iPhone app: test pairing and power against a Holo Core stand-in

Valve publishes no Steam Frame OS image, so tests/frame-container builds the
Frame's SSH surface on Valve and Collabora's Holo Core aarch64 base: a
steamos user with a password and sudo, OpenSSH with keys and passwords,
Python, and a systemctl that only records requests.

Against it from the Simulator: password pairing, the host-key pin, the power
password check. Found and fixed: a changed host key or a refused login said
"Can't reach the Frame" and retried forever; they now say "Pair with the
Frame again" and offer that. The server's key rejection now says the header
may be wrong, not only missing.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/server.py

@@ -1283,7 +1283,7 @@ class Handler(BaseHTTPRequestHandler):
         # trigger a headset capture and display it.
         api = urlparse(self.path).path.startswith("/api/")
         if (self.command == "POST" or api) and not secrets.compare_digest(self.headers.get("X-Frame-UI") or "", UI_KEY):
-            self.send_json({"error": "missing X-Frame-UI header"}, 403)
+            self.send_json({"error": "missing or wrong X-Frame-UI header"}, 403)
             return False
         return True