feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

decnet/web/db/repository.py

@@ -365,6 +365,35 @@ class BaseRepository(ABC):
         """
         raise NotImplementedError
 
+    @abstractmethod
+    async def list_observations_by_attacker(
+        self, attacker_uuid: str,
+    ) -> list[dict[str, Any]]:
+        """All BEHAVE-SHELL observations for *attacker_uuid*, ordered by
+        ``window_end_ts`` ASC, shaped as BEHAVE envelope dicts.
+
+        Each dict carries: ``primitive``, ``value``, ``confidence``,
+        ``window`` (``{start_ts, end_ts}``), ``source``, ``evidence_ref``,
+        and (when present) ``identity_ref``.
+
+        Empty list when the attacker has no observations. Used by the STIX
+        export to populate ``XDecnetBehaveProfile.observations``.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    async def get_all_observations_for_export(
+        self,
+    ) -> dict[str, list[dict[str, Any]]]:
+        """Return ``{attacker_uuid: [observation_envelope, ...]}`` for all
+        attackers that have BEHAVE observations.
+
+        Used by the fleet STIX export to attach per-attacker observation
+        streams without N+1 queries. Same envelope shape as
+        ``list_observations_by_attacker``.
+        """
+        raise NotImplementedError
+
     async def upsert_observed_attachment(
         self,
         *,