feat(pro): generalize pro tier to multi-surface extension points

Move the pro mount decnet/services/pro/ -> decnet/pro/ so the Professional tier
can contribute to more than honeypots. The core wires each surface only when
decnet/pro/ is present (absence stays the entitlement gate):

* services  — registry scans decnet/pro/services/ (was decnet/services/pro/)
* API routes — decnet/pro/routes.py exposes ROUTERS, mounted under /api/v1
* web pages  — Vite aliases @pro to the pro frontend (community -> empty stub),
               App.tsx maps proRoutes into <Route>s, Layout renders a
               PROFESSIONAL nav group; both tree-shake out of the community build

Frontend gate mirrors the existing VITE_DECNET_DEVELOPER tree-shake pattern.
Tests: registry + router seams (backend), empty-stub contract (frontend).

decnet_web/vite.config.ts

@@ -1,10 +1,26 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { defineConfig } from 'vitest/config'
 import react from '@vitejs/plugin-react'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+import { existsSync } from 'node:fs'
+
+const here = dirname(fileURLToPath(import.meta.url))
+// `@pro` resolves to the real Professional registry only for an explicit pro
+// build (VITE_DECNET_PRO=1) once the pro frontend is mounted at src/pro-impl/
+// (git-ignored; the pro build copies decnet/pro/web there so react/lucide and
+// tsc resolve normally). Otherwise the empty community stub, which tree-shakes
+// the pro surface out of the bundle.
+const proRealEntry = resolve(here, 'src/pro-impl/index.tsx')
+const proEntry =
+  process.env.VITE_DECNET_PRO === '1' && existsSync(proRealEntry)
+    ? proRealEntry
+    : resolve(here, 'src/pro/stub.ts')
 
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [react()],
+  resolve: { alias: { '@pro': proEntry } },
   test: {
     environment: 'jsdom',
     globals: true,