refactor(tests): move flat tests/*.py into per-subsystem subfolders

Groups every flat test_*.py under the module it exercises, matching the
existing tests/{profiler,sniffer,prober,collector,correlation,cli,web,
topology,swarm,bus,updater,api,docker,geoip,...} layout. New folders:
services/, fleet/, config/, logging/, db/ (+ db/mysql/), telemetry/,
mutator/, core/.

Path-dependent __file__ references bumped an extra .parent in three
files that moved one level deeper:
- tests/sniffer/test_sniffer_ja3.py   (template path)
- tests/services/test_ssh_capture_emit.py (template path)
- tests/cli/test_mode_gating.py  (REPO root)
- tests/web/test_env_lazy_jwt.py (repo var)

Also drops two SQLite runtime artifacts (test_decnet.db-{shm,wal}) that
were leaking into the repo from a previous test run.

Fixes two test_service_isolation cases that patched asyncio.sleep (no
longer on the profiler main-loop hot path — same pre-existing bug I
fixed earlier in test_attacker_worker.py) by patching asyncio.wait_for
and passing interval=0.

tests/db/test_factory.py

@@ -0,0 +1,44 @@
+"""
+Unit tests for the repository factory — dispatch on DECNET_DB_TYPE.
+"""
+import pytest
+
+from decnet.web.db.factory import get_repository
+from decnet.web.db.sqlite.repository import SQLiteRepository
+from decnet.web.db.mysql.repository import MySQLRepository
+
+
+def test_factory_defaults_to_sqlite(monkeypatch, tmp_path):
+    monkeypatch.delenv("DECNET_DB_TYPE", raising=False)
+    repo = get_repository(db_path=str(tmp_path / "t.db"))
+    assert isinstance(repo, SQLiteRepository)
+
+
+def test_factory_sqlite_explicit(monkeypatch, tmp_path):
+    monkeypatch.setenv("DECNET_DB_TYPE", "sqlite")
+    repo = get_repository(db_path=str(tmp_path / "t.db"))
+    assert isinstance(repo, SQLiteRepository)
+
+
+def test_factory_mysql_branch(monkeypatch):
+    """MySQL branch must import and instantiate without a live server.
+
+    Engine creation is lazy in SQLAlchemy — no socket is opened until the
+    first query — so the repository constructs cleanly here.
+    """
+    monkeypatch.setenv("DECNET_DB_TYPE", "mysql")
+    monkeypatch.setenv("DECNET_DB_URL", "mysql+asyncmy://u:p@127.0.0.1:3306/x")
+    repo = get_repository()
+    assert isinstance(repo, MySQLRepository)
+
+
+def test_factory_is_case_insensitive(monkeypatch, tmp_path):
+    monkeypatch.setenv("DECNET_DB_TYPE", "SQLite")
+    repo = get_repository(db_path=str(tmp_path / "t.db"))
+    assert isinstance(repo, SQLiteRepository)
+
+
+def test_factory_rejects_unknown_type(monkeypatch):
+    monkeypatch.setenv("DECNET_DB_TYPE", "cassandra")
+    with pytest.raises(ValueError, match="Unsupported database type"):
+        get_repository()