feat(web): attacker artifacts endpoint + UI drawer

Adds the server-side wiring and frontend UI to surface files captured
by the SSH honeypot for a given attacker.

- New repository method get_attacker_artifacts (abstract + SQLModel
  impl) that joins the attacker's IP to `file_captured` log rows.
- New route GET /attackers/{uuid}/artifacts.
- New router /artifacts/{decky}/{service}/{stored_as} that streams a
  quarantined file back to an authenticated viewer.
- AttackerDetail grows an ArtifactDrawer panel with per-file metadata
  (sha256, size, orig_path) and a download action.
- ssh service fragment now sets NODE_NAME=decky_name so logs and the
  host-side artifacts bind-mount share the same decky identifier.

decnet_web/src/components/ArtifactDrawer.tsx

@@ -0,0 +1,186 @@
+import React, { useState } from 'react';
+import { X, Download, AlertTriangle } from 'lucide-react';
+import api from '../utils/api';
+
+interface ArtifactDrawerProps {
+  decky: string;
+  storedAs: string;
+  fields: Record<string, any>;
+  onClose: () => void;
+}
+
+// Bulky nested structures are shipped as one base64-encoded JSON blob in
+// `meta_json_b64` (see templates/ssh/emit_capture.py). All summary fields
+// arrive as top-level SD params already present in `fields`.
+function decodeMeta(fields: Record<string, any>): Record<string, any> | null {
+  const b64 = fields.meta_json_b64;
+  if (typeof b64 !== 'string' || !b64) return null;
+  try {
+    const json = atob(b64);
+    return JSON.parse(json);
+  } catch (err) {
+    console.error('artifact: failed to decode meta_json_b64', err);
+    return null;
+  }
+}
+
+const Row: React.FC<{ label: string; value: React.ReactNode }> = ({ label, value }) => (
+  <div style={{ display: 'flex', gap: '12px', padding: '6px 0', borderBottom: '1px solid rgba(255,255,255,0.05)' }}>
+    <div style={{ minWidth: '140px', color: 'var(--dim-color)', fontSize: '0.75rem', textTransform: 'uppercase' }}>{label}</div>
+    <div style={{ flex: 1, fontSize: '0.85rem', wordBreak: 'break-all' }}>{value ?? <span style={{ opacity: 0.4 }}>—</span>}</div>
+  </div>
+);
+
+const ArtifactDrawer: React.FC<ArtifactDrawerProps> = ({ decky, storedAs, fields, onClose }) => {
+  const [downloading, setDownloading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const meta = decodeMeta(fields);
+
+  const handleDownload = async () => {
+    setDownloading(true);
+    setError(null);
+    try {
+      const res = await api.get(
+        `/artifacts/${encodeURIComponent(decky)}/${encodeURIComponent(storedAs)}`,
+        { responseType: 'blob' },
+      );
+      const blobUrl = URL.createObjectURL(res.data);
+      const a = document.createElement('a');
+      a.href = blobUrl;
+      a.download = storedAs;
+      document.body.appendChild(a);
+      a.click();
+      document.body.removeChild(a);
+      URL.revokeObjectURL(blobUrl);
+    } catch (err: any) {
+      const status = err?.response?.status;
+      setError(
+        status === 403 ? 'Admin role required to download artifacts.' :
+        status === 404 ? 'Artifact not found on disk (may have been purged).' :
+        status === 400 ? 'Server rejected the request (invalid parameters).' :
+        'Download failed — see console.'
+      );
+      console.error('artifact download failed', err);
+    } finally {
+      setDownloading(false);
+    }
+  };
+
+  const concurrent = meta?.concurrent_sessions;
+  const ssSnapshot = meta?.ss_snapshot;
+
+  return (
+    <div
+      onClick={onClose}
+      style={{
+        position: 'fixed', inset: 0,
+        backgroundColor: 'rgba(0,0,0,0.6)',
+        display: 'flex', justifyContent: 'flex-end',
+        zIndex: 1000,
+      }}
+    >
+      <div
+        onClick={(e) => e.stopPropagation()}
+        style={{
+          width: 'min(620px, 100%)', height: '100%',
+          backgroundColor: 'var(--bg-color, #0d1117)',
+          borderLeft: '1px solid var(--border-color, #30363d)',
+          padding: '24px', overflowY: 'auto',
+          color: 'var(--text-color)',
+        }}
+      >
+        <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '16px' }}>
+          <div>
