chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/swarm/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/swarm/test_agent_app.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Agent FastAPI app — static/contract checks only.
 
 We deliberately do NOT spin uvicorn up in-process here: the mTLS layer is

tests/swarm/test_agent_heartbeat.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for the worker-side heartbeat loop (decnet.agent.heartbeat)."""
 from __future__ import annotations
 

tests/swarm/test_agent_no_auto_restore.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Step 8 regression: the agent must NEVER auto-restore a topology on boot.
 
 Guiding rule: master is authoritative, agent is a dumb executor.  If an

tests/swarm/test_agent_relocalize.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Worker agent re-localizes master-built configs to its own NIC/subnet.
 
 The master ships a DecnetConfig populated from *its own* network (master

tests/swarm/test_agent_topology_endpoints.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Agent topology endpoints — contract-level tests with mocked ops."""
 from __future__ import annotations
 

tests/swarm/test_agent_topology_store.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for :mod:`decnet.agent.topology_store`."""
 from __future__ import annotations
 

tests/swarm/test_cli_forwarder.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """CLI surface for `decnet forwarder`. Only guard clauses — the async
 loop itself is covered by tests/swarm/test_log_forwarder.py."""
 from __future__ import annotations

tests/swarm/test_cli_swarm.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """CLI `decnet swarm {enroll,list,decommission}` + `deploy --mode swarm`.
 
 Controller HTTP is stubbed via monkeypatching `_http_request`; we aren't

tests/swarm/test_cli_swarm_update.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """CLI `decnet swarm update` — target resolution, tarring, push aggregation.
 
 The UpdaterClient is stubbed: we are testing the CLI's orchestration, not

tests/swarm/test_client_agent_roundtrip.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """End-to-end test: AgentClient talks to a live worker agent over mTLS.
 
 Spins up uvicorn in-process on an ephemeral port with real cert files on

tests/swarm/test_client_mutate.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Roundtrip test for AgentClient.mutate() through a live in-process
 agent over mTLS.  Mirrors test_client_agent_roundtrip's harness."""
 from __future__ import annotations

tests/swarm/test_client_topology.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """AgentClient topology methods — unit tests with a mock httpx transport.
 
 Avoids the full uvicorn+mTLS setup used by the roundtrip test; we just

tests/swarm/test_forwarder_resilience.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Extra resilience tests for the syslog-over-TLS pipeline.
 
 Covers failure modes the happy-path tests in test_log_forwarder.py don't

tests/swarm/test_heartbeat.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for POST /swarm/heartbeat — cert pinning + shard snapshot refresh."""
 from __future__ import annotations
 

tests/swarm/test_heartbeat_lifecycle.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/heartbeat — lifecycle delta application.
 
 Worker pushes one or more ``lifecycle`` deltas in the heartbeat body

tests/swarm/test_heartbeat_topology_resync.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Heartbeat-driven topology resync: master flags divergent agents.
 
 When an agent reports an applied_version_hash that differs from what

tests/swarm/test_log_forwarder.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for the syslog-over-TLS pipeline.
 
 Covers:

tests/swarm/test_pki.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """PKI roundtrip tests for the DECNET swarm CA."""
 from __future__ import annotations
 

tests/swarm/test_state_schema.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Backward-compatibility tests for the SWARM state-schema extension.
 
 DeckyConfig gained an optional ``host_uuid`` field in swarm mode.  Existing

tests/swarm/test_swarm_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Unit tests for the SWARM controller FastAPI app.
 
 Covers the enrollment, host-management, and deployment dispatch routes.

tests/swarm/test_tar_tree.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """tar_working_tree: exclude filter, tarball validity, git SHA detection."""
 from __future__ import annotations
 

tests/swarm/test_uvicorn_tls_scope.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Regression tests for the uvicorn TLS scope monkey-patch."""
 from __future__ import annotations