chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/correlation/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/correlation/attribution/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/correlation/attribution/test_aggregate_categorical.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Pure-function tests for the categorical merger — every state
 transition the engine claims to detect, exercised by synthetic
 observation lists. No DB, no bus.

tests/correlation/attribution/test_aggregate_numeric_hash.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 — numeric + hash merger tests + dispatcher coverage.
 
 Pure-function tests; no DB, no bus. Synthetic input lists drive each

tests/correlation/attribution/test_attribution_worker_phase1.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 1 attribution worker — wiring smoke tests.
 
 The Phase 1 worker subscribes to ``attacker.observation.>`` and, for

tests/correlation/attribution/test_attribution_worker_phase4.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 4 — end-to-end worker wiring.
 
 Observation event → stub identity → load series → merger → upsert

tests/correlation/attribution/test_calibration_scenarios.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 7 — calibration lockdown.
 
 Four synthetic operator-behaviour scenarios that exercise the full

tests/correlation/attribution/test_multi_actor_correlator.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 5 — cross-primitive multi_actor correlator.
 
 Periodic tick over attribution_state rows; fires

tests/correlation/test_bounty_dedup.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for bounty deduplication.
 

tests/correlation/test_correlation.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for the DECNET cross-decky correlation engine.
 

tests/correlation/test_correlation_bus.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Bus wiring for the correlation engine (DEBT-031, worker 3).
 
 The correlator is not a standalone worker — ``CorrelationEngine`` is a

tests/correlation/test_credential_reuse.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Credential-reuse correlator tests.
 
 Covers:

tests/correlation/test_event_kinds.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Classifier unit tests for decnet.correlation.event_kinds."""
 from __future__ import annotations
 

tests/correlation/test_fingerprint_rotation.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Unit tests for ``decnet.correlation.fingerprint_rotation``.
 
 Pure library: in-memory SQLite + sync Session + collected callback

tests/correlation/test_parser_double_wrap.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Correlation parser unwraps double-wrapped RFC5424 lines.
 
 Mirrors ``tests/collector/test_parse_rfc5424_double_wrap.py``. Both

tests/correlation/test_reuse_worker_publish.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Reuse correlator publishes ``credential.reuse.detected``.
 
 Pins the producer wiring so a regression that silently drops the