Alert on genuinely new (never-seen-before) devices

New seen_macs table: permanent, insert-only, MAC-keyed record of the
first time each device was ever seen -- deliberately decoupled from
devices.first_seen (IP-keyed, would false-positive on every DHCP
lease change). Bootstrap-safe: first call seeds the baseline from
whatever's currently on the network without alerting on all 71+
existing devices at once. Verified locally: bootstrap call reports
nothing new, repeat calls with the same MACs report nothing new, one
genuinely new MAC gets reported exactly once.

Pushes a Home Assistant persistent_notification when a new MAC
appears (gated behind HOME_ASSISTANT_TOKEN + homeAssistant.url in
hosts.yaml -- missing config just means no push, detection still
runs). Also surfaced directly in the dashboard as a blue "new" badge
for anything first seen in the last 24h, independent of HA config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/config/index.ts

@@ -23,6 +23,10 @@ interface RawDeepCheck {
   username?: string;
 }
 
+interface RawHomeAssistant {
+  url: string;
+}
+
 export interface HostsConfig {
   proxmox: {
     host: string;
@@ -31,6 +35,7 @@ export interface HostsConfig {
   sshHosts?: RawSshHost[];
   knownDevices?: RawKnownDevice[];
   deepCheck?: RawDeepCheck;
+  homeAssistant?: RawHomeAssistant;
 }
 
 export interface AppConfig {
@@ -56,9 +61,15 @@ export interface AppConfig {
   oidc: OidcConfig | undefined;
   deepCheck: DeepCheckHostConfig | undefined;
   fingerbankApiKey: string | undefined;
+  homeAssistant: HomeAssistantConfig | undefined;
   hosts: HostsConfig;
 }
 
+export interface HomeAssistantConfig {
+  url: string;
+  token: string;
+}
+
 export interface DeepCheckHostConfig {
   host: string;
   port: number;
@@ -138,6 +149,10 @@ export function loadConfig(hostsConfigPath: string): AppConfig {
         }
       : undefined,
     fingerbankApiKey: process.env.FINGERBANK_API_KEY,
+    homeAssistant:
+      hosts.homeAssistant && process.env.HOME_ASSISTANT_TOKEN
+        ? { url: hosts.homeAssistant.url, token: process.env.HOME_ASSISTANT_TOKEN }
+        : undefined,
     hosts,
   };
 }