+            <div style={{ fontSize: '0.7rem', color: 'var(--dim-color)', letterSpacing: '0.1em' }}>
+              CAPTURED ARTIFACT · {decky}
+            </div>
+            <div style={{ fontSize: '1rem', fontWeight: 'bold', marginTop: '4px', wordBreak: 'break-all' }}>
+              {storedAs}
+            </div>
+          </div>
+          <button onClick={onClose} style={{ background: 'none', border: 'none', color: 'var(--text-color)', cursor: 'pointer' }}>
+            <X size={20} />
+          </button>
+        </div>
+
+        <div style={{
+          display: 'flex', alignItems: 'center', gap: '8px',
+          padding: '8px 12px', marginBottom: '16px',
+          border: '1px solid rgba(255, 170, 0, 0.3)',
+          backgroundColor: 'rgba(255, 170, 0, 0.05)',
+          fontSize: '0.75rem', color: '#ffaa00',
+        }}>
+          <AlertTriangle size={14} />
+          Attacker-controlled content. Download at your own risk.
+        </div>
+
+        <button
+          onClick={handleDownload}
+          disabled={downloading}
+          style={{
+            display: 'flex', alignItems: 'center', gap: '8px',
+            padding: '8px 14px', marginBottom: '20px',
+            border: '1px solid var(--text-color)',
+            background: 'transparent', color: 'var(--text-color)',
+            cursor: downloading ? 'wait' : 'pointer',
+            opacity: downloading ? 0.5 : 1,
+          }}
+        >
+          <Download size={14} /> {downloading ? 'DOWNLOADING…' : 'DOWNLOAD RAW'}
+        </button>
+        {error && (
+          <div style={{ color: '#ff5555', fontSize: '0.8rem', marginBottom: '16px' }}>{error}</div>
+        )}
+
+        <section style={{ marginBottom: '24px' }}>
+          <h3 style={{ fontSize: '0.8rem', letterSpacing: '0.1em', color: 'var(--dim-color)', marginBottom: '8px' }}>
+            ORIGIN
+          </h3>
+          <Row label="Orig path" value={fields.orig_path} />
+          <Row label="SHA-256" value={fields.sha256} />
+          <Row label="Size" value={fields.size ? `${fields.size} bytes` : null} />
+          <Row label="Mtime" value={fields.mtime} />
+        </section>
+
+        <section style={{ marginBottom: '24px' }}>
+          <h3 style={{ fontSize: '0.8rem', letterSpacing: '0.1em', color: 'var(--dim-color)', marginBottom: '8px' }}>
+            ATTRIBUTION · {fields.attribution ?? 'unknown'}
+          </h3>
+          <Row label="SSH user" value={fields.ssh_user} />
+          <Row label="Src IP" value={fields.src_ip} />
+          <Row label="Src port" value={fields.src_port} />
+          <Row label="SSH pid" value={fields.ssh_pid} />
+          <Row label="Writer pid" value={fields.writer_pid} />
+          <Row label="Writer comm" value={fields.writer_comm} />
+          <Row label="Writer uid" value={fields.writer_uid} />
+          <Row label="Writer cmdline" value={meta?.writer_cmdline} />
+          <Row label="Writer loginuid" value={meta?.writer_loginuid} />
+        </section>
+
+        {Array.isArray(concurrent) && concurrent.length > 0 && (
+          <section style={{ marginBottom: '24px' }}>
+            <h3 style={{ fontSize: '0.8rem', letterSpacing: '0.1em', color: 'var(--dim-color)', marginBottom: '8px' }}>
+              CONCURRENT SESSIONS ({concurrent.length})
+            </h3>
+            <pre style={{ fontSize: '0.75rem', background: 'rgba(255,255,255,0.03)', padding: '8px', overflowX: 'auto' }}>
+              {JSON.stringify(concurrent, null, 2)}
+            </pre>
+          </section>
+        )}
+
+        {Array.isArray(ssSnapshot) && ssSnapshot.length > 0 && (
+          <section>
+            <h3 style={{ fontSize: '0.8rem', letterSpacing: '0.1em', color: 'var(--dim-color)', marginBottom: '8px' }}>
+              SS SNAPSHOT ({ssSnapshot.length})
+            </h3>
+            <pre style={{ fontSize: '0.75rem', background: 'rgba(255,255,255,0.03)', padding: '8px', overflowX: 'auto' }}>
+              {JSON.stringify(ssSnapshot, null, 2)}
+            </pre>
+          </section>
+        )}
+      </div>
+    </div>
+  );
+};
+
+export default ArtifactDrawer;

