feat(enroll): systemd units for agent/forwarder/engine + log-directory INI key

Rename log-file-path -> log-directory (maps to DECNET_LOG_DIRECTORY). Bundle
now ships three systemd units rendered with agent_name/master_host and installs
them into /etc/systemd/system/. Bootstrap replaces direct 'decnet X --daemon'
calls with systemctl enable --now. Each unit pins DECNET_SYSTEM_LOGS so agent,
forwarder, and deckies logs land at decnet.{agent,forwarder}.log and decnet.log
under /var/log/decnet.

decnet/web/templates/decnet-agent.service.j2

@@ -0,0 +1,17 @@
+[Unit]
+Description=DECNET worker agent (mTLS control plane) — {{ agent_name }}
+Documentation=https://github.com/anti/DECNET
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.agent.log
+ExecStart=/usr/local/bin/decnet agent --no-forwarder
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:/var/log/decnet/decnet.agent.log
+StandardError=append:/var/log/decnet/decnet.agent.log
+
+[Install]
+WantedBy=multi-user.target

decnet/web/templates/decnet-engine.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=DECNET deckie orchestrator (decnet deploy) — {{ agent_name }}
+Documentation=https://github.com/anti/DECNET
+After=network-online.target decnet-agent.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.log
+ExecStart=/usr/local/bin/decnet deploy
+StandardOutput=append:/var/log/decnet/decnet.log
+StandardError=append:/var/log/decnet/decnet.log
+
+[Install]
+WantedBy=multi-user.target

decnet/web/templates/decnet-forwarder.service.j2

@@ -0,0 +1,18 @@
+[Unit]
+Description=DECNET log forwarder (syslog-over-TLS → master) — {{ agent_name }}
+Documentation=https://github.com/anti/DECNET
+After=network-online.target
+Wants=network-online.target
+PartOf=decnet-agent.service
+
+[Service]
+Type=simple
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.forwarder.log
+ExecStart=/usr/local/bin/decnet forwarder --master-host {{ master_host }} --master-port 6514 --agent-dir /etc/decnet/agent --log-file /var/log/decnet/decnet.log
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:/var/log/decnet/decnet.forwarder.log
+StandardError=append:/var/log/decnet/decnet.forwarder.log
+
+[Install]
+WantedBy=multi-user.target

decnet/web/templates/enroll_bootstrap.sh.j2

@@ -5,7 +5,7 @@
 set -euo pipefail
 
 [[ $EUID -eq 0 ]] || { echo "decnet-install: must run as root (use sudo)"; exit 1; }
-for bin in python3 curl tar; do
+for bin in python3 curl tar systemctl; do
   command -v "$bin" >/dev/null || { echo "decnet-install: $bin required"; exit 1; }
 done
 
@@ -53,8 +53,15 @@ fi
 # combos drop it with mode 0644) and expose it on PATH.
 chmod 0755 "$INSTALL_DIR/.venv/bin/decnet"
 ln -sf "$INSTALL_DIR/.venv/bin/decnet" /usr/local/bin/decnet
-/usr/local/bin/decnet agent --daemon
+
+echo "[DECNET] installing systemd units..."
+install -Dm0644 etc/systemd/system/decnet-agent.service /etc/systemd/system/decnet-agent.service
+install -Dm0644 etc/systemd/system/decnet-forwarder.service /etc/systemd/system/decnet-forwarder.service
+install -Dm0644 etc/systemd/system/decnet-engine.service /etc/systemd/system/decnet-engine.service
+systemctl daemon-reload
+systemctl enable --now decnet-agent.service decnet-forwarder.service
+
 if [[ "$WITH_UPDATER" == "true" ]]; then
   /usr/local/bin/decnet updater --daemon
 fi
-echo "[DECNET] agent {{ agent_name }} enrolled -> {{ master_host }}. Forwarder auto-spawned."
+echo "[DECNET] agent {{ agent_name }} enrolled -> {{ master_host }}. Units: decnet-agent, decnet-forwarder active."