fix: from_attributes=True on Pydantic schemas that share a SQLModel name (#865)
Audit of every Pydantic BaseModel whose name collides with a SQLModel table found 11 candidates missing from_attributes=True. Three endpoints were already 400'ing for this reason (network_connectors, notification, ai_trigger); five more (FlaggedRule, Mailbox, TriggeredAction in sublime; SSOConfig in shuffle; Alert in wazuh_indexer) are intentional name collisions where the Pydantic class receives external-API JSON, not ORM rows — adding the config there is harmless defense-in-depth, not a fix. Same Pydantic 1→2 root cause as PR #864: v1 extracted attributes leniently; v2 requires the explicit `from_attributes=True` ConfigDict flag (the rename of v1's `orm_mode`). Affected files: - network_connectors/schema.py: CustomerNetworkConnectors, NetworkConnectorsSubscription, NetworkConnectorsService, NetworkConnectorsAuthKeys (broken) - incidents/schema/db_operations.py: Notification, AITrigger (broken) - connectors/sublime/schema/alerts.py: FlaggedRule, Mailbox, TriggeredAction (defense-in-depth) - connectors/shuffle/schema/organizations.py: SSOConfig (defense-in-depth) - connectors/wazuh_indexer/schema/alerts.py: Alert (defense-in-depth) Co-authored-by: taylor_socfortress <taylor.walton@socfortress.co> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>