feat(ja3-ja4-tls-fingerprinting): M8 SQLite intel store + M9 detection engine
M8: tlsfp-intel crate with seeded fingerprint DB, JA4 fuzzy matcher, prevalence scoring.
M9: six detection rules (known_bad, ua_mismatch, os_mismatch, first_seen, fp_rotation, monoculture) over an observation/alert store (migration v2); --detect on pcap/live plus an intel alerts feed; user_agent plumbed through StreamEvent::HttpRequest.
M10 scaffolding: cybercore frontend, compose/infra/install groundwork (serve not yet wired).
Relicense MIT -> AGPL-3.0; ignore env/node_modules/dist; exclude seed CSVs from whitespace hooks.
1bb94b08eb