docs: document first-session exception in session alerts

[Copilot]

• Locate all documentation for the session alerts feature
• Update auth-security.md to clearly document that the first session (sign-in immediately after sign-up) does not trigger a session alert email, with an explanation of why
• Rephrase first-session rationale: remove "proven they own their email address" (not true for email+password), replace with "new account doesn't yet hold anything worthy of protection"

[Meldiron]

lgtm

[greptile-apps]

Greptile Summary

This PR adds a well-structured "When alerts are not sent" subsection to the session alerts documentation, covering the first-session exception, auth methods that skip alerts, and accounts without an email address. The rationale for the first-session case is accurate and clearly explained.

Confidence Score: 5/5

Safe to merge; only a minor heading-level style note remains.

All findings are P2 style suggestions. The content is accurate and clearly improves the existing documentation.

No files require special attention.

Important Files Changed

Filename	Overview
src/partials/auth-security.md	Documents first-session and other alert exceptions clearly; introduces the only H2 heading in a doc that otherwise uses exclusively H1 headings

_{Reviews (2): Last reviewed commit: "Update src/partials/auth-security.md" | Re-trigger Greptile}

[adityaoberai]

@Meldiron I have only one suggestion, approving PR to unblock merge