FR: Email notifications before a device key expires

### What are you trying to do?

When remote device keys expire, there is no notification beyond on-device notifications (not visible because it's a remote device), and a subtle label in the admin console (not a notification).

### How should we solve this?

It would be great to get (optional) email notifications before a device key expires, e.g. to avoid remote devices breaking without having to disable key expiry. A system notification isn't very useful in that situation.

Ideally an admin could enable email notifications on a per-device or per-tailnet basis.

If I got a notifiation in time, I could ssh to the device and do a reauth before the key expires.

### What is the impact of not solving this?

Without this, you have to disable key expiry on all remote (or seldom accessed) devices, or deal with accessing the device locally to reenable it once you notice that you can no longer access it.

### Anything else?

I raised this in #12745 and was asked to submit a separate issue.