feat(attackers): scanned vs. interacted service bucketing on detail page

Adds a new card on AttackerDetail: SCANNED · N services | INTERACTED
WITH · M services. Distinguishes port-scanners (N high, M=0) from
actual engagement (M>0) at a glance — the analyst's first question
when triaging a new attacker row.

Classifier lives in decnet/correlation/event_kinds.py, a single
source of truth for the event-type vocabulary:

- INTERACTION_EVENT_TYPES — command-family (command/exec/query/...),
  SMTP engagement (mail_from/rcpt_to/message_accepted), file/payload
  activity (file_captured/upload/download_attempt/retr), pub/sub
  (publish/subscribe), recorded TTY sessions.
- NOISE_EVENT_TYPES — DECNET-internal (startup/shutdown/parse_error/
  unknown_*).
- Everything else defaults to scan. Conservative by design: new
  template verbs show up as "scanned" until explicitly promoted.

Bucket logic: a service is "interacted" if ≥1 of its events
classifies as interaction; otherwise "scanned" if ≥1 scan event;
noise-only services drop. Disjoint by construction.

Deliberate no-schema path: compute on-the-fly in the detail endpoint
via SELECT DISTINCT service, event_type FROM logs. Small result set
(tens of pairs per attacker), cost is trivial vs. the existing
behavior/commands queries. Trade-off: one more DB round-trip per
detail view in exchange for zero ALTER TABLE migration pain and
immediate classifier-change feedback loop.

Profiler's _COMMAND_EVENT_TYPES stays as-is (strict subset of
interactions that carry executable text), with a comment pointing at
the new canonical module.

Closes DEVELOPMENT.md "Attacker Intelligence §Service-Level Behavioral
Profiling — Services actively interacted with".

tests/web/test_api_attackers.py

@@ -183,6 +183,7 @@ class TestGetAttackerDetail:
         with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
             mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
             mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+            mock_repo.get_attacker_service_activity = AsyncMock(return_value=[])
 
             result = await get_attacker_detail(uuid="att-uuid-1", user={"uuid": "test-user", "role": "viewer"})
 
@@ -211,6 +212,7 @@ class TestGetAttackerDetail:
         with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
             mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
             mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+            mock_repo.get_attacker_service_activity = AsyncMock(return_value=[])
 
             result = await get_attacker_detail(uuid="att-uuid-1", user={"uuid": "test-user", "role": "viewer"})
 
@@ -219,6 +221,34 @@ class TestGetAttackerDetail:
         assert isinstance(result["fingerprints"], list)
         assert isinstance(result["commands"], list)
 
+    @pytest.mark.asyncio
+    async def test_service_activity_splits_scanned_vs_interacted(self):
+        """Attacker detail response buckets services by event-type signal."""
+        from decnet.web.router.attackers.api_get_attacker_detail import get_attacker_detail
+
+        sample = _sample_attacker()
+        pairs = [
+            ("ssh", "connection"),
+            ("ssh", "shell_input"),   # promotes ssh to interacted
+            ("http", "get_request"),  # scan only
+            ("ftp", "retr"),          # interacted
+            ("bus", "startup"),       # noise — dropped
+        ]
+        with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
+            mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
+            mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+            mock_repo.get_attacker_service_activity = AsyncMock(return_value=pairs)
+
+            result = await get_attacker_detail(
+                uuid="att-uuid-1",
+                user={"uuid": "test-user", "role": "viewer"},
+            )
+
+        assert result["service_activity"] == {
+            "interacted": ["ftp", "ssh"],
+            "scanned": ["http"],
+        }
+
 
 # ─── GET /attackers/{uuid}/commands ──────────────────────────────────────────