fix(api): /deckies/deploy becomes additive by default

The wizard POSTs only the new decky on each submit. The handler used to
treat every INI as the complete desired fleet (config.deckies = INI) so
the reconciler tore down prior deckies as orphans — deploying a second
Windows workstation silently wiped the first.

Add replace_fleet to DeployIniRequest (default false). Default path
merges new deckies into existing config and rejects name/IP collisions
with 409. replace_fleet=true preserves set-desired-state semantics for
CLI / declarative callers. Lifecycle rows are created only for the
deckies submitted in the current call, so /deckies/lifecycle?ids=...
reflects exactly what this submit deployed.

build_deckies_from_ini gains reserved_ips so additive auto-allocation
skips IPs already held by the existing fleet.

decnet/fleet/__init__.py

@@ -104,8 +104,14 @@ def build_deckies_from_ini(
     host_ip: str,
     randomize: bool,
     cli_mutate_interval: int | None = None,
+    reserved_ips: set[str] | None = None,
 ) -> list[DeckyConfig]:
-    """Build DeckyConfig list from an IniConfig, auto-allocating missing IPs."""
+    """Build DeckyConfig list from an IniConfig, auto-allocating missing IPs.
+
+    *reserved_ips* lets the additive deploy path pass the IPs of the
+    already-deployed fleet so auto-allocation skips them instead of
+    handing out a colliding address.
+    """
     from ipaddress import IPv4Address, IPv4Network
     import time
     now = time.time()
@@ -121,6 +127,8 @@ def build_deckies_from_ini(
         IPv4Address(gateway),
         IPv4Address(host_ip),
     } | explicit_ips
+    if reserved_ips:
+        reserved |= {IPv4Address(ip) for ip in reserved_ips}
 
     auto_pool = (str(addr) for addr in net.hosts() if addr not in reserved)