refactor(intel): migrate AttackerIntel JSON-string columns to native SQLAlchemy JSON

Five list columns (greynoise_tags, abuseipdb_categories, threatfox_threat_types,
threatfox_ioc_types, threatfox_malware_families) and four dict columns
(*_raw) are now Column(JSON) with list/dict type annotations and
default_factory=list/dict. Providers return native Python objects; the
application-layer json.dumps/json.loads round-trip and _decode_json_list
helpers are gone. to_intel_event_payload() reads columns directly.

Also caps pytest xdist at -n 4 and excludes tests/api from norecursedirs
to prevent schemathesis workers from OOM-killing the dev loop.

pyproject.toml

@@ -117,13 +117,14 @@ decnet = "decnet.cli:app"
 asyncio_mode = "auto"
 asyncio_debug = "true"
 asyncio_default_fixture_loop_scope = "module"
-addopts = "-v -q -x -n logical --dist load"
+addopts = "-v -q -x -n 4 --dist load"
 norecursedirs = [
     "tests/live",
     "tests/stress",
     "tests/service_testing",
     "tests/docker",
     "tests/perf",
+    "tests/api",
     "__pycache__",
     ".git",
     "node_modules",