Alert on genuinely new (never-seen-before) devices

New seen_macs table: permanent, insert-only, MAC-keyed record of the
first time each device was ever seen -- deliberately decoupled from
devices.first_seen (IP-keyed, would false-positive on every DHCP
lease change). Bootstrap-safe: first call seeds the baseline from
whatever's currently on the network without alerting on all 71+
existing devices at once. Verified locally: bootstrap call reports
nothing new, repeat calls with the same MACs report nothing new, one
genuinely new MAC gets reported exactly once.

Pushes a Home Assistant persistent_notification when a new MAC
appears (gated behind HOME_ASSISTANT_TOKEN + homeAssistant.url in
hosts.yaml -- missing config just means no push, detection still
runs). Also surfaced directly in the dashboard as a blue "new" badge
for anything first seen in the last 24h, independent of HA config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/routes/devices.ts

@@ -27,6 +27,14 @@ async function requireAuth(req: FastifyRequest, reply: FastifyReply) {
 // config/hosts.yaml known list, then the passively-resolved mDNS hostname —
 // which is informational only and does NOT make a device "known" on its own,
 // since nobody has actually vetted it yet.
+const NEW_DEVICE_WINDOW_HOURS = 24;
+
+function isRecent(isoTimestamp: string | null, hours: number): boolean {
+  if (!isoTimestamp) return false;
+  const seenAt = new Date(isoTimestamp.replace(" ", "T") + "Z").getTime();
+  return Date.now() - seenAt < hours * 60 * 60 * 1000;
+}
+
 function toApiDevice(r: DeviceRow) {
   const name = r.manual_label ?? r.known_name ?? null;
   return {
@@ -36,6 +44,7 @@ function toApiDevice(r: DeviceRow) {
     known: r.manual_label !== null || r.known_name !== null,
     vendor: getVendor(r.mac),
     mdnsHostname: r.mdns_hostname,
+    isNew: isRecent(r.first_ever_seen, NEW_DEVICE_WINDOW_HOURS),
     firstSeen: r.first_seen,
     lastSeen: r.last_seen,
   };