Log failed login alerts for security analysts before workday

Your failed login emails arrive untriaged, causing missed brute-force patterns and delayed blocks. Analysts get parsed incident rows with IP, username, attempt counts and timestamps to act before the next workday.