chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/canary/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/canary/conftest.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared fixtures for canary tests — minimal DOCX/XLSX/HTML/PDF fixtures.
 
 We synthesise the OOXML zips inline rather than checking real binary

tests/canary/test_cli.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Smoke coverage for the ``decnet canary`` CLI subcommand.
 
 We don't run the worker (it would block on HTTP/DNS sockets) — we

tests/canary/test_cultivator.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Realism-driven canary cultivation.
 
 Stage 7 of the realism migration: the orchestrator's planner picks a

tests/canary/test_deploy_hook.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Smoke coverage for the deploy-time canary baseline seed.
 
 The deployer hook calls ``decnet.canary.planter.seed_baseline`` for

tests/canary/test_factory.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the generator/instrumenter factory + MIME dispatch.
 
 The concrete generators and instrumenters land in subsequent commits;

tests/canary/test_fingerprint_generators.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for the HTML/SVG fingerprint canary generators.
 
 Skipped when the Node toolchain (or vendored javascript-obfuscator) is

tests/canary/test_generators.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the synthesised-artifact generators.
 
 Each generator MUST be deterministic for a given ``CanaryContext`` —

tests/canary/test_instrumenters.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the operator-upload instrumenters.
 
 Each instrumenter is round-tripped against a small, real-shaped

tests/canary/test_models.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Smoke coverage for the Pydantic request/response shapes + helpers.
 
 The tables themselves are exercised end-to-end in

tests/canary/test_obfuscator.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for :mod:`decnet.canary.obfuscator` — the per-mint JS obfuscator.
 
 Skipped when Node or the vendored ``javascript-obfuscator`` package is

tests/canary/test_paths.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the persona-aware path resolver + placement validator."""
 from __future__ import annotations
 

tests/canary/test_planter.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the canary planter (docker exec wrapper).
 
 We don't actually invoke docker — :func:`asyncio.create_subprocess_exec`

tests/canary/test_repository.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Repository CRUD coverage for canary blobs / tokens / triggers.
 
 Same harness as the rest of :mod:`tests.db` — spin up a SQLite-backed

tests/canary/test_storage.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the on-disk blob store."""
 from __future__ import annotations
 

tests/canary/test_systemd_unit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Sanity check on the decnet-canary.service unit + decnet.target.
 
 Tests are deliberately static (no rendering, no systemd) — they just

tests/canary/test_topics.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Coverage for the canary bus-topic builder + constants.
 
 The builder shares :func:`_reject_tokens` with every other family in

tests/canary/test_worker_dns.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DNS surface coverage for the canary worker.
 
 We don't open a real UDP socket — instead we drive

tests/canary/test_worker_http.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """HTTP surface coverage for the canary worker.
 
 We exercise the FastAPI app via Starlette's TestClient so the test