feat(mazenet): per-LAN swarm host pin

Adds nullable LAN.host_uuid (FK swarm_hosts.uuid). Resolution order
when deploying a LAN: lan.host_uuid → topology.target_host_uuid →
master. A LAN is one Docker bridge so the bridge cannot span hosts;
this pin forces every decky in the LAN onto the named host.

LANCreateRequest / LANUpdateRequest accept host_uuid; both validate
that the host exists, returning 400 on unknown UUIDs. PATCH still
gated by the existing pending-only guard, so reassignment of a live
LAN is not yet possible (deferred to mutator support).

LANRow surfaces the field so the frontend can render per-host badges.

decnet/web/router/topology/api_lan_crud.py

@@ -57,11 +57,20 @@ async def api_create_lan(
         )
         subnet = allocator.next_free()
 
+    if body.host_uuid is not None:
+        host = await repo.get_swarm_host_by_uuid(body.host_uuid)
+        if host is None:
+            raise HTTPException(
+                status_code=400,
+                detail=f"swarm host {body.host_uuid!r} not found",
+            )
+
     payload = {
         "topology_id": topology_id,
         "name": body.name,
         "subnet": subnet,
         "is_dmz": body.is_dmz,
+        "host_uuid": body.host_uuid,
         "x": body.x,
         "y": body.y,
     }
@@ -102,6 +111,13 @@ async def api_update_lan(
     await assert_pending_or_409(topology_id)
 
     fields = body.model_dump(exclude_unset=True, exclude={"expected_version"})
+    if "host_uuid" in fields and fields["host_uuid"] is not None:
+        host = await repo.get_swarm_host_by_uuid(fields["host_uuid"])
+        if host is None:
+            raise HTTPException(
+                status_code=400,
+                detail=f"swarm host {fields['host_uuid']!r} not found",
+            )
     try:
         await repo.update_lan(
             lan_id,