Add --reset and post-import --set-password; fix algorithm nibble parsing

Add two admin operations on the OATH protocol layer: --reset (RESET
0x04/0xDEAD) and --set-password, which sets an access password after a
successful import only if the applet has none. Fix _parse_select to mask
the SELECT ALGORITHM tag to its low nibble (the applet reports the full
type|algo byte, e.g. 0x21), which previously broke validate on a locked
applet. Add a clean top-level OathError handler.

docs/design.md

@@ -201,11 +201,25 @@ exceptions (no card, reader gone) surface as clear, actionable messages.
   oversize key, SHA512).
 - `61xx` reassembly via a fake channel that chunks a long LIST response.
 
+## Password / reset admin (added after initial spec)
+
+The importer also exposes two admin operations on the same protocol layer:
+
+- `--set-password PASS`: after a fully successful import, set an access password
+  on the applet **only if it has none** (SET CODE with a SHA1 access key derived
+  as above). Runs post-import for efficiency (single session). Does not change or
+  remove an existing password.
+- `--reset`: standalone; sends RESET (P1P2 = 0xDEAD) to wipe all credentials and
+  any password, then exits.
+
+Note: the applet reports the full `type|algo` byte (e.g. `0x21`) in the SELECT
+ALGORITHM tag; the low nibble is masked off to select the HMAC algorithm.
+
 ## Out of scope (YAGNI)
 
-Setting/changing/removing the applet password (authenticate-only); HOTP import;
-touch-required; RENAME/DELETE; CSV/text input; on-device code calculation
-(beyond optional post-import verification, not included).
+Changing or removing an existing password; HOTP import; touch-required;
+RENAME/DELETE of individual credentials; CSV/text input; on-device code
+calculation (beyond ad-hoc post-import verification, not part of the tool).
 
 ## Files