refactor(intel): migrate AttackerIntel JSON-string columns to native SQLAlchemy JSON

Five list columns (greynoise_tags, abuseipdb_categories, threatfox_threat_types,
threatfox_ioc_types, threatfox_malware_families) and four dict columns
(*_raw) are now Column(JSON) with list/dict type annotations and
default_factory=list/dict. Providers return native Python objects; the
application-layer json.dumps/json.loads round-trip and _decode_json_list
helpers are gone. to_intel_event_payload() reads columns directly.

Also caps pytest xdist at -n 4 and excludes tests/api from norecursedirs
to prevent schemathesis workers from OOM-killing the dev loop.

tests/intel/test_feodo.py

@@ -10,7 +10,6 @@ subsequent ``lookup`` calls hit memory. We assert:
 """
 from __future__ import annotations
 
-import json
 
 import httpx
 import pytest
@@ -56,8 +55,7 @@ async def test_listed_ip_yields_malicious_verdict():
     result = await provider.lookup("9.9.9.9")
     assert result.verdict == "malicious"
     assert result.column_updates["feodo_listed"] is True
-    raw = json.loads(result.column_updates["feodo_raw"])
-    assert raw["malware"] == "TrickBot"
+    assert result.column_updates["feodo_raw"]["malware"] == "TrickBot"
     assert len(captured) == 1