refactor(intel): migrate AttackerIntel JSON-string columns to native SQLAlchemy JSON

Five list columns (greynoise_tags, abuseipdb_categories, threatfox_threat_types,
threatfox_ioc_types, threatfox_malware_families) and four dict columns
(*_raw) are now Column(JSON) with list/dict type annotations and
default_factory=list/dict. Providers return native Python objects; the
application-layer json.dumps/json.loads round-trip and _decode_json_list
helpers are gone. to_intel_event_payload() reads columns directly.

Also caps pytest xdist at -n 4 and excludes tests/api from norecursedirs
to prevent schemathesis workers from OOM-killing the dev loop.

tests/intel/test_abuseipdb.py

@@ -1,7 +1,6 @@
 """Unit tests for the AbuseIPDB provider."""
 from __future__ import annotations
 
-import json
 
 import httpx
 import pytest
@@ -71,8 +70,7 @@ async def test_high_score_maps_to_malicious(monkeypatch):
     result = await provider.lookup("1.2.3.4")
     assert result.verdict == "malicious"
     assert result.column_updates["abuseipdb_score"] == 92
-    raw = json.loads(result.column_updates["abuseipdb_raw"])
-    assert raw["countryCode"] == "RU"
+    assert result.column_updates["abuseipdb_raw"]["countryCode"] == "RU"
     # Key header sent, query params correct.
     req = captured[0]
     assert req.headers["key"] == "k3y"
@@ -120,8 +118,7 @@ async def test_categories_flattened_from_reports(monkeypatch):
     _install_transport(handler)
     provider = AbuseIPDBProvider()
     result = await provider.lookup("1.2.3.4")
-    cats = json.loads(result.column_updates["abuseipdb_categories"])
-    assert cats == [14, 18, 21, 22]
+    assert result.column_updates["abuseipdb_categories"] == [14, 18, 21, 22]
 
 
 @pytest.mark.anyio
@@ -136,7 +133,7 @@ async def test_categories_empty_when_no_reports(monkeypatch):
     _install_transport(handler)
     provider = AbuseIPDBProvider()
     result = await provider.lookup("8.8.8.8")
-    assert json.loads(result.column_updates["abuseipdb_categories"]) == []
+    assert result.column_updates["abuseipdb_categories"] == []
 
 
 @pytest.mark.anyio