Add Phase 2 intel modules — 9 intelligence modules for on-device analysis

- credential_db: Central credential store with dedup, hashcat/CSV/JSON export, crack tracking
- topology_mapper: Network graph from HOST_DISCOVERED/VLAN_DETECTED events, Graphviz DOT/SVG output
- net_intel: Beacon detection (stddev/mean analysis), comm graph, DNS tunneling, service deps
- user_timeline: Per-user activity timelines, work hours, admin/service account identification
- supply_chain_detect: Passive detection of PyPI/npm mirrors, WSUS, CI/CD, SCCM, container registries
- change_detector: Continuous baseline diff for burn detection, scan/security tool alerts
- security_posture: EDR/SIEM/NAC/honeypot/scanner detection by DNS/port/UA, risk gating
- operator_audit: Append-only HMAC chain audit log for engagement deconfliction
- tool_output_parser: Unified parser for bettercap events, Responder logs, mitmproxy flows

modules/intel/__init__.py

@@ -0,0 +1,23 @@
+"""BigBrother intelligence modules — on-device analysis and data aggregation."""
+
+from modules.intel.credential_db import CredentialDB
+from modules.intel.topology_mapper import TopologyMapper
+from modules.intel.net_intel import NetIntel
+from modules.intel.user_timeline import UserTimeline
+from modules.intel.supply_chain_detect import SupplyChainDetect
+from modules.intel.change_detector import ChangeDetector
+from modules.intel.security_posture import SecurityPosture
+from modules.intel.operator_audit import OperatorAudit
+from modules.intel.tool_output_parser import ToolOutputParser
+
+__all__ = [
+    "CredentialDB",
+    "TopologyMapper",
+    "NetIntel",
+    "UserTimeline",
+    "SupplyChainDetect",
+    "ChangeDetector",
+    "SecurityPosture",
+    "OperatorAudit",
+    "ToolOutputParser",
+]