Alert on genuinely new (never-seen-before) devices

New seen_macs table: permanent, insert-only, MAC-keyed record of the
first time each device was ever seen -- deliberately decoupled from
devices.first_seen (IP-keyed, would false-positive on every DHCP
lease change). Bootstrap-safe: first call seeds the baseline from
whatever's currently on the network without alerting on all 71+
existing devices at once. Verified locally: bootstrap call reports
nothing new, repeat calls with the same MACs report nothing new, one
genuinely new MAC gets reported exactly once.

Pushes a Home Assistant persistent_notification when a new MAC
appears (gated behind HOME_ASSISTANT_TOKEN + homeAssistant.url in
hosts.yaml -- missing config just means no push, detection still
runs). Also surfaced directly in the dashboard as a blue "new" badge
for anything first seen in the last 24h, independent of HA config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -51,3 +51,10 @@ SSH_PRIVATE_KEY_PATH=./ssh/monitor_ed25519
 # only reaches manufacturer-level confidence, same as the free OUI lookup — see
 # docs/device-discovery.md. Omit entirely to skip this enrichment.
 FINGERBANK_API_KEY=
+
+# Optional. Long-lived access token from Home Assistant (Profile > Security >
+# Long-Lived Access Tokens). When set (with homeAssistant.url in
+# config/hosts.yaml), pushes a persistent_notification whenever a MAC address
+# is seen on the network for the very first time -- see docs/device-discovery.md.
+# Detection runs either way; this only gates whether you get pushed a notification.
+HOME_ASSISTANT_TOKEN=