Normalize attack_type to lowercase in record_event

Ensures consistent casing for attack type labels stored in the
threat database by applying .lower() on input.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

threat_db.py

@@ -112,6 +112,7 @@ def _update_known_threat(cursor, ip, attack_type, now):
 
 def record_event(ip, attack_type, source, severity=None, evidence=None):
     """Insert an abuse event and update the known_threats profile for the IP."""
+    attack_type = attack_type.lower()
     now = datetime.utcnow()
     with _get_connection() as conn:
         cursor = conn.cursor()