Expand MITRE coverage for database & HTTP-client tools

[blitzcrieg1]

core/audit/mitre.py maps common file/shell tools, but many agents call DB clients (psql, mysql, mongosh) and HTTP libraries that currently fall through unmapped.

Task

Add entries to _TOOL_MAP in mitre.py: database query tools -> Collection (TA0009 / T1005), and additional network/HTTP client names -> Command and Control (TA0011 / T1071.001). Keys are folded with _norm(), so add the plain method name.

Acceptance criteria

• New cases in apps/orchestrator/tests/test_mitre_dlp.py asserting the mapped technique ids.
• Do not map genuinely benign tools (no false positives).
• ruff + pytest green.