feat: manual threat authoring and editing

[Hacks4Snacks]

feat: manual threat authoring and editing

Up to now the tmforge-json overlay could say exactly one thing about a threat: "I accept the risk." Every threat came from a rule, and the only author-owned bit we round-tripped was acceptance. If you actually understood your system and wanted to record a threat the rules don't know about or fix the wording, priority, or mitigation on one they do there was nowhere to put it.

The model is unchanged in spirit: the register stays a regenerable projection of the rules. We do not serialize the whole register to the wire. Instead we widen the existing sparse overlay so it carries two new kinds of author intent besides acceptance:

1. edits to a rule-generated threat (state, priority, title,
   description, mitigation, justification), and
2. fully hand-authored threats that no rule produced.

A manual threat is an overlay entry keyed manual:{guid} with no TypeId. On read we materialize it into the register; on generate we append it; on export we regenerate the rules and re-apply the overlay on top.