feat(canary): auto-deregister fingerprint slug after first valid beacon

Once a fingerprint canary's HTTP beacon passes all 4 validation layers
and the trigger row lands, the token is immediately set to state=revoked
and canary.<id>.revoked is published on the bus. The slug lookup is
tightened to only return planted tokens, so subsequent requests to the
same URL silently return the transparent GIF without persisting anything
(stealth posture preserved). Plain http/dns canaries with no
fingerprint_nonce are not affected.

Changes:
- sqlmodel_repo/canary.py: add state == "planted" filter to
  get_canary_token_by_slug so revoked slugs resolve to None
- worker.py: after record_canary_trigger, if parsed_fp survived all
  layers and token has a fingerprint_nonce, call
  update_canary_token_state("revoked") + publish CANARY_REVOKED; errors
  are best-effort (trigger row already landed)
- test_worker_http.py: assert state=revoked in test_fp_valid_nonce_persists;
  new test_fp_deregisters_slug_after_valid_hit (second hit records nothing);
  new test_plain_http_canary_not_deregistered (env_file stays planted)

decnet/canary/worker.py

@@ -339,6 +339,22 @@ async def _record_hit(
     except Exception as e:  # noqa: BLE001 — best effort
         log.warning("canary.triggered publish failed slug=%s err=%s", slug, e)
 
+    # Auto-deregister fingerprint canaries after the first valid fingerprint
+    # is collected. Slug goes dark; the stealth posture means the attacker
+    # sees the same 200 + GIF on the next hit — nothing reveals the revocation.
+    # Guard: only fingerprint tokens have a non-NULL fingerprint_nonce; plain
+    # http/dns canaries are NOT auto-revoked.
+    if parsed_fp is not None and token.get("fingerprint_nonce") is not None:
+        try:
+            await repo.update_canary_token_state(token["uuid"], "revoked")
+            await bus.publish(
+                topics.canary(token["uuid"], topics.CANARY_REVOKED),
+                {"token_id": token["uuid"], "trigger_id": trigger_id,
+                 "reason": "fingerprint_collected"},
+            )
+        except Exception as e:  # noqa: BLE001 — trigger row already landed; best effort
+            log.warning("canary.deregister failed token=%s err=%s", token["uuid"], e)
+
 
 # ---------------------------- DNS surface --------------------------------