feat(api): /deckies/deploy and /mutate become 202 fire-and-forget

This is the unblock for the wizard hang. Both endpoints used to run
docker compose synchronously inside the HTTP handler -- on master
(unihost) or via asyncio.gather of worker /deploy POSTs at 600s
timeout each (swarm) -- blocking every other API request.

New flow:
  1. Commit the new config shape to repo state (fast).
  2. Create one DeckyLifecycle row per decky (status=pending).
  3. Spawn asyncio.create_task(run_deploy / run_mutate) -- the
     lifecycle runner drives rows through running -> succeeded|failed
     and emits decky.<name>.lifecycle on the bus.
  4. Return 202 with {lifecycle_ids: [...]}. Wizard polls
     GET /deckies/lifecycle?ids=... (next commit).

mutator/engine.py gains pick_new_services() -- shared between the
async API path and the watch-loop's synchronous mutate_decky().

DeployResponse grows lifecycle_ids[]. The old dispatch_decnet_config
helper still exists for the CLI swarm-deploy command path; it just
isn't called from the API handler anymore.

Test changes: 200 -> 202, drop dispatch_decnet_config mocks (handler
no longer calls it), assert lifecycle_ids in response + committed
state matches expectations.

tests/api/config/test_deploy_limit.py

@@ -57,7 +57,7 @@ services = ssh
         json={"ini_content": ini},
         headers={"Authorization": f"Bearer {auth_token}"},
     )
-    assert resp.status_code == 200
+    assert resp.status_code == 202
     persisted = await repo.get_state("deployment")
     names = [d["name"] for d in persisted["config"]["deckies"]]
     assert names == ["only-decky"]
@@ -81,4 +81,4 @@ services = ssh
     if resp.status_code == 409:
         assert "limit" not in resp.json()["detail"].lower()
     else:
-        assert resp.status_code == 200
+        assert resp.status_code == 202