fix(security): flag logins that lose country attestation

[joelorzet]

Problem

An org owner reviewing a member's recent sessions sees a red flag when the member's country changes from one known country to another (AU -> KR), but a change from a known country to an unplaceable location (no country attested) raised no flag at all. Both should be treated the same way.

Root cause

The red flag is computed at login in assessLoginRisk and stored in sessions.risk_flags_json; the member-sessions panel only renders what was stored. That function returned early with a no-anomaly signal whenever the login carried no country attestation, before comparing against the user's prior countries. A second guard in the session-create hook only persisted the risk blob when a country was present, so even a computed anomaly with a null country would have been dropped.

Fix

• Remove the early return. A null country now raises an unknown_country anomaly when the user has an established country history, mirroring the existing new_country path. A null country with no prior history stays inconclusive, so local-dev and self-hosted logins are not tripped.
• Persist the risk blob whenever there is a resolved country or an anomaly, so the unknown_country verdict reaches the panel.
• Add the unknown_country -> "Unknown location" badge label.

Impossible-travel detection now also runs on the null-country path (previously skipped by the early return), a strict improvement since IP-fallback coordinates can still be present.

Tests

• pnpm vitest run tests/unit/login-risk.test.ts -- 17 passed. Updated the "no country" cases to assert they stay inconclusive only without history, and added coverage for unknown_country firing with prior history (CF XX sentinel and full CF bypass).
• pnpm type-check -- clean.