feat(db): canary token tables (blob/token/trigger)

Three new tables for the canary tokens feature:

- canary_blobs       — operator-uploaded source artifacts, deduped by sha256
- canary_tokens      — one planted artifact in one decky; carries the
                       callback slug, generator/instrumenter, and lifecycle
- canary_triggers    — append-only log of every callback hit; attacker_id
                       back-filled by the correlator

Pydantic request/response shapes live in the same file per the
single-source-of-truth convention. No migrations file — pre-v1
SQLModel.metadata.create_all() covers it.

decnet/web/db/models/__init__.py

@@ -14,6 +14,20 @@ from ._base import (
 from .common import (
     MessageResponse,
 )
+from .canary import (
+    CanaryBlob,
+    CanaryBlobResponse,
+    CanaryBlobsResponse,
+    CanaryKind,
+    CanaryState,
+    CanaryToken,
+    CanaryTokenCreateRequest,
+    CanaryTokenResponse,
+    CanaryTokensResponse,
+    CanaryTrigger,
+    CanaryTriggerResponse,
+    CanaryTriggersResponse,
+)
 from .auth import (
     AdminConfigResponse,
     ChangePasswordRequest,
@@ -159,6 +173,19 @@ __all__ = [
     "_normalize_null",
     # common
     "MessageResponse",
+    # canary
+    "CanaryBlob",
+    "CanaryBlobResponse",
+    "CanaryBlobsResponse",
+    "CanaryKind",
+    "CanaryState",
+    "CanaryToken",
+    "CanaryTokenCreateRequest",
+    "CanaryTokenResponse",
+    "CanaryTokensResponse",
+    "CanaryTrigger",
+    "CanaryTriggerResponse",
+    "CanaryTriggersResponse",
     # auth
     "AdminConfigResponse",
     "ChangePasswordRequest",