels
- PWA: the side panel's Map/Stats tabs became a view selector (Map / Stats /
  Files); the Files view is a timeline of Read / Update / Changed (card) rows
  (colour-coded, the same file names as the Map view), a row click jumps to
  the APDU (loading the pages it needs) and a card-change row's Δ opens the
  changed ranges with the previous and the new bytes; EN/RU
- bounds: the image freezes past 64 KB of observed bytes per file, the change
  log keeps the last 1000 events per file (counters keep counting)
- tests: tests/test_filetrack.py (counters, resets, channels, image/diff
  semantics, record files, SFI resolution and the provisional merge, EF.DIR
  labels, caps, the endpoint) and Node tests for the Files-view helpers and
  wiring
- v2.3.0; MIN_SERVER_VERSION 2.3.0; SW cache simtrace-analyser-v63

tests/test_decode.py

@@ -1690,11 +1690,37 @@ class TestSfiResolution(unittest.TestCase):
         self.assertIsNone(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '00'},
                                            'body': {'hex': '6f7e'}}))
         self.assertIsNone(selected_df_fid({'ins_hex': 'b0'}))
+        # SELECT by AID: the USIM maps to its virtual FID, any other
+        # application keeps its AID as the DF identity.
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '04'},
+                                          'body': {'hex': 'a0000000871002ff'}}), '7fff')
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '04'},
+                                          'body': {'hex': 'A00000015141434C00'}}),
+                         'aid:a00000015141434c00')
+        self.assertIsNone(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '04'},
+                                           'body': {'hex': ''}}))
+        # An AID DF has no normative SFI table.
+        self.assertEqual(sfi_table('aid:a00000015141434c00'), {})
         self.assertEqual(sfi_table('7fff')[0x1e], '6fe3')
         self.assertEqual(sfi_table('3f00')[0x1e], '2f00')
         self.assertEqual(sfi_table('7fff')[0x17], '6f06')
         self.assertEqual(sfi_table('7fff')[0x1a], '6fc6')
         self.assertEqual(sfi_table('6f7e'), {})
+        # TS 102 221 §8.4.1: selecting an EF leaves its parent DF current.
+        # 'path from MF', single component → directly under MF (Table 8.2).
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '08'},
+                                          'body': {'hex': '2fe2'}}, '7fff'), '3f00')
+        # 'path from MF' via the ADF: the EF's parent is 7FFF.
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '08'},
+                                          'body': {'hex': '7fff6f07'}}, '3f00'), '7fff')
+        # 'path from current DF': a single EF stays in the current DF.
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '09'},
+                                          'body': {'hex': '6f7e'}}, '7fff'), '7fff')
+        # …and an unknown application keeps its AID identity for '7fff'.
+        self.assertEqual(selected_df_fid({'ins_hex': 'a4', 'p1': {'raw': '08'},
+                                          'body': {'hex': '7fff4f09'}},
+                                         'aid:a00000015141434c00'),
+                         'aid:a00000015141434c00')
 
     def test_record_p2_sfi(self):
         # READ RECORD P2 = 0xBC → SFI = 0xBC>>3 = 23, mode = 0x04.