feat(fingerprint): ToS/DSCP/ECN extraction in active + passive TCP fingerprint

Active prober now reads ip.tos from the SYN-ACK and emits tos/dscp/ecn
alongside the existing TTL/window/options fields. dscp is folded into the
fingerprint hash so different DSCP markings produce distinct signatures.

Passive sniffer logs the same three fields on tcp_syn_fingerprint events;
profiler rollup carries them into the attacker tcp_fingerprint snapshot;
AttackerDetail's TCP STACK panel now surfaces DSCP and ECN cells.

decnet/prober/worker.py

@@ -412,6 +412,9 @@ def _tcpfp_phase(
                 sack_ok=str(result["sack_ok"]),
                 timestamp=str(result["timestamp"]),
                 options_order=result["options_order"],
+                tos=str(result["tos"]),
+                dscp=str(result["dscp"]),
+                ecn=str(result["ecn"]),
                 msg=f"TCPFP {ip}:{port} = {result['tcpfp_hash']}",
             )
             logger.info("prober: TCPFP %s:%d = %s", ip, port, result["tcpfp_hash"])