The notification bell now receives event-driven alerts: new handshake captures, new enterprise credentials, pineapd down/recovery and monitor drops (15s poll, diffs against last-seen state). Dashboard gains an Attacks / PineAPd / Recon live status row.