chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

decnet/ttp/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """TTP-tagging subsystem.
 
 Maps DECNET telemetry to MITRE ATT&CK technique tags. See

decnet/ttp/attack_catalog.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Backward-compatible shim over :mod:`decnet.ttp.attack_stix`.
 
 Historically this module exposed a hand-maintained

decnet/ttp/attack_stix.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """STIX 2.1 backed MITRE ATT&CK lookups.
 
 Replaces the hand-maintained technique-name dict that used to live in

decnet/ttp/attack_version.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Pinned MITRE ATT&CK Enterprise STIX bundle version.
 
 Bumping ``ATTACK_BUNDLE_VERSION`` is the *only* code change required

decnet/ttp/base.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tagger ABC — input shape, base class, tolerant mixin.
 
 Contract step E.1.3 of ``development/TTP_TAGGING.md``. Defines the type

decnet/ttp/data/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Data files used at runtime by the TTP layer.
 
 See ``decnet/ttp/data/intel/`` for provider-signal → ATT&CK technique

decnet/ttp/data/intel/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-provider intel-signal → ATT&CK technique mapping data.
 
 One YAML file per intel provider (abuseipdb / greynoise / feodo /

decnet/ttp/data/intel_loader.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """YAML-backed loader for intel-provider → ATT&CK technique mappings.
 
 Replaces the ``_*_TO_TECHNIQUES`` ``Final[dict]`` tables that used to

decnet/ttp/factory.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tagger factory + composite tagger.
 
 Contract step E.1.4 of ``development/TTP_TAGGING.md``. Mirrors the

decnet/ttp/impl/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """TTP tagger implementations — rule engine + per-source lifters.
 
 Subpackage layout per the provider-subpackage convention used in

decnet/ttp/impl/_emit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared TTPTag emission helper used by per-source lifters.
 
 The rule engine assembles a tag inline inside ``_evaluate_rules``; the

decnet/ttp/impl/_rule_index.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Hot-swappable rule registry shared by RuleEngine and per-source lifters.
 
 The dispatch index originally lived inline on

decnet/ttp/impl/_state.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared state-modulation helpers for rule consumers.
 
 Both :class:`~decnet.ttp.impl.rule_engine.RuleEngine` and the per-source

decnet/ttp/impl/behavioral_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Behavioral lifter — derives techniques from cross-event session signal.
 
 E.3.9 of ``development/TTP_TAGGING.md``. Owns YAML rules R0031–R0040 by

decnet/ttp/impl/canary_fingerprint_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Canary fingerprint lifter — browser-payload derived technique tagger (E.3.11).
 
 Reads canary-payload fingerprints (navigator properties, canvas hashes,

decnet/ttp/impl/credential_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Credential lifter — credential-capture / reuse / brute-force tagger.
 
 E.3.13 of ``development/TTP_TAGGING.md``. Owns rules whose

decnet/ttp/impl/email_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Email lifter — SMTP message-level technique tagger (E.3.12).
 
 Reads pre-parsed SMTP message payload (headers as a name-only list,

decnet/ttp/impl/http_fingerprint_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """HTTP fingerprint lifter — JA4H / H2-settings / H3-settings / JA4-QUIC tagger.
 
 Reads ``http_fingerprint`` source-kind events and emits Reconnaissance

decnet/ttp/impl/identity_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Identity lifter — cross-attacker identity-rollup tagger.
 
 E.3.13 of ``development/TTP_TAGGING.md``. Owns rules whose

decnet/ttp/impl/intel_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Intel lifter — opportunistic third-party verdict translator (E.3.10).
 
 Reads ``AttackerIntel``-derived payload fields and emits ATT&CK

decnet/ttp/impl/ipv6_leak_lifter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """IPv6 link-local leak lifter — opsec-failure tagger (R0059).
 
 Reads ``ipv6_leak`` source-kind events emitted by the passive sniffer

decnet/ttp/impl/rule_engine.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Rule engine contract — `CompiledRule`, `RuleEngine`, `RuleSchema`.
 
 Contract step E.1.5 of ``development/TTP_TAGGING.md``. Shape only — no

decnet/ttp/misp_export.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """MISP event builder for DECNET attacker data.
 
 Converts a STIX 2.1 Bundle (built by stix_export.build_attacker_bundle /

decnet/ttp/stix_custom.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DECNET-defined STIX 2.1 custom extension and object types.
 
 Import this module before parsing any DECNET-produced bundle so the types are

decnet/ttp/stix_export.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """STIX 2.1 bundle builder for a DECNET attacker observation.
 
 Pure function — no I/O. The caller (router) does all DB reads and

decnet/ttp/store/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """TTP rule store — pluggable backend for rule definitions + state.
 
 Contract step E.1.11 of ``development/TTP_TAGGING.md``. Two backends

decnet/ttp/store/base.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Rule store ABC + change/state value types.
 
 Contract step E.1.11. The two backends (``impl/filesystem.py``,

decnet/ttp/store/factory.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Rule store factory.
 
 Mirrors :mod:`decnet.ttp.factory` and :mod:`decnet.intel.factory`:

decnet/ttp/store/impl/__init__.py

@@ -1 +1,2 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Rule store backend implementations — filesystem + database."""

decnet/ttp/store/impl/database.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Database-backed rule store — ``ttp_rule`` + ``ttp_rule_state``.
 
 E.3.6 implementation. Right for swarm: master syncs filesystem changes

decnet/ttp/store/impl/filesystem.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Filesystem-backed rule store — reads ``./rules/ttp/`` + inotify watch.
 
 E.3.5 implementation. Linux-only by construction: the inotify dep

decnet/ttp/worker.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Long-running TTP-tagging worker.
 
 E.3.14 of ``development/TTP_TAGGING.md``. Drains the bus topics