fix(api): /deckies/deploy becomes additive by default

The wizard POSTs only the new decky on each submit. The handler used to
treat every INI as the complete desired fleet (config.deckies = INI) so
the reconciler tore down prior deckies as orphans — deploying a second
Windows workstation silently wiped the first.

Add replace_fleet to DeployIniRequest (default false). Default path
merges new deckies into existing config and rejects name/IP collisions
with 409. replace_fleet=true preserves set-desired-state semantics for
CLI / declarative callers. Lifecycle rows are created only for the
deckies submitted in the current call, so /deckies/lifecycle?ids=...
reflects exactly what this submit deployed.

build_deckies_from_ini gains reserved_ips so additive auto-allocation
skips IPs already held by the existing fleet.

decnet/web/db/models/deploy.py

@@ -17,6 +17,15 @@ class DeployIniRequest(BaseModel):
     # This field now enforces strict INI structure during Pydantic initialization.
     # The OpenAPI schema correctly shows it as a required string.
     ini_content: IniContent = PydanticField(..., description="A valid INI formatted string")
+    replace_fleet: bool = PydanticField(
+        default=False,
+        description=(
+            "If true, the INI is treated as the complete desired fleet — any "
+            "existing decky absent from the INI is torn down. Default false: "
+            "the INI is appended to the existing fleet; name or IP collisions "
+            "with already-deployed deckies yield 409."
+        ),
+    )
 
 
 class DeployResponse(BaseModel):