The gunman who killed nine in Munich had planned his attack for a year and appeared to have bought his gun on the "dark net", German officials say.