feat: show each account's last sign-in in Users

A right-aligned column at the end of every Users & roles row says how long ago the
account signed in, with the exact moment as the hint and as a line in the account
panel; a dash where nothing is recorded, and the demo account says it is not recorded.
formatDateTime formats that moment in the UI language rather than the browser's.

frontend/src/components/AccountPanel.tsx

@@ -1,7 +1,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Check, Clock, Copy, Globe, KeyRound, Mail, Send, ShieldAlert } from "lucide-react";
+import { Check, Clock, Copy, Globe, KeyRound, LogIn, Mail, Send, ShieldAlert } from "lucide-react";
 import Modal from "./ui/Modal";
 import { LoadingState, StateMessage } from "./ui/QueryState";
 import { api } from "../lib/api";
@@ -9,6 +9,7 @@ import { qk } from "../lib/queryKeys";
 import { notify } from "../lib/notifications";
 import { notifyActionError } from "../lib/actionErrors";
 import { copyText } from "../lib/clipboard";
+import { formatDateTime } from "../lib/format";
 import { invalidateUserAccess } from "../lib/adminUsers";
 import type { AdminUserAccess, AdminUserRow } from "../lib/api/admin";
 
@@ -168,6 +169,20 @@ export default function AccountPanel({
               }
               tone={a.has_google ? "ok" : "muted"}
             />
+            {/* The exact moment; the list row beside it only says how long ago. Null has two different
+                meanings, so it says which: nothing recorded yet, or the shared demo account, which is
+                deliberately never stamped. */}
+            <AccessRow
+              icon={LogIn}
+              label={t("users.account.lastLogin")}
+              value={
+                a.last_login_at
+                  ? formatDateTime(a.last_login_at)
+                  : a.is_demo
+                    ? t("users.account.lastLoginDemo")
+                    : t("users.account.lastLoginNone")
+              }
+            />
             {/* The gate that explains a Google sign-in silently becoming a fresh access request. */}
             {!a.is_allowed && (
               <AccessRow

frontend/src/components/AdminUsers.dom.test.tsx

@@ -36,6 +36,7 @@ vi.mock("../lib/errorDialog", () => ({ reportError: vi.fn() }));
 
 import AdminUsers from "./AdminUsers";
 import { api, type AdminUserRow } from "../lib/api";
+import { relativeTime } from "../lib/format";
 import i18n from "../i18n";
 
 const row = {
@@ -76,6 +77,27 @@ function mount() {
   return users;
 }
 
+describe("the last sign-in column (E22 S1)", () => {
+  it("says how long ago each account signed in, and a dash where nothing is recorded", async () => {
+    const at = new Date(Date.now() - 3 * 86_400_000).toISOString();
+    vi.spyOn(api, "adminUsers").mockResolvedValue([
+      { ...row, id: 3, email: "seen@x", last_login_at: at },
+      { ...row, id: 4, email: "never@x", last_login_at: null },
+      { ...row, id: 5, email: "demo@x", is_demo: true, last_login_at: null },
+    ] as never);
+    render(
+      <QueryClientProvider
+        client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}
+      >
+        <AdminUsers />
+      </QueryClientProvider>,
+    );
+
+    expect(await screen.findByText(relativeTime(at))).toBeTruthy();
+    expect(screen.getAllByText("—")).toHaveLength(2);
+  });
+});
+
 describe("a user action that fails", () => {
   it("says a user who is gone, and refetches the list", async () => {
     const users = mount();

frontend/src/components/AdminUsers.tsx

@@ -24,6 +24,7 @@ import {
   type PendingAccessRow,
 } from "../lib/api";
 import { notify } from "../lib/notifications";
+import { formatDateTime, relativeTime } from "../lib/format";
 import { invalidateUserAccess } from "../lib/adminUsers";
 import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import { Button } from "./ui/Button";
@@ -310,6 +311,23 @@ function UsersRoles({ me }: { me: Me }) {
                     icon={<Trash2 className="w-4 h-4" />}
                   />
                 </Tooltip>
+                {/* How long ago this account last signed in. LAST in the row on purpose: the badges and
+                    the role button before it vary in width row to row, so only the row's own right
+                    edge lines the values up into one column. The exact moment is the hint here and a
+                    line in the account panel; below `sm` the row has no room, and the panel still says it. */}
+                <Tooltip
+                  hint={
+                    u.last_login_at
+                      ? t("users.roles.lastLogin", { time: formatDateTime(u.last_login_at) })
+                      : u.is_demo
+                        ? t("users.roles.lastLoginDemo")
+                        : t("users.roles.lastLoginNone")
+                  }
+                >
+                  <span className="hidden sm:inline-block w-20 shrink-0 text-right text-2xs text-muted tabular-nums">
+                    {u.last_login_at ? relativeTime(u.last_login_at) : "—"}
+                  </span>
+                </Tooltip>
               </div>
             );
           })}