feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER

Extends the prober with two new active probe types alongside JARM:
- HASSHServer: SSH server fingerprinting via KEX_INIT algorithm ordering
  (MD5 hash of kex;enc_s2c;mac_s2c;comp_s2c, pure stdlib)
- TCP/IP stack: OS/tool fingerprinting via SYN-ACK analysis using scapy
  (TTL, window size, DF bit, MSS, TCP options ordering, SHA256 hash)

Worker probe cycle now runs three phases per IP with independent
per-type port tracking. Ingester extracts bounties for all three
fingerprint types.

decnet/cli.py

@@ -324,7 +324,7 @@ def probe(
     timeout: float = typer.Option(5.0, "--timeout", help="Per-probe TCP timeout in seconds"),
     daemon: bool = typer.Option(False, "--daemon", "-d", help="Detach to background (used by deploy, no console output)"),
 ) -> None:
-    """JARM-fingerprint all attackers discovered in the log stream."""
+    """Fingerprint attackers (JARM + HASSH + TCP/IP stack) discovered in the log stream."""
     import asyncio
     from decnet.prober import prober_worker