feat(pro): generalize pro tier to multi-surface extension points

Move the pro mount decnet/services/pro/ -> decnet/pro/ so the Professional tier
can contribute to more than honeypots. The core wires each surface only when
decnet/pro/ is present (absence stays the entitlement gate):

* services  — registry scans decnet/pro/services/ (was decnet/services/pro/)
* API routes — decnet/pro/routes.py exposes ROUTERS, mounted under /api/v1
* web pages  — Vite aliases @pro to the pro frontend (community -> empty stub),
               App.tsx maps proRoutes into <Route>s, Layout renders a
               PROFESSIONAL nav group; both tree-shake out of the community build

Frontend gate mirrors the existing VITE_DECNET_DEVELOPER tree-shake pattern.
Tests: registry + router seams (backend), empty-stub contract (frontend).

decnet/web/router/__init__.py

@@ -218,3 +218,13 @@ api_router.include_router(ttp_rules_router)
 api_router.include_router(ttp_tag_details_router)
 api_router.include_router(ttp_navigator_router)
 api_router.include_router(ttp_groups_for_technique_router)
+
+# Professional tier (optional): mount pro routers under /api/v1 when the
+# decnet/pro/ package is present. Absence is the entitlement gate — community
+# builds have no decnet.pro, so this is a no-op there.
+try:
+    from decnet.pro.routes import ROUTERS as _pro_routers
+except ModuleNotFoundError:
+    _pro_routers = []
+for _pro_router in _pro_routers:
+    api_router.include_router(_pro_router)