v0.18.0

Added

• MITRE ATT&CK Navigator layer export — JSON layer, techniques colored by severity, drops into the Navigator (closes #43).
• STIX 2.1 bundle export — report + IOC indicators + ATT&CK + malware/identities with indicates links; deterministic ids, no library; drops into any TIP (closes #45).
• Email / .eml / .msg import — deterministic phishing/BEC importer: event at the message's Date:, severity from SPF/DKIM/DMARC + spoof heuristics, IOCs harvested (T1566) (closes #44).
• Adversary group hints — known ATT&CK groups ranked by technique overlap (offline, not attribution); sub-technique-aware (exact matches weighted + highlighted); dashboard panel + report §4.6.1 (closes #46).