perf: migrate hot-path JSON serialization to orjson

stdlib json was FastAPI's default. Every response body, every SSE frame,
and every add_log/state/payload write paid the stdlib encode cost.

- pyproject.toml: add orjson>=3.10 as a core dep.
- decnet/web/api.py: default_response_class=ORJSONResponse on the
  FastAPI app, so every endpoint return goes through orjson without
  touching call sites. Explicit JSONResponse sites in the validation
  exception handlers migrated to ORJSONResponse for consistency.
- health endpoint's explicit JSONResponse → ORJSONResponse.
- SSE stream (api_stream_events.py): 6 json.dumps call sites →
  orjson.dumps(...).decode() — the per-event frames that fire on every
  sse tick.
- sqlmodel_repo.py: encode sites on the log-insert path switched to
  orjson (fields, payload, state value). Parser sites (json.loads)
  left as-is for now — not on the measured hot path.

decnet/web/api.py

@@ -5,7 +5,7 @@ from typing import Any, AsyncGenerator, Optional
 
 from fastapi import FastAPI, Request, status
 from fastapi.exceptions import RequestValidationError
-from fastapi.responses import JSONResponse
+from fastapi.responses import ORJSONResponse
 from pydantic import ValidationError
 from fastapi.middleware.cors import CORSMiddleware
 
@@ -136,6 +136,7 @@ app: FastAPI = FastAPI(
     title="DECNET Web Dashboard API",
     version="1.0.0",
     lifespan=lifespan,
+    default_response_class=ORJSONResponse,
     docs_url="/docs" if DECNET_DEVELOPER else None,
     redoc_url="/redoc" if DECNET_DEVELOPER else None,
     openapi_url="/openapi.json" if DECNET_DEVELOPER else None
@@ -179,7 +180,7 @@ app.include_router(api_router, prefix="/api/v1")
 
 
 @app.exception_handler(RequestValidationError)
-async def validation_exception_handler(request: Request, exc: RequestValidationError) -> JSONResponse:
+async def validation_exception_handler(request: Request, exc: RequestValidationError) -> ORJSONResponse:
     """
     Handle validation errors with targeted status codes to satisfy contract tests.
     Tiered Prioritization:
@@ -199,7 +200,7 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
         for err in errors
     )
     if is_structural_violation:
-        return JSONResponse(
+        return ORJSONResponse(
             status_code=status.HTTP_400_BAD_REQUEST,
             content={"detail": "Bad Request: Schema structural violation (wrong type, extra fields, or invalid length)."},
         )
@@ -210,7 +211,7 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     # Empty INI content (Valid string but semantically empty)
     is_ini_empty = any("INI content is empty" in err.get("msg", "") for err in errors)
     if is_ini_empty:
-        return JSONResponse(
+        return ORJSONResponse(
             status_code=status.HTTP_409_CONFLICT,
             content={"detail": "Configuration conflict: INI content is empty."},
         )
@@ -219,7 +220,7 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     # Mapping to 409 for Positive Data compliance.
     is_invalid_characters = any("Invalid INI format" in err.get("msg", "") for err in errors)
     if is_invalid_characters:
-        return JSONResponse(
+        return ORJSONResponse(
             status_code=status.HTTP_409_CONFLICT,
             content={"detail": "Configuration conflict: INI syntax or characters are invalid."},
         )
@@ -227,7 +228,7 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     # Logical invalidity (Valid string, valid syntax, but missing required DECNET logic like sections)
     is_ini_invalid_logic = any("at least one section" in err.get("msg", "") for err in errors)
     if is_ini_invalid_logic:
-        return JSONResponse(
+        return ORJSONResponse(
             status_code=status.HTTP_409_CONFLICT,
             content={"detail": "Invalid INI config structure: No decky sections found."},
         )
@@ -242,19 +243,19 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     if "/deckies/deploy" in request.url.path:
         message = "Invalid INI config"
 
-    return JSONResponse(
+    return ORJSONResponse(
         status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
         content={"detail": message},
     )
 
 @app.exception_handler(ValidationError)
-async def pydantic_validation_exception_handler(request: Request, exc: ValidationError) -> JSONResponse:
+async def pydantic_validation_exception_handler(request: Request, exc: ValidationError) -> ORJSONResponse:
     """
     Handle Pydantic errors that occur during manual model instantiation (e.g. state hydration).
     Prevents 500 errors when the database contains inconsistent or outdated schema data.
     """
     log.error("Internal Pydantic validation error: %s", exc)
-    return JSONResponse(
+    return ORJSONResponse(
         status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
         content={
             "detail": "Internal data consistency error",