feat(intel): attacker_intel table + repo helpers

New TTL-cached threat-intel row keyed by attacker IP, with per-provider
verdict/raw/queried_at columns for GreyNoise, AbuseIPDB, abuse.ch Feodo
Tracker and ThreatFox. Carries schema_version from day one (federation
wire-format precedent set by SessionProfile). Repo gains
upsert_attacker_intel, get_attacker_intel_by_ip, and a
get_unenriched_attacker_ips backfill primitive that picks fresh + stale
rows for the forthcoming 'decnet enrich' worker.

Also documents the open-source intel-source backlog in DEVELOPMENT_V2.

decnet/web/db/models/__init__.py

@@ -35,6 +35,9 @@ from .attackers import (
     SessionProfile,
     SmtpTarget,
 )
+from .attacker_intel import (
+    AttackerIntel,
+)
 from .deploy import (
     DeployIniRequest,
     DeployResponse,
@@ -157,6 +160,7 @@ __all__ = [
     # attackers
     "Attacker",
     "AttackerBehavior",
+    "AttackerIntel",
     "AttackersResponse",
     "SessionProfile",
     "SmtpTarget",