feat: add login anomaly detection and suspicious activity alerts (closes #124)

[technologicsingularity]

Summary

• What changed: Added login anomaly detection with brute-force protection, unusual hour alerts, login event history, and expanded audit logging
• Why: Implements bounty issue Login anomaly detection & suspicious activity alerts #124 — Login anomaly detection & suspicious activity alerts

What's included

New service: app/services/security.py

Feature	Detail
Brute-force protection	Block IP after 5 failed attempts (Redis, 10-min TTL) → HTTP 429
Login event tracking	Store last 10 logins per user in Redis (30-day TTL) with IP + timestamp
Unusual hour detection	Alert on logins 01:00–05:00 UTC via security_alert field
Audit logging	login_success, login_failed, brute_force_blocked written to AuditLog

Modified: POST /auth/login

1. is_brute_force(ip, email)? → 429 {"error": "too_many_attempts"}
2. Bad credentials? → record_failed_login() + AuditLog → 401
3. Success → reset_failure_count() + store_login_event() + AuditLog
4. Unusual hour? → append "security_alert" to response JSON

New endpoint: GET /auth/security-events

JWT-protected. Returns last 10 login events for the authenticated user:

{
  "events": [
    {"ip": "192.168.1.1", "hour": 14, "timestamp": "2026-02-20T14:32:00+00:00"}
  ]
}

Modified: app/models.py

• Added ip_address (String 45) and details (Text) columns to AuditLog for richer security event tracking

Example: Login with security alert

{
  "access_token": "...",
  "refresh_token": "...",
  "security_alert": "Login detected at unusual hour (02:34 UTC)"
}

Validation

• Backend tests: 27 new tests, all 52 tests passing (./scripts/test-backend.sh)
• No regressions in existing test suite
• Covers: 401 bad creds, 400 missing fields, 429 brute force, counter reset, Redis TTL, unusual hour alert, security-events endpoint, audit log entries

Security and Ownership

• PR opened from a fork (not direct push to main)

Checklist

• No secrets added
• No unrelated files changed
• Production ready — all security functions handle Redis/DB errors gracefully

[rohitdash08]

@technologicsingularity, can you please share your discord or connect me over discord to discuss this further?