new-device login notification emails with known-fingerprint suppression

[jaspermayone]

Why

Users should hear about logins from unfamiliar devices — without notification fatigue from their own devices.

What

• after_create_commit on User::Session: send a new-login email unless (a) it's the account's first session, or (b) the device fingerprint was seen on a session within the last 6 months.
• Weave already captures fingerprint, device/os info, IP, and geocoded location on user_sessions — the email should include device + approximate location + a link to the existing session-revocation UI (/profile/sessions).

Reference

• https://github.com/hackclub/auth/blob/main/app/models/identity_session.rb (suppression logic in the after_create hook)