chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/correlation/attribution/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/correlation/attribution/test_aggregate_categorical.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Pure-function tests for the categorical merger — every state
 transition the engine claims to detect, exercised by synthetic
 observation lists. No DB, no bus.

tests/correlation/attribution/test_aggregate_numeric_hash.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 — numeric + hash merger tests + dispatcher coverage.
 
 Pure-function tests; no DB, no bus. Synthetic input lists drive each

tests/correlation/attribution/test_attribution_worker_phase1.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 1 attribution worker — wiring smoke tests.
 
 The Phase 1 worker subscribes to ``attacker.observation.>`` and, for

tests/correlation/attribution/test_attribution_worker_phase4.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 4 — end-to-end worker wiring.
 
 Observation event → stub identity → load series → merger → upsert

tests/correlation/attribution/test_calibration_scenarios.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 7 — calibration lockdown.
 
 Four synthetic operator-behaviour scenarios that exercise the full

tests/correlation/attribution/test_multi_actor_correlator.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 5 — cross-primitive multi_actor correlator.
 
 Periodic tick over attribution_state rows; fires