fix: 'New' badge flagged the entire existing device population

Deployed the new-device feature, checked the live API response
instead of assuming the earlier unit test covered it, and found 65/71
devices marked isNew: true. The notification path was correctly
bootstrap-safe (verified separately), but the UI's isNew check just
tested "first_ever_seen within 24h" with no bootstrap awareness --
and bootstrap timestamps are, correctly, "now", so the whole existing
population qualified on day one.

Added seen_macs.is_bootstrap, set on the seeding call and excluded
from isNew. Migration backfills is_bootstrap=1 for any seen_macs rows
that already existed before this column did (the already-deployed
CT122 instance) -- verified locally against both a fresh DB and a
simulated pre-migration table.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/routes/devices.ts

@@ -37,6 +37,11 @@ function isRecent(isoTimestamp: string | null, hours: number): boolean {
 
 function toApiDevice(r: DeviceRow) {
   const name = r.manual_label ?? r.known_name ?? null;
+  // is_bootstrap excludes devices that were only ever "new" because this
+  // feature had just been turned on, not because they actually just
+  // appeared -- otherwise the whole pre-existing device population shows as
+  // "new" for 24h after every fresh deploy of this feature.
+  const isNew = r.is_bootstrap === 0 && isRecent(r.first_ever_seen, NEW_DEVICE_WINDOW_HOURS);
   return {
     ip: r.ip,
     mac: r.mac,
@@ -44,7 +49,7 @@ function toApiDevice(r: DeviceRow) {
     known: r.manual_label !== null || r.known_name !== null,
     vendor: getVendor(r.mac),
     mdnsHostname: r.mdns_hostname,
-    isNew: isRecent(r.first_ever_seen, NEW_DEVICE_WINDOW_HOURS),
+    isNew,
     firstSeen: r.first_seen,
     lastSeen: r.last_seen,
   };