feat: login anomaly detection & suspicious activity alerts (#124)

[alexchenai]

Summary

Implements login anomaly detection system with real-time threat analysis and alert management.

Features

• Brute force detection: 5+ failed logins in 1 hour triggers high-severity alert
• New IP detection: first-time IP flagged as medium severity
• Impossible travel: two different countries within 60 min triggers critical alert
• Unusual time detection: logins between 1-5 AM flagged as low severity
• Device/platform change detection
• Trusted IP allowlist to reduce false positives
• Full alert lifecycle: create, list active, dismiss

API Endpoints

• GET /api/security/login-events — list recent login events
• POST /api/security/login-events — record event, get anomaly analysis
• GET /api/security/alerts — get active security alerts
• POST /api/security/alerts/{id}/dismiss — dismiss an alert
• GET /api/security/trusted-ips — list trusted IPs
• POST /api/security/trusted-ips — add trusted IP

Tests

7 tests covering brute force, new IP, impossible travel, unusual time, trusted IP bypass, and alert dismiss.

Closes #124