Alert and log when a new client is seen for the first time #1323

Reported via #1322: a device with a DHCP reservation (known hostname, never seen by netpulse before) joined the network and was silently added to the client list. No log entry, no banner, no notification.

Current behavior: the only client-join alert is "unknown device", which fires only for nameless clients (no DHCP hostname, Name == MAC) that stay nameless for a few poll ticks (#234). A device that resolves a hostname on the first tick is never "unknown", so a named-but-new client alerts nothing.

Missing piece: a "new client" signal based on first sight, independent of name resolution.

• emit a clients-category alert (urgent, so it also pushes) when a MAC is inserted into device_seen for the first time (first_seen written), carrying name/IP/router/attachment when known
• guard the startup avalanche: the first poll cycle after server start must not alert for everything already online (same pattern as seenOnlineMacs in trackUnknownDevices)
• define deletion semantics: feat(devices): indefinite client retention with delete #1172 removes the device_seen row on client delete; decide whether the same MAC re-alerting later is desired or "deleted clients stay deleted" (fix(clients): deleted clients stay deleted; fleet MACs purged; sane IPs #1290) applies
• keep "unknown device" as the nameless variant; both already share the intake flow in the UI (DismissUnknownDevice marks the MAC as alerted)

Longer term: per-type alert configurability (which types push, which are silent) can be its own issue if there is demand.