feat(account): show the account its own last sign-in

Settings → Account names the latest sign-in on any device (only the
admin's user list did, though the 0.88 notes said otherwise), and the role
in the reader's language instead of the raw `user`.

backend/app/routes/me.py

@@ -23,6 +23,7 @@ from app import logs
 from app import sysconfig
 from app.db import get_db
 from app.models import Invite, User
+from app.utils import iso
 
 router = APIRouter(prefix="/api/me", tags=["me"])
 
@@ -138,6 +139,9 @@ def get_me(
             user.google_email if user.google_email and user.google_email != user.email else None
         ),
         "has_password": user.password_hash is not None,
+        # The account's latest sign-in on any device — shown in Settings → Account, so a sign-in the
+        # user does not recognise is something they can see (null: none since 0.88, or the demo).
+        "last_login_at": iso(user.last_login_at),
         # Instance-wide: whether Google sign-in / YouTube connect is available at all (the UI hides
         # YouTube-access affordances and the onboarding nudge when it isn't configured).
         "google_enabled": google_enabled(db),

backend/tests/test_last_login.py

@@ -95,3 +95,13 @@ def test_the_admin_user_list_carries_last_login(as_user, db, make_user):
 
     assert rows["boss@example.com"]["last_login_at"].startswith("2026-09-16T08:30")
     assert rows[never.email]["last_login_at"] is None
+
+
+def test_the_account_sees_its_own_last_sign_in(client, db, make_user):
+    # Settings → Account shows it (prod UAT 2026-09-19: only the admin's user list did).
+    make_user(email="me@example.com", password=_PW)
+    client.post("/auth/password-login", json={"email": "me@example.com", "password": _PW})
+
+    stamp = client.get("/api/me").json()["last_login_at"]
+
+    assert _recent(datetime.fromisoformat(stamp))