feat(topology): pending-only mutation repo methods with cascade + guards

MazeNET phase 2 step 6. Equips the repo layer with the CRUD the web
editor needs before deploy.

- TopologyNotEditable exception: raised when a pending-only method hits
  a non-pending topology. The intent is "free-form edits stop at deploy;
  the mutator (step 7) takes over for live topologies."
- _assert_pending helper checks status inside the session.
- update_lan / update_topology_decky accept enforce_pending=True for
  pre-deploy callers (existing internal callers default to False so
  behavior is unchanged).
- delete_lan: cascades edges; refuses if any decky has only one edge
  (= this LAN is its home) to prevent orphans.
- delete_topology_decky: cascades edges.
- delete_topology_edge: bare-bones removal.

All four mutators accept expected_version for optimistic concurrency.
Existing tests continue to pass (no behavior change for persist/deploy).

decnet/web/db/repository.py

@@ -265,7 +265,14 @@ class BaseRepository(ABC):
     async def add_lan(self, data: dict[str, Any]) -> str:
         raise NotImplementedError
 
-    async def update_lan(self, lan_id: str, fields: dict[str, Any]) -> None:
+    async def update_lan(
+        self,
+        lan_id: str,
+        fields: dict[str, Any],
+        *,
+        expected_version: Optional[int] = None,
+        enforce_pending: bool = False,
+    ) -> None:
         raise NotImplementedError
 
     async def list_lans_for_topology(
@@ -277,7 +284,12 @@ class BaseRepository(ABC):
         raise NotImplementedError
 
     async def update_topology_decky(
-        self, decky_uuid: str, fields: dict[str, Any]
+        self,
+        decky_uuid: str,
+        fields: dict[str, Any],
+        *,
+        expected_version: Optional[int] = None,
+        enforce_pending: bool = False,
     ) -> None:
         raise NotImplementedError
 
@@ -298,3 +310,20 @@ class BaseRepository(ABC):
         self, topology_id: str, limit: int = 100
     ) -> list[dict[str, Any]]:
         raise NotImplementedError
+
+    # -------------------- pre-deploy (pending-only) mutations --------------------
+
+    async def delete_lan(
+        self, lan_id: str, *, expected_version: Optional[int] = None
+    ) -> None:
+        raise NotImplementedError
+
+    async def delete_topology_decky(
+        self, decky_uuid: str, *, expected_version: Optional[int] = None
+    ) -> None:
+        raise NotImplementedError
+
+    async def delete_topology_edge(
+        self, edge_id: str, *, expected_version: Optional[int] = None
+    ) -> None:
+        raise NotImplementedError