feat(stix_export): wire fingerprint bounties through all endpoints + tests

Remaining files from the fingerprint-bounties + characterizes-SRO commit:
misp_export, repository, bounties mixin, all 4 router endpoints, and test suite
updates. Prerequisite: previous commit added _extract_fingerprint_bounty_data
and the stix_export changes.

decnet/web/router/attackers/api_export_attacker_misp.py

@@ -66,6 +66,7 @@ async def api_export_attacker_misp(
         repo.list_smtp_targets(uuid),
         repo.list_attacker_commands_deduped(uuid),
         repo.list_observations_by_attacker(uuid),
+        repo.get_fingerprint_bounties_by_ip(attacker["ip"]),
     )
     behavior = cast(dict[str, Any] | None, results[0])
     identity = cast(dict[str, Any] | None, results[1])
@@ -76,6 +77,7 @@ async def api_export_attacker_misp(
     smtp_targets = cast(list[dict[str, Any]], results[6])
     commands = cast(list[str], results[7])
     observations = cast(list[dict[str, Any]], results[8])
+    fingerprint_bounties = cast(list[dict[str, Any]], results[9])
 
     event = build_attacker_misp_event(
         attacker=attacker,
@@ -91,6 +93,7 @@ async def api_export_attacker_misp(
         smtp_targets=smtp_targets,
         commands=commands,
         observations=observations,
+        fingerprint_bounties=fingerprint_bounties,
     )
     return Response(
         content=json.dumps(event, default=str),

decnet/web/router/attackers/api_export_attacker_stix.py

@@ -70,6 +70,7 @@ async def api_export_attacker_stix(
         repo.list_smtp_targets(uuid),
         repo.list_attacker_commands_deduped(uuid),
         repo.list_observations_by_attacker(uuid),
+        repo.get_fingerprint_bounties_by_ip(attacker["ip"]),
     )
     behavior = cast(dict[str, Any] | None, results[0])
     identity = cast(dict[str, Any] | None, results[1])
@@ -80,6 +81,7 @@ async def api_export_attacker_stix(
     smtp_targets = cast(list[dict[str, Any]], results[6])
     commands = cast(list[str], results[7])
     observations = cast(list[dict[str, Any]], results[8])
+    fingerprint_bounties = cast(list[dict[str, Any]], results[9])
 
     bundle = build_attacker_bundle(
         attacker=attacker,
@@ -95,6 +97,7 @@ async def api_export_attacker_stix(
         smtp_targets=smtp_targets,
         commands=commands,
         observations=observations,
+        fingerprint_bounties=fingerprint_bounties,
     )
     return Response(
         content=bundle.serialize(pretty=True, indent=2),

decnet/web/router/attackers/api_export_attackers_misp.py

@@ -43,15 +43,17 @@ async def api_export_attackers_misp(
     user: dict[str, Any] = Depends(require_viewer),
 ) -> Response:
     """Download a MISP collection JSON covering every observed attacker."""
-    rows, ttp_by_attacker, obs_by_attacker = await asyncio.gather(
+    rows, ttp_by_attacker, obs_by_attacker, fp_by_ip = await asyncio.gather(
         repo.get_all_attackers_for_export(),
         repo.get_all_ttp_rollups_for_export(),
         repo.get_all_observations_for_export(),
+        repo.get_all_fingerprint_bounties_for_export(),
     )
     collection = build_fleet_misp_collection(
         rows=rows,
         ttp_by_attacker=ttp_by_attacker,
         observations_by_attacker=obs_by_attacker,
+        fingerprint_bounties_by_ip=fp_by_ip,
     )
     ts = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
     return Response(

decnet/web/router/attackers/api_export_attackers_stix.py

@@ -42,11 +42,12 @@ async def api_export_attackers_stix(
     user: dict[str, Any] = Depends(require_viewer),
 ) -> Response:
     """Download a STIX 2.1 bundle covering every observed attacker."""
-    rows, ttp_by_attacker, obs_by_attacker = await _gather_fleet_data()
+    rows, ttp_by_attacker, obs_by_attacker, fp_by_ip = await _gather_fleet_data()
     bundle = build_fleet_bundle(
         rows=rows,
         ttp_by_attacker=ttp_by_attacker,
         observations_by_attacker=obs_by_attacker,
+        fingerprint_bounties_by_ip=fp_by_ip,
     )
     ts = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
     return Response(
@@ -64,11 +65,13 @@ async def _gather_fleet_data() -> tuple[
     list[dict[str, Any]],
     dict[str, list[dict[str, Any]]],
     dict[str, list[dict[str, Any]]],
+    dict[str, list[dict[str, Any]]],
 ]:
     import asyncio
-    rows, ttp_by_attacker, obs_by_attacker = await asyncio.gather(
+    rows, ttp_by_attacker, obs_by_attacker, fp_by_ip = await asyncio.gather(
         repo.get_all_attackers_for_export(),
         repo.get_all_ttp_rollups_for_export(),
         repo.get_all_observations_for_export(),
+        repo.get_all_fingerprint_bounties_for_export(),
     )
-    return rows, ttp_by_attacker, obs_by_attacker
+    return rows, ttp_by_attacker, obs_by_attacker, fp_by_ip