Release 1.2.0

• Alerts → STIX: StreamingAlertsResponse.to_stix(settings) resolves each alert's target, maps it, and wraps it in an Incident (alert / data-breach) with watcher labels + portal reference. Needs api_client; toggle with alerts_create_incident.
• New mappers (standalone or via alerts): forum posts, private messages, chat messages, data-leak-site posts, credentials & occurrences, credential sets, malware events, malware families.
• Generated descriptions (defanged links/emails/domains) and verity471:* type labels for filtering.
• Sender/recipient distinguished on PMs; first_seen/last_seen on malware, C2 infra, and incidents.