feat(account): show the account its own last sign-in

Settings → Account names the latest sign-in on any device (only the
admin's user list did, though the 0.88 notes said otherwise), and the role
in the reader's language instead of the raw `user`.

frontend/src/components/SettingsPanel.account.dom.test.tsx

@@ -0,0 +1,60 @@
+// @vitest-environment jsdom
+//
+// Settings → Account names the account's latest sign-in (prod UAT 2026-09-19: only the admin's user
+// list showed it), and its role in the reader's language — the raw `user` read in English under HU.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, render, screen } from "@testing-library/react";
+
+import type { Me } from "../lib/api";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (key: string, vars?: Record<string, unknown>) =>
+        vars?.time != null ? `${key}:${String(vars.time)}` : key,
+      i18n: { language: "en" },
+    }),
+  };
+});
+vi.mock("../lib/format", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/format")>();
+  return { ...actual, formatDateTime: (iso: string) => `at ${iso}` };
+});
+
+import { AccountHeader } from "./SettingsPanel";
+
+afterEach(cleanup);
+
+const me = (extra: Partial<Me>): Me =>
+  ({
+    email: "someone@example.com",
+    display_name: "Someone",
+    avatar_url: null,
+    role: "user",
+    is_demo: false,
+    last_login_at: null,
+    ...extra,
+  }) as Me;
+
+describe("AccountHeader", () => {
+  it("names the latest sign-in and the role in the reader's language", () => {
+    render(<AccountHeader me={me({ last_login_at: "2026-09-19T02:00:00Z" })} />);
+    expect(screen.getByTestId("account-last-login").textContent).toBe(
+      "settings.account.lastLogin:at 2026-09-19T02:00:00Z",
+    );
+    expect(screen.getByText("nav.role.user")).toBeTruthy();
+  });
+
+  it("says when none is recorded, and says nothing about it for the demo", () => {
+    render(<AccountHeader me={me({})} />);
+    expect(screen.getByTestId("account-last-login").textContent).toBe(
+      "settings.account.lastLoginNone",
+    );
+    cleanup();
+    render(<AccountHeader me={me({ is_demo: true })} />);
+    expect(screen.queryByTestId("account-last-login")).toBeNull();
+    expect(screen.getByText("nav.role.demo")).toBeTruthy();
+  });
+});

frontend/src/components/SettingsPanel.tsx

@@ -1,6 +1,7 @@
 import { useState } from "react";
 import { withActiveAccount } from "../lib/activeAccount";
 import { qk } from "../lib/queryKeys";
+import { formatDateTime } from "../lib/format";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Activity, Bell, Check, Loader2, Monitor, RefreshCw, Trash2, User } from "lucide-react";
@@ -778,6 +779,38 @@ export function DownloadAuth() {
   );
 }
 
+/** Who is signed in: name, address, role — and the latest sign-in on any device, so one the user does
+ *  not recognise is something they can see. */
+export function AccountHeader({ me }: { me: Me }) {
+  const { t } = useTranslation();
+  return (
+    <Section title={t("settings.account.title")}>
+      <div className="flex items-center gap-3 mb-3">
+        <Avatar
+          src={me.avatar_url}
+          fallback={me.display_name ?? me.email}
+          className="w-12 h-12 rounded-full"
+        />
+        <div className="min-w-0">
+          <div className="font-semibold truncate">{me.display_name ?? me.email.split("@")[0]}</div>
+          <div className="text-xs text-muted truncate">{me.email}</div>
+          {/* Translated, like the sidebar's tooltip: the raw `user` read in English under HU. */}
+          <div className="text-xs text-muted">
+            {t(`nav.role.${me.is_demo ? "demo" : me.role === "admin" ? "admin" : "user"}`)}
+          </div>
+          {!me.is_demo && (
+            <div className="text-xs text-muted" data-testid="account-last-login">
+              {me.last_login_at
+                ? t("settings.account.lastLogin", { time: formatDateTime(me.last_login_at) })
+                : t("settings.account.lastLoginNone")}
+            </div>
+          )}
+        </div>
+      </div>
+    </Section>
+  );
+}
+
 function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
   const { t } = useTranslation();
   const confirm = useConfirm();
@@ -801,22 +834,7 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
   };
   return (
     <>
-      <Section title={t("settings.account.title")}>
-        <div className="flex items-center gap-3 mb-3">
-          <Avatar
-            src={me.avatar_url}
-            fallback={me.display_name ?? me.email}
-            className="w-12 h-12 rounded-full"
-          />
-          <div className="min-w-0">
-            <div className="font-semibold truncate">
-              {me.display_name ?? me.email.split("@")[0]}
-            </div>
-            <div className="text-xs text-muted truncate">{me.email}</div>
-            <div className="text-xs text-muted capitalize">{me.role}</div>
-          </div>
-        </div>
-      </Section>
+      <AccountHeader me={me} />
 
       {!me.is_demo && <SignInMethods me={me} />}