refactor(topology): introduce TopologyRepository protocol with DTO return types

Replace repo: BaseRepository with a structural TopologyRepository protocol
in persistence.py and allocator.py. All read methods now return typed DTOs
(TopologySummary, LANRow, DeckyRow, EdgeRow) instead of raw dicts, eliminating
silent field-shape regressions across the topology subsystem.

TopologySummary gains email_personas and language_default so api_personas.py
can continue reading those fields via attribute access. hydrate() converts
DTOs to dicts before passing to _backfill_decky_configs, keeping the mutable
working-state function dict-based at its boundary. All production callers
(router handlers, mutator, CLI, heartbeat) migrated from dict/get access to
attribute access. 134 tests pass.

decnet/web/router/topology/_guards.py

@@ -1,8 +1,6 @@
 """Shared helpers for the Phase-3 child-CRUD routes."""
 from __future__ import annotations
 
-from typing import Any
-
 from fastapi import HTTPException
 
 from decnet.topology.status import (
@@ -10,17 +8,18 @@ from decnet.topology.status import (
     TopologyStatus,
     VersionConflict,
 )
+from decnet.web.db.models.topology import TopologySummary
 from decnet.web.dependencies import repo
 
 
-async def get_topology_or_404(topology_id: str) -> dict[str, Any]:
+async def get_topology_or_404(topology_id: str) -> TopologySummary:
     topo = await repo.get_topology(topology_id)
     if topo is None:
         raise HTTPException(status_code=404, detail="Topology not found")
     return topo
 
 
-async def assert_pending_or_409(topology_id: str) -> dict[str, Any]:
+async def assert_pending_or_409(topology_id: str) -> TopologySummary:
     """Ensure the topology exists and is in ``pending`` state.
 
     The repo layer enforces the same rule inside mutation methods, but the
@@ -28,11 +27,11 @@ async def assert_pending_or_409(topology_id: str) -> dict[str, Any]:
     the pre-condition before any side effect.
     """
     topo = await get_topology_or_404(topology_id)
-    if topo["status"] != TopologyStatus.PENDING:
+    if topo.status != TopologyStatus.PENDING:
         raise HTTPException(
             status_code=409,
             detail=(
-                f"Topology is {topo['status']!r}; free-form child edits are "
+                f"Topology is {topo.status!r}; free-form child edits are "
                 f"pending-only.  Use the mutation queue for active topologies."
             ),
         )