New-login security alerts ("we noticed a new login to your account").

On every login (PhoenixKitWeb.Users.Auth.log_in_user/3), the request's (ip_address, user_agent_hash) pair is checked against PhoenixKit.Users.Auth.KnownDevice rows for that user. An unrecognized pair is a new device: it's persisted, a user.new_login_detected activity entry is logged, and — when new_login_alert_enabled is on — an email goes out via PhoenixKit.Users.Auth.UserNotifier.deliver_new_login_alert/2.

A recognized pair just bumps last_seen_at — no alert, no email.

Sends synchronously (matching every other PhoenixKit auth email — confirmation, password reset, magic link — none of which are queued through Oban): a "new device" login is inherently rare per user (every subsequent login from the same device is silent), so the odd extra round-trip on a first-time login doesn't justify background-job infrastructure this feature would otherwise be the only user of. A send failure is logged and swallowed — it must never block sign-in.