chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/ttp/rule_precision/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-rule precision suite for TTP rule pack v0.
 
 One test module per rule cohort (command / behavioral / email / canary /

tests/ttp/rule_precision/_build_corpus.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Extract a labelled corpus from the production sqlite DB.
 
 Run on the operator workstation against a real ``decnet-prod.db``.

tests/ttp/rule_precision/conftest.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Fixtures for the per-rule precision suite.
 
 Two halves:

tests/ttp/rule_precision/test_behavioral_rules.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """R0031-R0040 — behavioral / cross-event cohort.
 
 Every rule here is consumed by the :class:`BehavioralLifter` (E.3.9).

tests/ttp/rule_precision/test_canary_rules.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """R0049-R0053 — canary fingerprint cohort.
 
 CanaryFingerprintLifter (E.3.11) parses the fingerprint payload

tests/ttp/rule_precision/test_command_rules.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-rule precision asserts for the command cohort (R0001-R0030).
 
 Drives the labelled corpus through a real :class:`RuleEngine` populated

tests/ttp/rule_precision/test_corpus_loads.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Sentinel: every cohort's seed corpus parses and the harness lives.
 
 Runs in clean checkouts (no operator-built corpus). Asserts the seed

tests/ttp/rule_precision/test_email_rules.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """R0041-R0048 — email cohort.
 
 EmailLifter (E.3.12) consumes these by rule_id. The v0

tests/ttp/rule_precision/test_intel_rules.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """R0054-R0058 — intel verdict cohort.
 
 IntelLifter (E.3.10) reads ``AttackerIntel`` provider columns