feat: complete OTEL tracing across all services with pipeline bridge and docs

Extends tracing to every remaining module: all 23 API route handlers,
correlation engine, sniffer (fingerprint/p0f/syslog), prober (jarm/hassh/tcpfp),
profiler behavioral analysis, logging subsystem, engine, and mutator.

Bridges the ingester→SSE trace gap by persisting trace_id/span_id columns on
the logs table and creating OTEL span links in the SSE endpoint. Adds log-trace
correlation via _TraceContextFilter injecting otel_trace_id into Python LogRecords.

Includes development/docs/TRACING.md with full span reference (76 spans),
pipeline propagation architecture, quick start guide, and troubleshooting.

decnet/prober/hassh.py

@@ -9,7 +9,7 @@ This is the *server* variant of HASSH (HASSHServer). It fingerprints what
 the server *offers*, which identifies the SSH implementation (OpenSSH,
 Paramiko, libssh, Cobalt Strike SSH, etc.).
 
-Stdlib only (socket, struct, hashlib). No DECNET imports.
+Stdlib only (socket, struct, hashlib) plus decnet.telemetry for tracing (zero-cost when disabled).
 """
 
 from __future__ import annotations
@@ -19,6 +19,8 @@ import socket
 import struct
 from typing import Any
 
+from decnet.telemetry import traced as _traced
+
 # SSH protocol constants
 _SSH_MSG_KEXINIT = 20
 _KEX_INIT_COOKIE_LEN = 16
@@ -36,6 +38,7 @@ _MAX_PACKET_LEN = 35000
 
 # ─── SSH connection + KEX_INIT capture ──────────────────────────────────────
 
+@_traced("prober.hassh_ssh_connect")
 def _ssh_connect(
     host: str,
     port: int,
@@ -213,6 +216,7 @@ def _compute_hassh(kex: str, enc: str, mac: str, comp: str) -> str:
 
 # ─── Public API ─────────────────────────────────────────────────────────────
 
+@_traced("prober.hassh_server")
 def hassh_server(
     host: str,
     port: int,

decnet/prober/jarm.py

@@ -8,7 +8,7 @@ fingerprint that identifies the TLS server implementation.
 
 Reference: https://github.com/salesforce/jarm
 
-No DECNET imports — this module is self-contained and testable in isolation.
+Only DECNET import is decnet.telemetry for tracing (zero-cost when disabled).
 """
 
 from __future__ import annotations
@@ -19,6 +19,8 @@ import struct
 import time
 from typing import Any
 
+from decnet.telemetry import traced as _traced
+
 # ─── Constants ────────────────────────────────────────────────────────────────
 
 JARM_EMPTY_HASH = "0" * 62
@@ -379,6 +381,7 @@ def _version_to_str(version: int) -> str:
 
 # ─── Probe sender ────────────────────────────────────────────────────────────
 
+@_traced("prober.jarm_send_probe")
 def _send_probe(host: str, port: int, hello: bytes, timeout: float = 5.0) -> bytes | None:
     """
     Open a TCP connection, send the ClientHello, and read the ServerHello.
@@ -471,6 +474,7 @@ def _compute_jarm(responses: list[str]) -> str:
 
 # ─── Public API ──────────────────────────────────────────────────────────────
 
+@_traced("prober.jarm_hash")
 def jarm_hash(host: str, port: int, timeout: float = 5.0) -> str:
     """
     Compute the JARM fingerprint for a TLS server.

decnet/prober/tcpfp.py

@@ -15,6 +15,8 @@ import hashlib
 import random
 from typing import Any
 
+from decnet.telemetry import traced as _traced
+
 # Lazy-import scapy to avoid breaking non-root usage of HASSH/JARM.
 # The actual import happens inside functions that need it.
 
@@ -36,6 +38,7 @@ _OPT_CODES: dict[str, str] = {
 
 # ─── Packet construction ───────────────────────────────────────────────────
 
+@_traced("prober.tcpfp_send_syn")
 def _send_syn(
     host: str,
     port: int,
@@ -196,6 +199,7 @@ def _compute_fingerprint(fields: dict[str, Any]) -> tuple[str, str]:
 
 # ─── Public API ─────────────────────────────────────────────────────────────
 
+@_traced("prober.tcp_fingerprint")
 def tcp_fingerprint(
     host: str,
     port: int,

decnet/prober/worker.py

@@ -169,6 +169,7 @@ def _write_event(
 
 # ─── Target discovery from log stream ────────────────────────────────────────
 
+@_traced("prober.discover_attackers")
 def _discover_attackers(json_path: Path, position: int) -> tuple[set[str], int]:
     """
     Read new JSON log lines from the given position and extract unique
@@ -399,6 +400,7 @@ def _tcpfp_phase(
 
 # ─── Main worker ─────────────────────────────────────────────────────────────
 
+@_traced("prober.worker")
 async def prober_worker(
     log_file: str,
     interval: int = 300,