decnet_web/src/components/AttackerDetail.tsx

@@ -1,7 +1,8 @@
 import React, { useEffect, useState } from 'react';
 import { useParams, useNavigate } from 'react-router-dom';
-import { Activity, ArrowLeft, ChevronDown, ChevronLeft, ChevronRight, ChevronUp, Crosshair, Fingerprint, Shield, Clock, Wifi, Lock, FileKey, Radio, Timer } from 'lucide-react';
+import { Activity, ArrowLeft, ChevronDown, ChevronLeft, ChevronRight, ChevronUp, Crosshair, Fingerprint, Shield, Clock, Wifi, Lock, FileKey, Radio, Timer, Paperclip } from 'lucide-react';
 import api from '../utils/api';
+import ArtifactDrawer from './ArtifactDrawer';
 import './Dashboard.css';
 
 interface AttackerBehavior {
@@ -705,7 +706,19 @@ const AttackerDetail: React.FC = () => {
     behavior: true,
     commands: true,
     fingerprints: true,
+    artifacts: true,
   });
+
+  // Captured file-drop artifacts (ssh inotify farm) for this attacker.
+  type ArtifactLog = {
+    id: number;
+    timestamp: string;
+    decky: string;
+    service: string;
+    fields: string; // JSON-encoded SD params (parsed lazily below)
+  };
+  const [artifacts, setArtifacts] = useState<ArtifactLog[]>([]);
+  const [artifact, setArtifact] = useState<{ decky: string; storedAs: string; fields: Record<string, any> } | null>(null);
   const toggle = (key: string) => setOpenSections((prev) => ({ ...prev, [key]: !prev[key] }));
 
   // Commands pagination state
@@ -759,6 +772,19 @@ const AttackerDetail: React.FC = () => {
     setCmdPage(1);
   }, [serviceFilter]);
 
+  useEffect(() => {
+    if (!id) return;
+    const fetchArtifacts = async () => {
+      try {
+        const res = await api.get(`/attackers/${id}/artifacts`);
+        setArtifacts(res.data.data ?? []);
+      } catch {
+        setArtifacts([]);
+      }
+    };
+    fetchArtifacts();
+  }, [id]);
+
   if (loading) {
     return (
       <div className="dashboard">
@@ -1058,6 +1084,88 @@ const AttackerDetail: React.FC = () => {
         );
       })()}
 
+      {/* Captured Artifacts */}
+      <Section
+        title={<>CAPTURED ARTIFACTS ({artifacts.length})</>}
+        open={openSections.artifacts}
+        onToggle={() => toggle('artifacts')}
+      >
+        {artifacts.length > 0 ? (
+          <div className="logs-table-container">
+            <table className="logs-table">
+              <thead>
+                <tr>
+                  <th>TIMESTAMP</th>
+                  <th>DECKY</th>
+                  <th>FILENAME</th>
+                  <th>SIZE</th>
+                  <th>SHA-256</th>
+                  <th></th>
+                </tr>
+              </thead>
+              <tbody>
+                {artifacts.map((row) => {
+                  let fields: Record<string, any> = {};
+                  try { fields = JSON.parse(row.fields || '{}'); } catch {}
+                  const storedAs = fields.stored_as ? String(fields.stored_as) : null;
+                  const sha = fields.sha256 ? String(fields.sha256) : '';
+                  return (
+                    <tr key={row.id}>
+                      <td className="dim" style={{ fontSize: '0.75rem', whiteSpace: 'nowrap' }}>
+                        {new Date(row.timestamp).toLocaleString()}
+                      </td>
+                      <td className="violet-accent">{row.decky}</td>
+                      <td className="matrix-text" style={{ fontFamily: 'monospace', wordBreak: 'break-all' }}>
+                        {fields.orig_path ?? storedAs ?? '—'}
+                      </td>
+                      <td className="matrix-text" style={{ fontFamily: 'monospace' }}>
+                        {fields.size ? `${fields.size} B` : '—'}
+                      </td>
+                      <td className="dim" style={{ fontFamily: 'monospace', fontSize: '0.7rem' }}>
+                        {sha ? `${sha.slice(0, 12)}…` : '—'}
+                      </td>
+                      <td>
+                        {storedAs && (
+                          <button
+                            onClick={() => setArtifact({ decky: row.decky, storedAs, fields })}
+                            title="Inspect captured artifact"
+                            style={{
+                              display: 'flex', alignItems: 'center', gap: '6px',
+                              fontSize: '0.7rem',
+                              backgroundColor: 'rgba(255, 170, 0, 0.1)',
+                              padding: '2px 8px',
+                              borderRadius: '4px',
+                              border: '1px solid rgba(255, 170, 0, 0.5)',
+                              color: '#ffaa00',
+                              cursor: 'pointer',
+                            }}
+                          >
+                            <Paperclip size={11} /> OPEN
+                          </button>
+                        )}
+                      </td>
+                    </tr>
+                  );
+                })}
+              </tbody>
+            </table>
+          </div>
+        ) : (
+          <div style={{ padding: '24px', textAlign: 'center', opacity: 0.5 }}>
+            NO ARTIFACTS CAPTURED FROM THIS ATTACKER
+          </div>
+        )}
+      </Section>
+
+      {artifact && (
+        <ArtifactDrawer
+          decky={artifact.decky}
+          storedAs={artifact.storedAs}
+          fields={artifact.fields}
+          onClose={() => setArtifact(null)}
+        />
+      )}
+
       {/* UUID footer */}
       <div style={{ textAlign: 'right', fontSize: '0.65rem', opacity: 0.3, marginTop: '8px' }}>
         UUID: {attacker.uuid}