feat(tarpit): port-selective tc netem tarpit mode with live log events

- GET/POST/DELETE /api/v1/deckies/{name}/tarpit (admin write, viewer GET)
- get_container_veth() + get_container_pid() in network.py via iflink/ip-link
- TarpitRule SQLModel table + TarpitMixin repo (upsert/get/delete/list)
- Background tarpit_watcher_worker: polls /proc/{pid}/net/tcp every 15s,
  emits tarpit_enter/tarpit_exit log events (edge-triggered, with duration)
- tarpit_enabled/tarpit_disabled logs on operator POST/DELETE actions

decnet/web/db/models/__init__.py

@@ -179,6 +179,12 @@ from .workers import (
     WorkersResponse,
     WorkerStatus,
 )
+from .tarpit import (
+    TarpitEnableRequest,
+    TarpitRule,
+    TarpitRuleResponse,
+    TarpitStatusResponse,
+)
 
 __all__ = [
     # _base
@@ -334,4 +340,9 @@ __all__ = [
     "WorkerControlResponse",
     "WorkersResponse",
     "WorkerStatus",
+    # tarpit
+    "TarpitEnableRequest",
+    "TarpitRule",
+    "TarpitRuleResponse",
+    "TarpitStatusResponse",
 ]

decnet/web/db/models/tarpit.py

@@ -0,0 +1,44 @@
+"""Tarpit rule table + HTTP request/response shapes."""
+from datetime import datetime, timezone
+from typing import Any
+
+from pydantic import BaseModel, Field as PydanticField
+from sqlmodel import Field, SQLModel
+
+
+class TarpitRule(SQLModel, table=True):
+    """One active tarpit rule — one per decky at a time.
+
+    ``ports`` is JSON-encoded (e.g. ``"[22, 80]"``).  One row per decky;
+    ``set_tarpit_rule`` upserts on ``decky_name`` so re-enabling with
+    different parameters replaces the old rule.
+    """
+    __tablename__ = "tarpit_rules"
+
+    id: str = Field(primary_key=True)
+    decky_name: str = Field(index=True, unique=True)
+    ports: str          # JSON list[int]
+    delay_ms: int
+    created_at: datetime = Field(
+        default_factory=lambda: datetime.now(timezone.utc)
+    )
+    created_by: str     # operator UUID from JWT
+
+
+class TarpitEnableRequest(BaseModel):
+    ports: list[int] = PydanticField(..., min_length=1)
+    delay_ms: int = PydanticField(..., ge=100, le=300_000)
+
+
+class TarpitRuleResponse(BaseModel):
+    id: str
+    decky_name: str
+    ports: list[int]
+    delay_ms: int
+    created_at: datetime
+    created_by: str
+
+
+class TarpitStatusResponse(BaseModel):
+    rule: TarpitRuleResponse
+    active_connections: list[dict[str, Any]]