feat: record when an account last signed in

users.last_login_at (migration 0085, no backfill) is stamped by _establish_session,
which the Google callback now shares with password login instead of repeating its
session setup inline. The demo entry does not stamp its shared account. The admin
user list carries the field.

frontend/src/lib/api/admin.ts

@@ -82,6 +82,8 @@ export interface AdminUserRow {
   /** The Google account's address, ONLY when it differs from the account address (E9.5 S3). */
   google_email: string | null;
   created_at: string | null;
+  /** Last sign-in (Google or password). Null = not since 0.88 (no backfill), or the demo account. */
+  last_login_at: string | null;
 }
 
 /** The account panel's view of why someone can or cannot get in (E12 S5). */