feat(schema)!: structured decorators on callables and classes

[rahlk]

Closes#128.

Problem

decorators was List[str] of raw ast.unparse output, on callables only
(codeanalyzer/schema/py_schema.py:274, written at
codeanalyzer/syntactic_analysis/symbol_table_builder.py:334). Callee, arguments and location
were fused into one opaque string, so @app.route and @blueprint.route bound to the same
function were unequal, and @lru_cache and @lru_cache(maxsize=128) were unrelated.

PyClass had no field at all, and it was not recoverable elsewhere: ClassDef.lineno points at
the class keyword, so decorator lines fall outside PyClass.span and module.source[span.bytes]
cannot reach them. @dataclass was simply gone.

Change

PyDecorator — name, qualified_name, positional_arguments, keyword_arguments,
expression, span — carried on PyCallable and PyClass. expression keeps the full unparsed
source, so decorators too complex to decompose lose nothing.

qualified_name is plumbing, not new analysis. Jedi already resolved these and the result was
discarded — accessed_symbols on a decorated callable already carried functools.lru_cache.
Resolution infers at the last identifier of the callee, so @a.b.c resolves c rather than
a, and is best-effort: dynamic and conditional decorators stay None and never abort the build.

Neo4j: :PyDecorator merges on the resolved qualified_name where there is one, so the two
lru_cache spellings collapse to one node. Per-application facts move onto PY_DECORATED_BY —
:PyDecorator is project-shared and never pruned (neo4j/bolt.py:32), so anything
application-specific on the node accumulates across every project in the database.
PY_DECORATED_BY now accepts PyClass as a start label.

Verification

Point dataclass -> dataclasses.dataclass {"frozen": "True"}
risky audit -> app.audit
lru_cache -> functools.lru_cache {"maxsize": "128"}
make builtins.staticmethod -> builtins.staticmethod

7 tests in test/test_decorators_structured.py: class decorator with arguments, callee/argument
separation, local and library resolution, dotted spelling, span byte-slicing, [] rather than a
missing key, and unresolvable decorators yielding None without raising.

Three deviations from the issue

• No cache-guard change. The issue asked for one. Tested instead: an old-shape cache fails
  Pydantic validation (2 validation errors for PyCallable) and core.py already catches that and
  rebuilds. The shape change is self-invalidating.
• No plumbing for PyClassAttribute / PyCallableParameter. They get the field for
  cross-language parity, but Python has no decorator syntax for either, so the [] default is the
  entire implementation.
• qualified_name resolved at L1, not L2. This avoids introducing a second sanctioned
  monotonicity refinement — nothing goes null → id across a level boundary.

docs/handoff/ is deliberately untouched: its README pins it as a frozen bundle for
codeanalyzer-python==1.0.1.

Caveats

• Breaking.decorators elements change str → object; consumers reading decorators[0] as a
  string must read .name or .qualified_name. python-sdk models this field and needs a
  lockstep update. No schema_version bump — v2 is a moving target until Java/Python/TypeScript
  converge, so there is no stable number to move.
• Unblocks Receiver binding misses non-bare staticmethod spellings (@builtins.staticmethod) #135: receiver binding can now test qualified_name == "builtins.staticmethod" instead
  of string-matching the spelling.
• Re-keying :PyDecorator strands nodes in an existing database; a load against a pre-existing
  graph leaves the old string-keyed nodes behind.
• Suite result below is from before the rebase onto the merged fix(pycg): canonicalize the builtins module spelling on PyCG edges #134; the post-rebase run is in
  progress and will be posted.