feat(deckies): live service add/remove without full redeploy

decnet.engine.services_live exposes add_service / remove_service for
both fleet and topology decky scopes.  The host's _compose() wrapper
already supported per-service targeting (up --no-deps -d <svc>,
stop, rm -f); what was missing was the orchestration around it:

* add: validate against decnet.services.registry (rejects unknown +
  fleet_singleton); persist the new services list; re-render the
  per-scope compose file (so future redeploys reflect the change);
  run docker compose up -d --no-deps --build <decky>-<svc>.
* remove: stop + rm -f the service container; persist; re-render
  compose so a future up -d doesn't bring it back.

Both publish decky.<name>.service.added / .removed on the bus, with
the post-mutation services list.  Topic constants added to
decnet.bus.topics; the matching wiki entry in wiki-checkout/Service-Bus.md
ships in a separate commit on the wiki repo (wiki-checkout/ is gitignored).

Four new admin endpoints:

* POST/DELETE /api/v1/deckies/{name}/services{,/svc}
* POST/DELETE /api/v1/topologies/{id}/deckies/{name}/services{,/svc}

ServiceMutationError messages are mapped at the API boundary to 404
(decky/topology missing), 409 (idempotency violation), 422 (unknown
or fleet_singleton service).

tests/api/deckies/test_services_api.py

@@ -0,0 +1,161 @@
+"""End-to-end coverage for the live service add/remove endpoints.
+
+Covers both scopes:
+
+* fleet:    POST/DELETE /api/v1/deckies/{decky}/services
+* topology: POST/DELETE /api/v1/topologies/{id}/deckies/{decky}/services
+
+The engine layer's ``add_service``/``remove_service`` is patched so the
+tests don't shell out to docker; the auth + routing + 4xx-mapping path
+runs for real.
+"""
+from __future__ import annotations
+
+import httpx
+import pytest
+
+from decnet.engine import services_live
+from decnet.engine.services_live import ServiceMutationError
+
+
+_FLEET_BASE = "/api/v1/deckies"
+_TOPO_BASE = "/api/v1/topologies"
+
+
+def _hdr(token: str) -> dict[str, str]:
+    return {"Authorization": f"Bearer {token}"}
+
+
+# ---------------- fleet ---------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_fleet_add_service_returns_post_mutation_list(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_add(repo, *, decky_kind, decky_name, service_name, topology_id=None):
+        assert decky_kind == "fleet" and topology_id is None
+        return ["http", service_name]
+    monkeypatch.setattr(services_live, "add_service", _fake_add)
+
+    res = await client.post(
+        f"{_FLEET_BASE}/web1/services",
+        json={"name": "ssh"},
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 200, res.text
+    body = res.json()
+    assert body["decky_name"] == "web1"
+    assert body["services"] == ["http", "ssh"]
+    assert body.get("topology_id") is None
+
+
+@pytest.mark.asyncio
+async def test_fleet_add_service_422_unknown_service(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_add(*a, **kw):
+        raise ServiceMutationError("unknown service 'bogus'")
+    monkeypatch.setattr(services_live, "add_service", _fake_add)
+    res = await client.post(
+        f"{_FLEET_BASE}/web1/services",
+        json={"name": "bogus"},
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 422
+
+
+@pytest.mark.asyncio
+async def test_fleet_add_service_409_already_present(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_add(*a, **kw):
+        raise ServiceMutationError("service 'ssh' already on decky 'web1'")
+    monkeypatch.setattr(services_live, "add_service", _fake_add)
+    res = await client.post(
+        f"{_FLEET_BASE}/web1/services",
+        json={"name": "ssh"},
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 409
+
+
+@pytest.mark.asyncio
+async def test_fleet_remove_service_returns_remaining(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_remove(repo, *, decky_kind, decky_name, service_name, topology_id=None):
+        return ["http"]
+    monkeypatch.setattr(services_live, "remove_service", _fake_remove)
+    res = await client.delete(
+        f"{_FLEET_BASE}/web1/services/ssh",
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 200
+    assert res.json()["services"] == ["http"]
+
+
+@pytest.mark.asyncio
+async def test_fleet_remove_service_404_decky_missing(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_remove(*a, **kw):
+        raise ServiceMutationError("fleet decky 'ghost' not found")
+    monkeypatch.setattr(services_live, "remove_service", _fake_remove)
+    res = await client.delete(
+        f"{_FLEET_BASE}/ghost/services/ssh",
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 404
+
+
+# ---------------- topology ------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_topology_add_service_returns_post_mutation_list(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_add(repo, *, decky_kind, topology_id, decky_name, service_name):
+        assert decky_kind == "topology"
+        assert topology_id == "abc123"
+        return ["http", service_name]
+    monkeypatch.setattr(services_live, "add_service", _fake_add)
+    res = await client.post(
+        f"{_TOPO_BASE}/abc123/deckies/web1/services",
+        json={"name": "ssh"},
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 200, res.text
+    body = res.json()
+    assert body["decky_name"] == "web1"
+    assert body["topology_id"] == "abc123"
+    assert body["services"] == ["http", "ssh"]
+
+
+@pytest.mark.asyncio
+async def test_topology_remove_service_round_trip(
+    client: httpx.AsyncClient, auth_token: str, monkeypatch
+) -> None:
+    async def _fake_remove(repo, *, decky_kind, topology_id, decky_name, service_name):
+        return []
+    monkeypatch.setattr(services_live, "remove_service", _fake_remove)
+    res = await client.delete(
+        f"{_TOPO_BASE}/abc123/deckies/router/services/dns",
+        headers=_hdr(auth_token),
+    )
+    assert res.status_code == 200
+    assert res.json()["services"] == []
+
+
+# ---------------- auth ----------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_unauthenticated_service_mutation_rejected(
+    client: httpx.AsyncClient,
+) -> None:
+    res = await client.post(
+        f"{_FLEET_BASE}/web1/services", json={"name": "ssh"},
+    )
+    assert res.status_code in (401, 403)