feat(pro): generalize pro tier to multi-surface extension points

Move the pro mount decnet/services/pro/ -> decnet/pro/ so the Professional tier
can contribute to more than honeypots. The core wires each surface only when
decnet/pro/ is present (absence stays the entitlement gate):

* services  — registry scans decnet/pro/services/ (was decnet/services/pro/)
* API routes — decnet/pro/routes.py exposes ROUTERS, mounted under /api/v1
* web pages  — Vite aliases @pro to the pro frontend (community -> empty stub),
               App.tsx maps proRoutes into <Route>s, Layout renders a
               PROFESSIONAL nav group; both tree-shake out of the community build

Frontend gate mirrors the existing VITE_DECNET_DEVELOPER tree-shake pattern.
Tests: registry + router seams (backend), empty-stub contract (frontend).

pyproject.toml

@@ -173,11 +173,10 @@ where = ["."]
 # "decnet*" also globs decnet_web/ and pulls in stray node_modules .py files;
 # pin to the actual package so the wheel/sdist stay clean.
 include = ["decnet", "decnet.*"]
-# Community build is open-core: never ship the Professional-tier honeypots even
-# if a dev tree has the private decnet/services/pro/ submodule mounted. The
-# Professional build overrides this. templates/pro/ is absent from the public
-# tree, so package-data's templates/**/* glob picks up nothing extra here.
-exclude = ["decnet.services.pro", "decnet.services.pro.*"]
+# Community build is open-core: never ship the Professional tier even if a dev
+# tree has the private decnet/pro/ repo mounted. The Professional build overrides
+# this.
+exclude = ["decnet.pro", "decnet.pro.*"]
 
 [tool.setuptools.package-data]
 # Ship docker build contexts + syslog_bridge.py as package data so they land