feat: Phase 1 — JA3/JA3S sniffer, Attacker model, profile worker

Add passive TLS fingerprinting via a sniffer container on the MACVLAN
interface, plus the Attacker table and periodic rebuild worker that
correlates per-IP profiles from Log + Bounty + CorrelationEngine.

- templates/sniffer/: Scapy sniffer with pure-Python TLS parser;
  emits tls_client_hello / tls_session RFC 5424 lines with ja3, ja3s,
  sni, alpn, raw_ciphers, raw_extensions; GREASE filtered per RFC 8701
- decnet/services/sniffer.py: service plugin (no ports, NET_RAW/NET_ADMIN)
- decnet/web/db/models.py: Attacker SQLModel table + AttackersResponse
- decnet/web/db/repository.py: 5 new abstract methods
- decnet/web/db/sqlite/repository.py: implement all 5 (upsert, pagination,
  sort by recent/active/traversals, bounty grouping)
- decnet/web/attacker_worker.py: 30s periodic rebuild via CorrelationEngine;
  extracts commands from log fields, merges fingerprint bounties
- decnet/web/api.py: wire attacker_profile_worker into lifespan
- decnet/web/ingester.py: extract JA3 bounty (fingerprint_type=ja3)
- development/DEVELOPMENT.md: full attacker intelligence collection roadmap
- pyproject.toml: scapy>=2.6.1 added to dev deps
- tests: test_sniffer_ja3.py (40+ vectors), test_attacker_worker.py,
  test_base_repo.py / test_web_api.py updated for new surface

tests/test_base_repo.py

@@ -21,6 +21,11 @@ class DummyRepo(BaseRepository):
     async def get_total_bounties(self, **kw): await super().get_total_bounties(**kw)
     async def get_state(self, k): await super().get_state(k)
     async def set_state(self, k, v): await super().set_state(k, v)
+    async def get_all_logs_raw(self): await super().get_all_logs_raw()
+    async def get_all_bounties_by_ip(self): await super().get_all_bounties_by_ip()
+    async def upsert_attacker(self, d): await super().upsert_attacker(d)
+    async def get_attackers(self, **kw): await super().get_attackers(**kw)
+    async def get_total_attackers(self, **kw): await super().get_total_attackers(**kw)
 
 @pytest.mark.asyncio
 async def test_base_repo_coverage():
@@ -41,3 +46,8 @@ async def test_base_repo_coverage():
     await dr.get_total_bounties()
     await dr.get_state("k")
     await dr.set_state("k", "v")
+    await dr.get_all_logs_raw()
+    await dr.get_all_bounties_by_ip()
+    await dr.upsert_attacker({})
+    await dr.get_attackers()
+    await dr.get_total_attackers()