refactor(cli): split decnet/cli.py monolith into decnet/cli/ package

The 1,878-line cli.py held every Typer command plus process/HTTP helpers
and mode-gating logic. Split into one module per command using a
register(app) pattern so submodules never import app at module scope,
eliminating circular-import risk.

- utils.py: process helpers, _http_request, _kill_all_services, console, log
- gating.py: MASTER_ONLY_* sets, _require_master_mode, _gate_commands_by_mode
- deploy.py: deploy + _deploy_swarm (tightly coupled)
- lifecycle.py: status, teardown, redeploy
- workers.py: probe, collect, mutate, correlate
- inventory.py, swarm.py, db.py, and one file per remaining command

__init__.py calls register(app) on each module then runs the mode gate
last, and re-exports the private symbols tests patch against
(_db_reset_mysql_async, _kill_all_services, _require_master_mode, etc.).

Test patches retargeted to the submodule where each name now resolves.
Enroll-bundle tarball test updated to assert decnet/cli/__init__.py.

No behavioral change.

tests/swarm/test_cli_swarm_update.py

@@ -14,7 +14,7 @@ import pytest
 from typer.testing import CliRunner
 
 from decnet import cli as cli_mod
-from decnet.cli import app
+from decnet.cli import app, utils as cli_utils
 
 
 runner = CliRunner()
@@ -40,7 +40,7 @@ def http_stub(monkeypatch: pytest.MonkeyPatch) -> dict:
             return _FakeResp(state["hosts"])
         raise AssertionError(f"Unscripted HTTP call: {method} {url}")
 
-    monkeypatch.setattr(cli_mod, "_http_request", _fake)
+    monkeypatch.setattr(cli_utils, "_http_request", _fake)
     return state