refactor(tests): move flat tests/*.py into per-subsystem subfolders

Groups every flat test_*.py under the module it exercises, matching the
existing tests/{profiler,sniffer,prober,collector,correlation,cli,web,
topology,swarm,bus,updater,api,docker,geoip,...} layout. New folders:
services/, fleet/, config/, logging/, db/ (+ db/mysql/), telemetry/,
mutator/, core/.

Path-dependent __file__ references bumped an extra .parent in three
files that moved one level deeper:
- tests/sniffer/test_sniffer_ja3.py   (template path)
- tests/services/test_ssh_capture_emit.py (template path)
- tests/cli/test_mode_gating.py  (REPO root)
- tests/web/test_env_lazy_jwt.py (repo var)

Also drops two SQLite runtime artifacts (test_decnet.db-{shm,wal}) that
were leaking into the repo from a previous test run.

Fixes two test_service_isolation cases that patched asyncio.sleep (no
longer on the profiler main-loop hot path — same pre-existing bug I
fixed earlier in test_attacker_worker.py) by patching asyncio.wait_for
and passing interval=0.

tests/cli/test_mode_gating.py

@@ -10,7 +10,7 @@ from pathlib import Path
 import pytest
 
 
-REPO = pathlib.Path(__file__).resolve().parent.parent
+REPO = pathlib.Path(__file__).resolve().parent.parent.parent
 #DECNET_BIN = REPO / ".venv" / "bin" / "decnet"
 DECNET_BIN = Path(sys.executable).parent / "decnet"
 

tests/services/test_service_isolation.py

@@ -202,15 +202,19 @@ class TestAttackerWorkerIsolation:
         mock_repo.set_state = AsyncMock()
 
         iterations = 0
+        real_wait_for = asyncio.wait_for
 
-        async def _controlled_sleep(seconds):
+        async def _controlled_wait_for(awaitable, timeout):
             nonlocal iterations
             iterations += 1
             if iterations >= 3:
+                if asyncio.iscoroutine(awaitable):
+                    awaitable.close()
                 raise asyncio.CancelledError()
+            return await real_wait_for(awaitable, timeout)
 
-        with patch("decnet.profiler.worker.asyncio.sleep", side_effect=_controlled_sleep):
+        with patch("decnet.profiler.worker.asyncio.wait_for", side_effect=_controlled_wait_for):
-            task = asyncio.create_task(attacker_profile_worker(mock_repo))
+            task = asyncio.create_task(attacker_profile_worker(mock_repo, interval=0))
             with pytest.raises(asyncio.CancelledError):
                 await task
         # Worker should have retried at least twice before we cancelled
@@ -454,15 +458,19 @@ class TestCascadeIsolation:
         mock_repo.get_logs_after_id = AsyncMock(return_value=[])
 
         iterations = 0
+        real_wait_for = asyncio.wait_for
 
-        async def _controlled_sleep(seconds):
+        async def _controlled_wait_for(awaitable, timeout):
             nonlocal iterations
             iterations += 1
             if iterations >= 3:
+                if asyncio.iscoroutine(awaitable):
+                    awaitable.close()
                 raise asyncio.CancelledError()
+            return await real_wait_for(awaitable, timeout)
 
-        with patch("decnet.profiler.worker.asyncio.sleep", side_effect=_controlled_sleep):
+        with patch("decnet.profiler.worker.asyncio.wait_for", side_effect=_controlled_wait_for):
-            task = asyncio.create_task(attacker_profile_worker(mock_repo))
+            task = asyncio.create_task(attacker_profile_worker(mock_repo, interval=0))
             with pytest.raises(asyncio.CancelledError):
                 await task
         # Attacker should have run independently

tests/services/test_ssh_capture_emit.py

@@ -19,7 +19,7 @@ import pytest
 
 from decnet.collector.worker import parse_rfc5424
 
-_TEMPLATE_DIR = Path(__file__).resolve().parent.parent / "decnet" / "templates" / "ssh"
+_TEMPLATE_DIR = Path(__file__).resolve().parent.parent.parent / "decnet" / "templates" / "ssh"
 _EMIT_SCRIPT = _TEMPLATE_DIR / "emit_capture.py"
 
 

tests/sniffer/test_sniffer_ja3.py

@@ -18,7 +18,7 @@ import pytest
 
 # ─── Import sniffer module with mocked syslog_bridge ─────────────────────────
 
-_SNIFFER_DIR = str(Path(__file__).parent.parent / "decnet" / "templates" / "sniffer")
+_SNIFFER_DIR = str(Path(__file__).parent.parent.parent / "decnet" / "templates" / "sniffer")
 
 def _load_sniffer():
     """Load decnet/templates/sniffer/server.py with syslog_bridge stubbed out."""

tests/web/test_env_lazy_jwt.py

@@ -41,7 +41,7 @@ def test_agent_cli_imports_without_jwt_secret(monkeypatch, tmp_path):
     }
     clean_env["PATH"] = os.environ["PATH"]
     clean_env["HOME"] = str(tmp_path)
-    repo = pathlib.Path(__file__).resolve().parent.parent
+    repo = pathlib.Path(__file__).resolve().parent.parent.parent
     # binary = repo / ".venv" / "bin" / "decnet"
     binary = Path(sys.executable).parent / "decnet"
     result = subprocess.run(