feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

decnet/web/router/attackers/api_export_attacker_misp.py

@@ -65,6 +65,7 @@ async def api_export_attacker_misp(
         repo.get_attacker_artifacts(uuid),
         repo.list_smtp_targets(uuid),
         repo.list_attacker_commands_deduped(uuid),
+        repo.list_observations_by_attacker(uuid),
     )
     behavior = cast(dict[str, Any] | None, results[0])
     identity = cast(dict[str, Any] | None, results[1])
@@ -74,6 +75,7 @@ async def api_export_attacker_misp(
     artifacts = cast(list[dict[str, Any]], results[5])
     smtp_targets = cast(list[dict[str, Any]], results[6])
     commands = cast(list[str], results[7])
+    observations = cast(list[dict[str, Any]], results[8])
 
     event = build_attacker_misp_event(
         attacker=attacker,
@@ -88,6 +90,7 @@ async def api_export_attacker_misp(
         artifacts=artifacts,
         smtp_targets=smtp_targets,
         commands=commands,
+        observations=observations,
     )
     return Response(
         content=json.dumps(event, default=str),