feat(alerts): SSID impostor detection from existing neighbor scans

[gnacho]

Request (#1358)

NetPulse already collects neighbor scans per radio (SSID + BSSID + channel + signal) and already knows its own fleet BSSIDs. That is enough for a high-value security alert with zero new collection: if a scanned BSSID advertises an SSID that belongs to the fleet but is not one of our radios, something is impersonating the network (classic evil-twin signature).

Changes

• New AgentRegistry.LocalSsids(): fleet SSIDs from agent OwnBssids plus dawn/usteer local APs. The approved list derives from the fleet itself - zero-config, nothing to type by hand.
• New Live.EvalSsidImpostors(): one bounded query over the last 6h of wifi_scans. A candidate BSSID confirms only with >=2 real scans (distinct timestamps, so a frozen re-pushed payload does not count) separated by >=20 min dwell, and the alert auto-resolves after 2h unseen. Stable alert ID per BSSID; in-memory tracking on purpose: a restarted server re-alerts if the impostor is still around (security beats re-notice).
• Own BSSIDs come from the agent registry AND SSH-polled radios (iwinfo), so an SSH-only router broadcasting a fleet SSID is not a false positive.
• Category clients, not signal: signal defaults to LevelNone and a security alert must not be invisible on stock config.
• Wired after SaveScan in the agent ingest handler (the exact moment the evidence changes); i18n es/en (title, description with vars, hint).

Verification

• 7 new tests: single sighting does not alert, dwell confirms exactly once, own/foreign BSSID ignored, frozen payload does not confirm, auto-resolve, latest-sighting attribution (row-order regression caught during E2E), LocalSsids composition. Full server suite green.
• Live E2E on the home fleet: planted an old sighting in wifi_scans + a signed synthetic agent push (ephemeral agent, removed afterwards via the fix(agents): no upgrade flag on stale agents + remove-from-fleet action #1385 DELETE) - alert fired with correct router/signal vars, rendered translated in the alert feed (critical counter, URGENT badge, hint). Test data fully cleaned.

Closes #1358