feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

tests/web/test_api_export_attacker_misp.py

@@ -112,6 +112,7 @@ def _mock_repo(*, attacker=None, intel=None, rollup=None, tags=None,
     m.get_attacker_artifacts = AsyncMock(return_value=artifacts or [])
     m.list_smtp_targets = AsyncMock(return_value=smtp or [])
     m.list_attacker_commands_deduped = AsyncMock(return_value=commands or [])
+    m.list_observations_by_attacker = AsyncMock(return_value=[])
     return m
 
 

tests/web/test_api_export_attacker_stix.py

@@ -128,6 +128,7 @@ def _mock_repo(*, attacker=None, identity=None, intel=None,
     m.get_attacker_artifacts = AsyncMock(return_value=artifacts or [])
     m.list_smtp_targets = AsyncMock(return_value=smtp or [])
     m.list_attacker_commands_deduped = AsyncMock(return_value=commands or [])
+    m.list_observations_by_attacker = AsyncMock(return_value=[])
     return m
 
 

tests/web/test_api_export_attackers_misp.py

@@ -51,6 +51,7 @@ def _mock_repo(*, rows=None, ttp_by_attacker=None):
     m = type("M", (), {})()
     m.get_all_attackers_for_export = AsyncMock(return_value=rows or [])
     m.get_all_ttp_rollups_for_export = AsyncMock(return_value=ttp_by_attacker or {})
+    m.get_all_observations_for_export = AsyncMock(return_value={})
     return m
 
 

tests/web/test_api_export_attackers_stix.py

@@ -52,6 +52,7 @@ def _mock_repo(*, rows=None, ttp_by_attacker=None):
     m = type("M", (), {})()
     m.get_all_attackers_for_export = AsyncMock(return_value=rows or [])
     m.get_all_ttp_rollups_for_export = AsyncMock(return_value=ttp_by_attacker or {})
+    m.get_all_observations_for_export = AsyncMock(return_value={})
     return m