refactor(db): extract AttackerIntelMixin

Moves upsert_attacker_intel, get_attacker_intel_by_uuid,
and get_unenriched_attackers into sqlmodel_repo/attacker_intel.py.
Composed onto SQLModelRepository via mixin inheritance.

decnet/web/db/sqlmodel_repo/__init__.py

@@ -37,7 +37,6 @@ from decnet.web.db.models import (
     Attacker,
     AttackerBehavior,
     AttackerIdentity,
-    AttackerIntel,
     Campaign,
     SessionProfile,
     SmtpTarget,
@@ -67,9 +66,13 @@ from decnet.web.db.sqlmodel_repo._helpers import (  # noqa: F401  (re-exported f
     _detach_close,
     _cleanup_tasks,
 )
+from decnet.web.db.sqlmodel_repo.attacker_intel import AttackerIntelMixin
 
 
-class SQLModelRepository(BaseRepository):
+class SQLModelRepository(
+    AttackerIntelMixin,
+    BaseRepository,
+):
     """Concrete SQLModel/SQLAlchemy-async repository.
 
     Subclasses provide ``self.engine`` (AsyncEngine) and ``self.session_factory``
@@ -1139,84 +1142,6 @@ class SQLModelRepository(BaseRepository):
                 return None
             return row.model_dump(mode="json")
 
-    async def upsert_attacker_intel(self, data: dict[str, Any]) -> str:
-        attacker_uuid_value = data["attacker_uuid"]
-        async with self._session() as session:
-            result = await session.execute(
-                select(AttackerIntel).where(
-                    AttackerIntel.attacker_uuid == attacker_uuid_value,
-                )
-            )
-            existing = result.scalar_one_or_none()
-            if existing:
-                for k, v in data.items():
-                    setattr(existing, k, v)
-                session.add(existing)
-                row_uuid = existing.uuid
-            else:
-                row_uuid = uuid.uuid4().hex
-                session.add(AttackerIntel(uuid=row_uuid, **data))
-            await session.commit()
-            return row_uuid
-
-    async def get_attacker_intel_by_uuid(
-        self,
-        uuid: str,
-    ) -> Optional[dict[str, Any]]:
-        async with self._session() as session:
-            result = await session.execute(
-                select(AttackerIntel).where(AttackerIntel.attacker_uuid == uuid)
-            )
-            row = result.scalar_one_or_none()
-            if not row:
-                return None
-            d = row.model_dump(mode="json")
-            for key in (
-                "greynoise_raw",
-                "abuseipdb_raw",
-                "feodo_raw",
-                "threatfox_raw",
-            ):
-                raw = d.get(key)
-                if isinstance(raw, str):
-                    try:
-                        d[key] = json.loads(raw)
-                    except (json.JSONDecodeError, TypeError):
-                        pass
-            return d
-
-    async def get_unenriched_attackers(
-        self, limit: int = 100,
-    ) -> list[dict[str, Any]]:
-        """``{"uuid", "ip"}`` pairs with no intel row OR a stale (expired) one.
-
-        Stale = ``expires_at < now``. Ordered by ``attackers.last_seen`` desc
-        so the worker prioritises recent activity on backfill. Both columns
-        are projected so the worker can write keyed on UUID and dispatch
-        provider calls keyed on IP without a second round-trip.
-        """
-        now = datetime.now(timezone.utc)
-        async with self._session() as session:
-            stmt = (
-                select(Attacker.uuid, Attacker.ip)
-                .outerjoin(
-                    AttackerIntel, AttackerIntel.attacker_uuid == Attacker.uuid,
-                )
-                .where(
-                    or_(
-                        AttackerIntel.uuid.is_(None),
-                        AttackerIntel.expires_at < now,
-                    )
-                )
-                .order_by(desc(Attacker.last_seen))
-                .limit(limit)
-            )
-            result = await session.execute(stmt)
-            return [
-                {"uuid": uuid_, "ip": ip}
-                for uuid_, ip in result.all()
-            ]
-
     async def increment_smtp_target(self, attacker_uuid: str, domain: str) -> None:
         """Upsert an (attacker_uuid, domain) pair and bump count + last_seen.