refactor(cli): split decnet/cli.py monolith into decnet/cli/ package

The 1,878-line cli.py held every Typer command plus process/HTTP helpers
and mode-gating logic. Split into one module per command using a
register(app) pattern so submodules never import app at module scope,
eliminating circular-import risk.

- utils.py: process helpers, _http_request, _kill_all_services, console, log
- gating.py: MASTER_ONLY_* sets, _require_master_mode, _gate_commands_by_mode
- deploy.py: deploy + _deploy_swarm (tightly coupled)
- lifecycle.py: status, teardown, redeploy
- workers.py: probe, collect, mutate, correlate
- inventory.py, swarm.py, db.py, and one file per remaining command

__init__.py calls register(app) on each module then runs the mode gate
last, and re-exports the private symbols tests patch against
(_db_reset_mysql_async, _kill_all_services, _require_master_mode, etc.).

Test patches retargeted to the submodule where each name now resolves.
Enroll-bundle tarball test updated to assert decnet/cli/__init__.py.

No behavioral change.

tests/api/swarm_mgmt/test_enroll_bundle.py

@@ -293,7 +293,7 @@ async def test_get_tgz_contents(client, auth_token, tmp_path):
     assert "home/.decnet/agent/worker.crt" in names
     assert "home/.decnet/agent/worker.key" in names
     assert "services.ini" in names
-    assert "decnet/cli.py" in names  # source shipped
+    assert "decnet/cli/__init__.py" in names  # source shipped
     assert "pyproject.toml" in names
 
     # Excluded paths must NOT be shipped