Define analyst user model

terminology/USER_MODEL.md

@@ -0,0 +1,12 @@
+Primary user: Cyber analyst
+
+Assumptions:
+- Technically competent
+- Time-constrained
+- Prefers density over whitespace
+- Values consistency over novelty
+
+Mental model:
+- Scan → filter → prioritize → act
+- Severity drives attention
+- Confidence drives trust