chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

decnet/correlation/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Cross-decky correlation engine for DECNET."""
 
 from decnet.correlation.engine import CorrelationEngine

decnet/correlation/attribution/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DECNET attribution engine — v0 aggregation library.
 
 Pure library: per-(identity, primitive) state machine over BEHAVE-SHELL

decnet/correlation/attribution/_thresholds.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Calibration thresholds for the attribution engine — every magic
 number lives here, named, with the calibration source cited.
 

decnet/correlation/attribution/aggregate.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-(identity, primitive) state-machine — the attribution engine's
 core merge logic.
 

decnet/correlation/attribution_worker.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Attribution-engine bus subscriber — v0 Phase 1 skeleton.
 
 Subscribes to ``attacker.observation.>`` and, for each event, ensures

decnet/correlation/engine.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Cross-decky correlation engine.
 

decnet/correlation/event_kinds.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Classify RFC 5424 event_type strings as interaction vs. scan vs. noise.
 
 Used by:

decnet/correlation/fingerprint_rotation.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Attacker substrate-fingerprint rotation detection.
 
 Called inline from the prober at each fingerprint emit site.  Looks up

decnet/correlation/graph.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Traversal graph data types for the DECNET correlation engine.
 

decnet/correlation/parser.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 RFC 5424 log line parser for the DECNET correlation engine.
 

decnet/correlation/reuse_worker.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Long-running credential-reuse correlator.
 
 Loops :meth:`CorrelationEngine.correlate_credential_reuse` over the