feat(swarm): master-side SWARM controller (swarmctl) + agent CLI

Adds decnet/web/swarm_api.py as an independent FastAPI app with routers
for host enrollment, deployment dispatch (sharding DecnetConfig across
enrolled workers via AgentClient), and active health probing. Runs as
its own uvicorn subprocess via 'decnet swarmctl', mirroring the isolation
pattern used by 'decnet api'. Also wires up 'decnet agent' CLI entry for
the worker side.

29 tests added under tests/swarm/test_swarm_api.py cover enrollment
(including bundle generation + duplicate rejection), host CRUD, sharding
correctness, non-swarm-mode rejection, teardown, and health probes with
a stubbed AgentClient.

decnet/web/router/swarm/__init__.py

@@ -0,0 +1,16 @@
+"""Swarm controller routers.
+
+Mounted onto the swarm-api FastAPI app under the ``/swarm`` prefix. The
+controller is a separate process from the main DECNET API so swarm
+failures cannot cascade into log ingestion / dashboard serving.
+"""
+from fastapi import APIRouter
+
+from .hosts import router as hosts_router
+from .deployments import router as deployments_router
+from .health import router as health_router
+
+swarm_router = APIRouter(prefix="/swarm")
+swarm_router.include_router(hosts_router)
+swarm_router.include_router(deployments_router)
+swarm_router.include_router(health_router)