feat(web): drop SessionProfile, wire observations into AttackerDetail (DEBT-050 / DEBT-036 closure)

Destructive half of BEHAVE-INTEGRATION.md Phase 1. SessionProfile +
its kd_* columns + the dialect ALTER TABLE migration helpers are
deleted outright; pre-v1, the table shipped empty, no migration
ceremony required (per the no-new-_migrate_-pre-v1 memory rule).
DEBT-036 closes via DEBT-050 supersedure. AttackerDetail's
``observations`` field is wired to the new ``observations`` table
and returns an empty list until the BEHAVE-SHELL extractor (DEBT-050
Phase 2) starts emitting.

decnet/web/db/models/attackers.py — SessionProfile class deleted
(~135 lines), KD_PAUSE_*/KD_START_OF_ACTION_IDLE_S module constants
deleted, module docstring updated to point at the observations
table. AttackerIdentity.kd_digraph_simhash is KEPT — it's the v2
federation centroid hook, not a SessionProfile field; docstring
repointed to the BEHAVE primitive that will populate it.

decnet/web/db/sqlmodel_repo/attackers/sessions.py — DELETED.
SessionProfilesMixin dropped from the AttackersMixin MRO.

decnet/web/db/repository.py — abstract upsert_session_profile +
get_session_profile removed.

decnet/web/db/sqlite/repository.py + mysql/repository.py —
_migrate_session_profile_table helpers and their initialize() calls
removed. mysql initialize() now goes attackers → column_types →
admin (no session_profile step).

decnet/web/db/models/__init__.py — SessionProfile re-export gone.

decnet/web/db/models/attacker_intel.py — docstring cross-reference
to SessionProfile.schema_version retargeted to AttackerIdentity.

decnet/web/router/attackers/api_get_attacker_detail.py — adds
``observations: []`` to the response by calling
``repo.latest_observation_per_primitive(uuid)`` and projecting to a
list sorted by primitive path. Empty until the extractor lands;
shape matches BEHAVE-INTEGRATION.md §"AttackerDetail consumer".

tests/profiler/test_session_profile.py — DELETED (56 lines).
tests/db/test_base_repo.py — DummyRepo loses upsert_session_profile
and get_session_profile overrides.
tests/db/mysql/test_mysql_migration.py — initialize-call-order
assertion updated; session_profile step removed from the expected
sequence; docstring records why.
tests/ttp/test_lifter_absence.py — docstring "no SessionProfile" →
"no ObservationRow".

decnet/web/db/mysql/repository.py

@@ -97,35 +97,6 @@ class MySQLRepository(SQLModelRepository):
                         f"ALTER TABLE `{table_name}` MODIFY COLUMN `{col_name}` {spec}"
                     ))
 
-    async def _migrate_session_profile_table(self) -> None:
-        """Add DEBT-036 keystroke-dynamics columns (start-of-action latency,
-        three-bucket pause histogram, top-bigrams JSON) to existing tables.
-
-        MySQL's ``ALTER TABLE ADD COLUMN`` fails if the column already
-        exists, so gate on ``information_schema.COLUMNS`` to stay
-        idempotent.
-        """
-        async with self.engine.begin() as conn:
-            rows = (await conn.execute(text(
-                "SELECT COLUMN_NAME FROM information_schema.COLUMNS "
-                "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'session_profile'"
-            ))).fetchall()
-            if not rows:
-                return
-            existing_cols = {r[0] for r in rows}
-            additions = [
-                ("kd_top_bigrams", "TEXT NULL"),
-                ("kd_start_of_action_latency", "DOUBLE NULL"),
-                ("kd_pause_hist_burst", "INT NULL"),
-                ("kd_pause_hist_think", "INT NULL"),
-                ("kd_pause_hist_distracted", "INT NULL"),
-            ]
-            for col_name, col_spec in additions:
-                if col_name not in existing_cols:
-                    await conn.execute(text(
-                        f"ALTER TABLE session_profile ADD COLUMN {col_name} {col_spec}"
-                    ))
-
     async def initialize(self) -> None:
         """Create tables and run all MySQL-specific migrations.
 
@@ -138,7 +109,6 @@ class MySQLRepository(SQLModelRepository):
             await lock_conn.execute(text("SELECT GET_LOCK('decnet_schema_init', 30)"))
             try:
                 await self._migrate_attackers_table()
-                await self._migrate_session_profile_table()
                 await self._migrate_column_types()
                 async with self.engine.begin() as conn:
                     await conn.run_sync(SQLModel.metadata.create_all)