feat(icom): offer the bands the connected radio actually has

The band row was hardwired to 160-6 m, so an IC-9700 - the one radio in the range with no HF at all - showed ten dead buttons and none of 2 m, 70 cm or 23 cm. bandsFor(model) follows the model, exactly as attOptions already did for the attenuator steps. bandOfHz's labels had to move with it: it returned '70' where the button says '70cm', so the current-band highlight could never have matched, and it knew nothing of 23 cm.

app.go

@@ -294,6 +294,11 @@ const (
 
 	keyScpEnabled = "scp.enabled" // Super Check Partial / N+1 suggestions on
 
+	// Web publishing: the whole config as one JSON blob. A single key rather than
+	// twenty: it is read and written as a unit by one settings panel, and the FTP
+	// password rides inside it — see isSensitiveSetting.
+	keyWebPublish = "webpublish.config"
+
 	// Worked-before: fold an operator's portable forms (X, X/3, X/P) together.
 	// Stored inverted — "0" means OFF — so the feature is ON for an existing
 	// install that has never seen the key, which is the behaviour operators asked
@@ -690,6 +695,7 @@ type App struct {
 	awardSnap          []qso.QSO   // light-scanned + enriched logbook snapshot reused across award computations
 	awardSnapRev       string      // logbook revision the snapshot was built at ("" = none)
 	awardSnapUsed      time.Time   // last read — the snapshot is dropped once it goes cold (see awardSnapshotJanitor)
+	webpub             webPublisher // log-to-website publishing: debounce timer, periodic ticker, last result
 	dataDir            string      // <exeDir>/data — holds config.json, logs, cty.dat
 
 	// shuttingDown gates beforeClose re-entry: the first user attempt to
@@ -1238,6 +1244,7 @@ func (a *App) startup(ctx context.Context) {
 	a.clusterEvents = newClusterQueue()
 	go a.clusterEventWorker()
 	go a.awardSnapshotJanitor() // give the award snapshot's memory back once it goes cold
+	a.restartWebPublishTimer()  // periodic log-to-website refresh, if configured
 
 	a.cluster = cluster.NewManager(
 		// onSpot / onLine run on the session's socket-read goroutine, so they must
@@ -2655,6 +2662,7 @@ func (a *App) AddQSO(q qso.QSO) (id int64, err error) {
 			}
 			a.maybeAutoSendEQSL(qc)
 			a.maybeSelfSpot(qc)
+			a.publishSoon() // refresh the published web page, debounced
 			if a.udp != nil {
 				a.udp.EmitLoggedADIF(adif.SingleRecordADIF(qc))
 			}
@@ -11704,6 +11712,7 @@ func (a *App) LogUDPLoggedADIF(adifText string) (int64, error) {
 		}
 		a.maybeAutoSendEQSL(qc)
 		a.maybeSelfSpot(qc)
+		a.publishSoon() // refresh the published web page, debounced
 		// Forward to the outbound UDP integrations, exactly like the manual log
 		// path — otherwise a QSO logged FROM WSJT-X/JTDX/MSHV was never re-emitted
 		// to the outbound ADIF listeners (Log4OM, N1MM, gridtracker…).