refactor(cli): split decnet/cli.py monolith into decnet/cli/ package

The 1,878-line cli.py held every Typer command plus process/HTTP helpers
and mode-gating logic. Split into one module per command using a
register(app) pattern so submodules never import app at module scope,
eliminating circular-import risk.

- utils.py: process helpers, _http_request, _kill_all_services, console, log
- gating.py: MASTER_ONLY_* sets, _require_master_mode, _gate_commands_by_mode
- deploy.py: deploy + _deploy_swarm (tightly coupled)
- lifecycle.py: status, teardown, redeploy
- workers.py: probe, collect, mutate, correlate
- inventory.py, swarm.py, db.py, and one file per remaining command

__init__.py calls register(app) on each module then runs the mode gate
last, and re-exports the private symbols tests patch against
(_db_reset_mysql_async, _kill_all_services, _require_master_mode, etc.).

Test patches retargeted to the submodule where each name now resolves.
Enroll-bundle tarball test updated to assert decnet/cli/__init__.py.

No behavioral change.

tests/test_cli_db_reset.py

@@ -56,7 +56,7 @@ class TestDbResetDispatch:
         monkeypatch.setenv("DECNET_DB_URL", "mysql+aiomysql://u:p@h/d")
 
         mock = AsyncMock()
-        with patch("decnet.cli._db_reset_mysql_async", new=mock):
+        with patch("decnet.cli.db._db_reset_mysql_async", new=mock):
             result = runner.invoke(app, ["db-reset"])
 
         assert result.exit_code == 0, result.stdout
@@ -70,7 +70,7 @@ class TestDbResetDispatch:
         monkeypatch.setenv("DECNET_DB_URL", "mysql+aiomysql://u:p@h/d")
 
         mock = AsyncMock()
-        with patch("decnet.cli._db_reset_mysql_async", new=mock):
+        with patch("decnet.cli.db._db_reset_mysql_async", new=mock):
             result = runner.invoke(app, ["db-reset", "--i-know-what-im-doing"])
 
         assert result.exit_code == 0, result.stdout
@@ -81,7 +81,7 @@ class TestDbResetDispatch:
         monkeypatch.setenv("DECNET_DB_URL", "mysql+aiomysql://u:p@h/d")
 
         mock = AsyncMock()
-        with patch("decnet.cli._db_reset_mysql_async", new=mock):
+        with patch("decnet.cli.db._db_reset_mysql_async", new=mock):
             result = runner.invoke(
                 app, ["db-reset", "--mode", "drop-tables", "--i-know-what-im-doing"]
             )
@@ -94,7 +94,7 @@ class TestDbResetDispatch:
         monkeypatch.setenv("DECNET_DB_URL", "mysql+aiomysql://from-env/db")
 
         mock = AsyncMock()
-        with patch("decnet.cli._db_reset_mysql_async", new=mock):
+        with patch("decnet.cli.db._db_reset_mysql_async", new=mock):
             result = runner.invoke(app, [
                 "db-reset", "--url", "mysql+aiomysql://override/db2",
             ])