feat(mutator,web): add_decky op — create-and-attach in one mutation

apply_attach_decky requires an existing decky, so the MazeNET editor
had no way to grow a live topology: creating a new decky on active
topologies 409'd on the direct-CRUD createDecky call.

- Backend: new apply_add_decky that creates the decky row + its
  home-LAN edge atomically, auto-allocating an IP if none pinned.
  Post-apply validation still runs. Added to DISPATCH + _MUTATION_OPS
  Literal + CLI help text.
- Tests: 3 new ops tests (happy path, duplicate-name rejection,
  missing-LAN rejection) plus dispatch coverage update.
- Frontend: useTopologyEditor gains addDeckyToLan() composite. Pending
  routes through createDecky + attachEdge as before; active routes
  through a single add_decky enqueue. MazeNET.tsx drag-archetype,
  duplicate, DMZ-gateway, and ctx-menu add-decky paths all use the
  composite so active topologies stop 409'ing on new-decky drops.

decnet/web/db/models.py

@@ -339,8 +339,8 @@ class TopologyMutation(SQLModel, table=True):
     )
     id: str = Field(default_factory=lambda: str(uuid4()), primary_key=True)
     topology_id: str = Field(foreign_key="topologies.id", index=True)
-    # add_lan|remove_lan|attach_decky|detach_decky|remove_decky|
-    # update_decky|update_lan
+    # add_lan|remove_lan|add_decky|attach_decky|detach_decky|
+    # remove_decky|update_decky|update_lan
     op: str = Field(index=True)
     # JSON-serialised op payload (keys depend on ``op``).
     payload: str = Field(
@@ -805,6 +805,7 @@ class EdgeCreateRequest(BaseModel):
 _MUTATION_OPS = Literal[
     "add_lan",
     "remove_lan",
+    "add_decky",
     "attach_decky",
     "detach_decky",
     "remove_decky",