refactor(tests): move flat tests/*.py into per-subsystem subfolders

Groups every flat test_*.py under the module it exercises, matching the
existing tests/{profiler,sniffer,prober,collector,correlation,cli,web,
topology,swarm,bus,updater,api,docker,geoip,...} layout. New folders:
services/, fleet/, config/, logging/, db/ (+ db/mysql/), telemetry/,
mutator/, core/.

Path-dependent __file__ references bumped an extra .parent in three
files that moved one level deeper:
- tests/sniffer/test_sniffer_ja3.py   (template path)
- tests/services/test_ssh_capture_emit.py (template path)
- tests/cli/test_mode_gating.py  (REPO root)
- tests/web/test_env_lazy_jwt.py (repo var)

Also drops two SQLite runtime artifacts (test_decnet.db-{shm,wal}) that
were leaking into the repo from a previous test run.

Fixes two test_service_isolation cases that patched asyncio.sleep (no
longer on the profiler main-loop hot path — same pre-existing bug I
fixed earlier in test_attacker_worker.py) by patching asyncio.wait_for
and passing interval=0.

tests/logging/test_log_file_mount.py

@@ -0,0 +1,73 @@
+"""Tests for compose generation — logging block and absence of volume mounts."""
+
+from decnet.composer import generate_compose, _DOCKER_LOGGING
+from decnet.config import DeckyConfig, DecnetConfig
+from decnet.distros import DISTROS
+
+
+def _make_config(log_file: str | None = None) -> DecnetConfig:
+    profile = DISTROS["debian"]
+    decky = DeckyConfig(
+        name="decky-01",
+        ip="10.0.0.10",
+        services=["http"],
+        distro="debian",
+        base_image=profile.image,
+        build_base=profile.build_base,
+        hostname="test-host",
+    )
+    return DecnetConfig(
+        mode="unihost",
+        interface="eth0",
+        subnet="10.0.0.0/24",
+        gateway="10.0.0.1",
+        deckies=[decky],
+        log_file=log_file,
+    )
+
+
+class TestComposeLogging:
+    def test_service_container_has_logging_block(self):
+        config = _make_config()
+        compose = generate_compose(config)
+        fragment = compose["services"]["decky-01-http"]
+        assert "logging" in fragment
+        assert fragment["logging"] == _DOCKER_LOGGING
+
+    def test_logging_driver_is_json_file(self):
+        config = _make_config()
+        compose = generate_compose(config)
+        fragment = compose["services"]["decky-01-http"]
+        assert fragment["logging"]["driver"] == "json-file"
+
+    def test_logging_has_rotation_options(self):
+        config = _make_config()
+        compose = generate_compose(config)
+        fragment = compose["services"]["decky-01-http"]
+        opts = fragment["logging"]["options"]
+        assert "max-size" in opts
+        assert "max-file" in opts
+
+    def test_base_container_has_no_logging_block(self):
+        """Base containers run sleep infinity and produce no app logs."""
+        config = _make_config()
+        compose = generate_compose(config)
+        base = compose["services"]["decky-01"]
+        assert "logging" not in base
+
+    def test_no_volume_mounts_on_service_container(self):
+        config = _make_config(log_file="/tmp/decnet.log")
+        compose = generate_compose(config)
+        fragment = compose["services"]["decky-01-http"]
+        assert not fragment.get("volumes")
+
+    def test_no_decnet_log_file_env_var(self):
+        config = _make_config(log_file="/tmp/decnet.log")
+        compose = generate_compose(config)
+        fragment = compose["services"]["decky-01-http"]
+        assert "DECNET_LOG_FILE" not in fragment.get("environment", {})
+
+    def test_no_log_network_in_networks(self):
+        config = _make_config()
+        compose = generate_compose(config)
+        assert "decnet_logs" not in compose["networks"]