Sign-In anomaly analyzer

Treat every finding as a lead, not a verdict. VPN exits, shared office NAT, and mobile carrier gateways all make one address look like many users or one user look like many countries, and a cloud mail client can fail sign-ins for boring reasons. Logs that carry only a country get the weaker fast country change signal, never computed travel, because travel math needs coordinates the log does not have. Rows with no readable outcome are counted and left out of every rule rather than guessed, and users under the baseline are skipped instead of flagged. A clean result only covers the rows you pasted here.