feat: record when an account last signed in

users.last_login_at (migration 0085, no backfill) is stamped by _establish_session,
which the Google callback now shares with password login instead of repeating its
session setup inline. The demo entry does not stamp its shared account. The admin
user list carries the field.

backend/app/models.py

@@ -102,6 +102,10 @@ class User(Base, TimestampMixin, CanonicalEmailMixin):
     # current_user rejects any cookie whose epoch is stale, so a stolen/copied cookie dies on those
     # events (client-side signed cookies otherwise stay valid until they expire).
     session_epoch: Mapped[int] = mapped_column(Integer, default=0, server_default="0")
+    # When this account last signed in (Google or password), stamped by the one sign-in path,
+    # routes/auth._establish_session. NULL = not since the column existed (0085; no backfill is
+    # possible). The shared demo account is never stamped — its "last login" would mean nobody.
+    last_login_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     display_name: Mapped[str | None] = mapped_column(String(255))
     avatar_url: Mapped[str | None] = mapped_column(String(1024))
     role: Mapped[str] = mapped_column(String(16), default="user", server_default="user")

backend/app/routes/admin.py

@@ -408,6 +408,8 @@ def _serialize_user(u: User) -> dict:
         # confusing sign-in.
         "google_email": u.google_email if u.google_email != u.email else None,
         "created_at": iso(u.created_at),
+        # NULL = no sign-in since the column existed (0085), or the shared demo account.
+        "last_login_at": iso(u.last_login_at),
     }
 
 

backend/app/routes/auth.py

@@ -479,16 +479,8 @@ async def callback(
     db.flush()
 
     _store_token(db, user, token)
+    _establish_session(request, user)
     db.commit()
-
-    # Multi-session: remember every account that has authenticated in this browser so the
-    # user can switch between them without going through Google again. Only accounts that
-    # actually completed OAuth here land in this list (it's the proof they may be switched to).
-    accounts = [a for a in (request.session.get("account_ids") or []) if a != user.id]
-    accounts.append(user.id)
-    request.session["account_ids"] = accounts[-MAX_SESSION_ACCOUNTS:]
-    request.session["user_id"] = user.id
-    _remember_epoch(request, user)
     log.info("Login: %s (id=%s, role=%s)", email, user.id, user.role)
     return RedirectResponse(url="/")
 
@@ -675,13 +667,18 @@ def demo_login(body: EmailIn, request: Request, db: Session = Depends(get_db)) -
 
 
 def _establish_session(request: Request, user: User) -> None:
-    """Sign `user` in for this browser session, mirroring the Google callback's multi-account
-    handling so password sign-in joins the same account switcher."""
+    """Sign `user` in for this browser session — the ONE sign-in path, shared by the Google callback
+    and password login, so both join the same account switcher and both stamp `last_login_at` (the
+    caller commits). Multi-session: every account that authenticated in this browser is remembered so
+    the user can switch between them; only accounts that actually proved themselves HERE land in that
+    wallet (it is the proof they may be switched to). The demo entry deliberately does not come
+    through here: it clears the wallet instead, and its shared account has no meaningful last login."""
     accounts = [a for a in (request.session.get("account_ids") or []) if a != user.id]
     accounts.append(user.id)
     request.session["account_ids"] = accounts[-MAX_SESSION_ACCOUNTS:]
     request.session["user_id"] = user.id
     _remember_epoch(request, user)
+    user.last_login_at = datetime.now(timezone.utc)
 
 
 def _app_base() -> str:
@@ -1051,6 +1048,7 @@ def password_login(
     if not user.is_active:
         raise _login_refused(403, "pending_approval", user)
     _establish_session(request, user)
+    db.commit()
     log.info("Password login: %s (id=%s, role=%s)", email, user.id, user.role)
     return {"ok": True}