refactor: extract decryption auto-detection into detect.py

CLAUDE.md

@@ -65,6 +65,8 @@ The SDK uses a src layout with the main package at `src/hubblenetwork/`. Public
 
 - **`crypto.py`** - Local packet decryption. Implements AES-CTR decryption with CMAC-based key derivation (SP800_108_Counter KDF). Supports both AES-256-CTR and AES-128-CTR. `decrypt()` accepts `counter_mode` as `"UNIX_TIME"` (default, UTC day-based) or `"DEVICE_UPTIME"` (counter-based, fixed pool size 128). Exports `UNIX_TIME` and `DEVICE_UPTIME` constants. `decrypt_eax()` decrypts AES-EAX packets by iterating counters 0-127, generating candidate EIDs via AES-ECB, and using `AES.MODE_EAX` for authenticated decryption. Uses key directly (no KDF). `decrypt_satellite()` decrypts a satellite packet's payload using the same AES-CTR/CMAC scheme as `decrypt()`; satellite packets deliver `seq_num`, `auth_tag`, and encrypted payload as separate fields (not packed into one advertisement). It accepts `counter_mode` (`"UNIX_TIME"` default, day-based; or `"DEVICE_UPTIME"`, sweeping the fixed 0-127 counter pool) just like `decrypt()`.
 
+- **`detect.py`** - Decryption-strategy auto-detection, decoupled from the CLI (imports no `click`, never prints). `detect_eid_type()` classifies a key's EID rotation mode (UNIX_TIME / DEVICE_UPTIME / AMBIGUOUS) from sample packets. `CtrCounterModeDetector` and `EaxExponentDetector` are per-scan stateful objects that hold the detection cache and own the detect/sweep loop; their `decrypt()` takes a caller-supplied packet-bound `decrypt_fn` and returns a `Detection(result, label)` — `label` is set only on the first successful detection of a scan. The CLI builds the `decrypt_fn` (so test mocks of `cli.decrypt`/`cli.decrypt_eax` still apply) and prints the `[INFO] Detected:` line itself when `label` is set.
+
 - **`packets.py`** - Data classes: `Location`, `EncryptedPacket`, `DecryptedPacket`, `AesEaxPacket`, `UnknownPacket`.
 
 - **`device.py`** - `Device` dataclass representing a registered device.