feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch

The 2026-05-02 ship-time audit of the R0054-R0058 intel rule pack found
that AbuseIPDB / GreyNoise / ThreatFox stored only the aggregate verdict
(score / classification / listed-bool) plus the raw response blob. The
TTP IntelLifter expects per-provider taxonomy fields (categories, tags,
threat_types) that were never populated, so R0054 / R0055 / R0057
emitted zero tags in production despite passing unit tests.

Add typed columns: abuseipdb_categories, greynoise_tags, greynoise_name,
feodo_malware_family, threatfox_threat_types, threatfox_ioc_types,
threatfox_malware_families. Each provider now parses the relevant
taxonomy out of the upstream response and writes it through
column_updates. JSON-list columns ride as TEXT with default "[]" to
keep the SQLite/MySQL backend split honest, deserialised back to native
lists by the repo on read.

decnet/web/db/sqlmodel_repo/attacker_intel.py

@@ -58,11 +58,19 @@ class AttackerIntelMixin(_MixinBase):
             if not row:
                 return None
             d = row.model_dump(mode="json")
+            # Two passes: ``*_raw`` columns hold provider response blobs
+            # (objects); the per-provider taxonomy columns hold JSON
+            # arrays the IntelLifter consumes as native lists.
             for key in (
                 "greynoise_raw",
                 "abuseipdb_raw",
                 "feodo_raw",
                 "threatfox_raw",
+                "greynoise_tags",
+                "abuseipdb_categories",
+                "threatfox_threat_types",
+                "threatfox_ioc_types",
+                "threatfox_malware_families",
             ):
                 raw = d.get(key)
                 if isinstance(raw, str):