refactor: extract decryption auto-detection into detect.py

[buckleypaul]

What & why

cli.py had grown to ~3500 lines, with a cluster of decryption-strategy
helpers ("given a key and a packet, figure out which counter mode / EAX period
exponent decrypts it, cache that, and decrypt") fused with presentation
(click.secho("[INFO] Detected: …")). That's domain logic, not command
plumbing, and it had no direct test coverage — only indirect coverage through
full CLI scan invocations.

This extracts that logic into a new src/hubblenetwork/detect.py that is
fully decoupled from the CLI: it imports no click and never prints. Detection
returns what happened (Detection(result, label)); the CLI decides whether
and how to present it.

No user-facing behavior change.

What's in detect.py

• detect_eid_type(key, pkts) — pure EID-rotation classifier (UNIX_TIME /
  DEVICE_UPTIME / AMBIGUOUS), renamed public.
• CtrCounterModeDetector / EaxExponentDetector — per-scan stateful objects
  that own the detect/sweep loop + cache. Their decrypt() takes a
  caller-supplied packet-bound decrypt_fn and returns Detection; label is
  set only on the first successful detection of a scan.
• BLE passes the packet EID as cache_key (None disables caching for EID-less
  packets); satellite omits it and shares one per-stream slot via a private
  _SINGLE_STREAM sentinel — no magic strings leak into the CLI.

The CLI builds the decrypt_fn (referencing cli.decrypt / cli.decrypt_eax,
so existing test mocks still apply) and emits the [INFO] Detected: line via a
small _announce_detection() helper. cli.py shrinks by ~160 lines.

Tests

• New tests/test_detect.py: direct unit coverage of the detect/cache/label
  logic (sweep order, per-EID caching, single-stream caching, label-once,
  wrong-key, cache_key=None, zero-byte-payload-is-success, non-auto bypass),
  the detect_eid_type classifications, an AST decoupling guard asserting
  no click import, and the Detection default.
• detect_eid_type unit tests relocated out of test_ble_validate.py; that
  file's decrypt patches retargeted to hubblenetwork.detect.
• Existing test_cli_ctr_autodetect.py, test_sat_decrypt.py, and
  test_aes_eax.py assertions unchanged.

Verification

• ruff check src — clean
• pytest -m "not integration and not ble and not docker" — 229 passed
• grep -rn "click" src/hubblenetwork/detect.py — empty