fix(attack): keep mobile/ICS techniques and their tactics, fix TLP and IOC parsing

[nkbeast]

Three independent fixes, each with regression tests.

1. Mobile/ICS ATT&CK techniques were silently dropped (src/lib/attack/stix.ts)

The mobile and ICS bundles shipped by MITRE use their own STIX source and kill-chain names (mitre-mobile-attack, mitre-ics-attack) instead of the enterprise mitre-attack. Two spots in stix.ts only matched mitre-attack:

• attackId() returned null for every mobile/ICS technique, so parseBundle skipped them entirely (if (!id) continue) — the whole MOBILE and ICS domains parsed to empty.
• The tactics kill-chain filter emptied tactics for those domains, so even the matrix view had no columns.

Both now accept all three MITRE domain names via a shared MITRE_SOURCE_NAMES set.

2. AMBER_STRICT exported to STIX as AMBER (src/lib/export/formats.ts)

TLP_TO_STIX_MARKING["AMBER_STRICT"] pointed at AMBER's marking (marking-definition--f88d31f6-…) instead of the OASIS TLP 2.0 AMBER+STRICT marking (marking-definition--939a9414-2ddd-4d32-a0cd-375ea402b003). STIX consumers therefore saw the stricter label downgraded to AMBER. Fixed the mapping.

3. IOC bulk parsing truncated URLs containing commas (src/lib/ioc/normalize.ts, src/lib/ioc/extract.ts)

parseBulk split on any comma (/[\t;,]+|\s{2,}/), so https://evil.com/a,b was parsed as the truncated URL https://evil.com/a plus an unparsed b — despite the code comment saying commas inside URLs must not split. The single-value path parseIndicator handles the same input correctly. Commas are now only treated as separators when whitespace follows them, in both parseBulk and the client-side extractIocs (so server and preview agree). The existing "does not split a URL containing a comma" test never actually contained a comma; it now does.

Tests

• attackId reads mitre-mobile-attack / mitre-ics-attack references
• parseBundle keeps tactics from mobile/ICS kill chains
• STIX export marks AMBER_STRICT with the AMBER+STRICT marking, distinct from AMBER
• parseBulk keeps a URL with a comma intact (full value asserted)

Verification

• vitest run — 179 passed (12 files)
• tsc --noEmit — clean
• eslint — 0 errors (3 pre-existing warnings in src/lib/sigma/generate.ts)

[SkxOverKill]

Hi @nkbeast, Thanks a good find will go ahead and merge it