feat(mutator): update_decky payload accepts top-level services list

apply_update_decky only merged payload.patch into decky_config. Since
services is a separate DB column, there was no way to replace a decky's
services list via a mutation. Add a top-level services key to the op
payload that maps straight onto the services column.

Unblocks the MazeNET editor routing service-add/service-drop actions
through the mutation queue on active topologies.

tests/topology/test_mutator.py

@@ -158,6 +158,25 @@ async def test_apply_add_lan_persists(repo):
     assert "LAN-MUT" in names
 
 
+@pytest.mark.anyio
+async def test_apply_update_decky_replaces_services(repo):
+    """Top-level ``services`` payload key replaces the decky's services list."""
+    tid = await _make_active(repo)
+    decky = (await repo.list_topology_deckies(tid))[0]
+    await apply_update_decky(
+        repo, tid,
+        {
+            "decky": decky["decky_config"]["name"],
+            "services": ["ssh", "http"],
+        },
+    )
+    updated = next(
+        d for d in await repo.list_topology_deckies(tid)
+        if d["uuid"] == decky["uuid"]
+    )
+    assert sorted(updated["services"]) == ["http", "ssh"]
+
+
 @pytest.mark.anyio
 async def test_apply_rejected_on_validator_error(repo):
     """Unknown service name must trip the post-apply validator."""