refactor(intel): migrate AttackerIntel JSON-string columns to native SQLAlchemy JSON

Five list columns (greynoise_tags, abuseipdb_categories, threatfox_threat_types,
threatfox_ioc_types, threatfox_malware_families) and four dict columns
(*_raw) are now Column(JSON) with list/dict type annotations and
default_factory=list/dict. Providers return native Python objects; the
application-layer json.dumps/json.loads round-trip and _decode_json_list
helpers are gone. to_intel_event_payload() reads columns directly.

Also caps pytest xdist at -n 4 and excludes tests/api from norecursedirs
to prevent schemathesis workers from OOM-killing the dev loop.

tests/intel/test_attacker_intel_repo.py

@@ -77,7 +77,7 @@ async def test_partial_provider_update_preserves_others(repo):
         _intel_payload(
             attacker_uuid=a_uuid, ip="9.9.9.9",
             greynoise_classification="malicious",
-            greynoise_raw='{"classification":"malicious"}',
+            greynoise_raw={"classification": "malicious"},
             greynoise_queried_at=datetime.now(timezone.utc),
         )
     )
@@ -87,7 +87,7 @@ async def test_partial_provider_update_preserves_others(repo):
         _intel_payload(
             attacker_uuid=a_uuid, ip="9.9.9.9",
             abuseipdb_score=85,
-            abuseipdb_raw='{"abuseConfidenceScore":85}',
+            abuseipdb_raw={"abuseConfidenceScore": 85},
             abuseipdb_queried_at=datetime.now(timezone.utc),
         )
     )