Strengthen intelligence data model and RAG ingestion

[anpa1200]

What changed

• adds canonical intelligence tags and provenance-backed cross-entity relationships
• promotes report-derived IOCs into the normalized IOC store
• links asset assessments to assets, CVE candidates, tags, and scanner evidence
• queues source-scoped RAG reconciliation immediately after ingestion
• adds an idempotent historical tag/link backfill
• extends startup and self-test integrity validation

Why

IOC, CVE, report, and scan ingestion previously used partially independent structures. Report IOCs could remain embedded in JSON, canonical tags were not first-class relationships, and RAG updates depended on the periodic reconciliation interval.

Validation

• full backend suite: 754 passed, 10 skipped
• focused ingestion/RAG suite: 77 passed
• final integrity/RAG suites: 29 passed and 24 passed
• live backfill: 0 untagged IOC/CVE/report records and 0 structural tag errors
• live RAG reconciliation: 122,262 documents seen and 118,502 updated