feat(security): login anomaly detection & suspicious activity alerts

[lalalic]

Login Anomaly Detection & Suspicious Activity Alerts

Implements issue #124 — real-time login anomaly detection with risk scoring and automated security alerts.

Features

• Multi-signal risk scoring — new IP (0.3), new device (0.25), unusual time (0.15), rapid attempts (0.4), failed streaks (0.5)
• Automatic alert generation — security alerts created when risk >= 0.5
• Alert management — acknowledge individual or bulk, filterable by status
• Login history — full event log with device/location metadata, filterable by type
• Statistics dashboard — login counts, unique IPs/devices, risk distribution

Implementation

Component	Details
Migration	032_login_anomaly.sql — login_events + security_alerts tables
Models	LoginEvent + SecurityAlert
Service	login_anomaly.py — risk analysis, event recording, alert lifecycle, stats
Routes	6 endpoints under /security/*
Tests	37 passing tests
Docs	docs/login-anomaly.md

API Endpoints

Method	Endpoint	Description
POST	/security/record	Record login event with anomaly check
GET	/security/history	Login event history
GET	/security/alerts	Security alerts
POST	/security/alerts/:id/acknowledge	Acknowledge alert
POST	/security/alerts/acknowledge-all	Bulk acknowledge
GET	/security/stats	Login statistics

Stats

• 1,206 lines added across 9 files
• 37 tests — all passing
• Zero external dependencies added

Closes #124