Unknown-volume alert

Checks per-source-IP volume against a threshold using the same plain ip_enrichment.label classification used across the dashboard (not the domain-scoped allowlist matching the recommendation engine uses) — deliberately a lighter-weight, faster daily check than the full R5/R6 analysis, meant to catch an obvious spike quickly rather than replace the deeper rule engine.