chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

decnet/swarm/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DECNET SWARM — multihost deployment subsystem.
 
 Components:

decnet/swarm/bundle_builder.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tarball + bootstrap construction for agent-enrollment bundles.
 
 Pure I/O, no FastAPI dependency — independently testable.

decnet/swarm/client.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Master-side HTTP client that talks to a worker's DECNET agent.
 
 All traffic is mTLS: the master presents a cert issued by its own CA (which

decnet/swarm/log_forwarder.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Worker-side syslog-over-TLS forwarder (RFC 5425).
 
 Runs alongside the worker agent. Tails the worker's local RFC 5424 log

decnet/swarm/log_listener.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Master-side syslog-over-TLS listener (RFC 5425).
 
 Accepts mTLS-authenticated worker connections on TCP 6514, reads

decnet/swarm/pki.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DECNET SWARM PKI — self-managed X.509 CA for master↔worker mTLS.
 
 Used by:

decnet/swarm/tar_tree.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Build a gzipped tarball of the master's working tree for pushing to workers.
 
 Always excludes the obvious large / secret / churn paths: ``.venv/``,

decnet/swarm/updater_client.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Master-side HTTP client for the worker's self-updater daemon.
 
 Sibling of ``AgentClient``: same mTLS identity (same DECNET CA, same