feat(swarm): remote teardown API + UI (per-decky and per-host)

Agents already exposed POST /teardown; the master was missing the plumbing
to reach it. Add:

- POST /api/v1/swarm/hosts/{uuid}/teardown — admin-gated. Body
  {decky_id: str|null}: null tears the whole host, a value tears one decky.
  On worker failure the master returns 502 and leaves DB shards intact so
  master and agent stay aligned.
- BaseRepository.delete_decky_shard(name) + sqlmodel impl for per-decky
  cleanup after a single-decky teardown.
- SwarmHosts page: "Teardown all" button (keeps host enrolled).
- SwarmDeckies page: per-row "Teardown" button.

Also exclude setuptools' build/ staging dir from the enrollment tarball —
`pip install -e` on the master generates build/lib/decnet_web/node_modules
and the bundle walker was leaking it to agents. Align pyproject's bandit
exclude with the git-hook invocation so both skip decnet/templates/.

decnet/web/router/swarm_mgmt/__init__.py

@@ -15,6 +15,7 @@ from .api_list_hosts import router as list_hosts_router
 from .api_decommission_host import router as decommission_host_router
 from .api_list_deckies import router as list_deckies_router
 from .api_enroll_bundle import router as enroll_bundle_router
+from .api_teardown_host import router as teardown_host_router
 
 swarm_mgmt_router = APIRouter(prefix="/swarm")
 
@@ -22,3 +23,4 @@ swarm_mgmt_router.include_router(list_hosts_router)
 swarm_mgmt_router.include_router(decommission_host_router)
 swarm_mgmt_router.include_router(list_deckies_router)
 swarm_mgmt_router.include_router(enroll_bundle_router)
+swarm_mgmt_router.include_router(teardown_host_router)