feat: add login anomaly detection alerts

[helh1723-lang]

Summary

• record login attempts with IP, user agent, success status, and anomaly reason
• flag suspicious logins for new IP/device and repeated failed attempts
• expose /auth/security-events and show a security alert toast on login
• document the API changes and add backend/frontend tests

Fixes #124

Validation

• python -m py_compile packages/backend/app/models.py packages/backend/app/routes/auth.py packages/backend/app/init.py packages/backend/tests/test_auth.py
• git diff --check
• Full pytest/jest not run locally because pytest, black, and jest are not installed in this environment

Security and Ownership

• PR opened from a fork
• No secrets added
• No unrelated files changed

[helh1723-lang]

/claim #124