refactor(intel): re-key attacker_intel on attacker_uuid (closes DEBT-041)

The threat-intel surface was IP-keyed on day one as an expedient — the
worker is woken by IP-bearing bus events. ANTI's call: don't carry that
debt. NO IPs as primary keys anywhere on the attacker-intel surface.

Schema:
- attacker_uuid is now the canonical key — UNIQUE + FK to attackers.uuid.
- attacker_ip stays as a denormalised, indexed, NON-UNIQUE value column.
  Updated on every upsert; useful for SIEM payloads and audit lookups,
  but explicitly NOT a key. Model docstring says so.
- Pre-v1, no Alembic migration needed. SQLModel.metadata.create_all()
  builds the new shape on fresh DBs.

Repo:
- upsert_attacker_intel now keys on attacker_uuid.
- get_attacker_intel_by_ip → get_attacker_intel_by_uuid.
- get_unenriched_attacker_ips → get_unenriched_attackers, returning
  [{uuid, ip}] tuples so the worker writes by UUID and dispatches
  provider calls by IP without a second round-trip.

Worker:
- _enrich_one(uuid, ip, ...) — UUID lands on the row, IP rides for
  provider egress.
- attacker.intel.enriched bus payload gains attacker_uuid alongside
  attacker_ip — webhook → SIEM consumers benefit; no removal.

API:
- GET /api/v1/attackers/{ip}/intel deleted outright (rip-and-replace,
  never deployed beyond dev).
- GET /api/v1/attackers/{uuid}/intel is the only public route, matching
  every other /attackers/* route.

Frontend:
- <IntelPanel uuid={id!} /> uses the URL param directly, fetches in
  parallel with the rest of AttackerDetail rather than waiting on
  attacker.ip.

Tests: re-keyed in place, 39 passed (same coverage as before the
refactor). Provider-impl tests untouched.

DEBT-041: closed in DEBT.md (entry preserved as historical rationale,
summary table flipped to ✅, remaining-open list shortened by one).

decnet/web/db/models/attacker_intel.py

@@ -30,8 +30,18 @@ class AttackerIntel(SQLModel, table=True):
     __tablename__ = "attacker_intel"
 
     uuid: str = Field(primary_key=True)  # uuid.uuid4().hex, generated by writer
-    attacker_uuid: Optional[str] = Field(default=None, index=True)
-    attacker_ip: str = Field(index=True, unique=True)
+    # Canonical key. One intel row per attacker UUID; FK guarantees no orphan
+    # rows when an attacker is deleted, and UNIQUE keeps upserts honest.
+    attacker_uuid: str = Field(
+        foreign_key="attackers.uuid",
+        unique=True,
+        index=True,
+    )
+    # DENORMALISED — NOT a key. The IP the worker queried providers with at
+    # write time. Useful for SIEM payloads and audit lookups; updated on every
+    # upsert if the attacker rotates IPs. Never use this column as a lookup
+    # key; ``attacker_uuid`` is the only canonical identifier here.
+    attacker_ip: str = Field(index=True)
     schema_version: int = Field(default=1)
 
     # ── GreyNoise Community ─────────────────────────────────────────────