feat: show each account's last sign-in in Users

A right-aligned column at the end of every Users & roles row says how long ago the
account signed in, with the exact moment as the hint and as a line in the account
panel; a dash where nothing is recorded, and the demo account says it is not recorded.
formatDateTime formats that moment in the UI language rather than the browser's.

frontend/src/components/AccountPanel.tsx

@@ -1,7 +1,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Check, Clock, Copy, Globe, KeyRound, Mail, Send, ShieldAlert } from "lucide-react";
+import { Check, Clock, Copy, Globe, KeyRound, LogIn, Mail, Send, ShieldAlert } from "lucide-react";
 import Modal from "./ui/Modal";
 import { LoadingState, StateMessage } from "./ui/QueryState";
 import { api } from "../lib/api";
@@ -9,6 +9,7 @@ import { qk } from "../lib/queryKeys";
 import { notify } from "../lib/notifications";
 import { notifyActionError } from "../lib/actionErrors";
 import { copyText } from "../lib/clipboard";
+import { formatDateTime } from "../lib/format";
 import { invalidateUserAccess } from "../lib/adminUsers";
 import type { AdminUserAccess, AdminUserRow } from "../lib/api/admin";
 
@@ -168,6 +169,20 @@ export default function AccountPanel({
               }
               tone={a.has_google ? "ok" : "muted"}
             />
+            {/* The exact moment; the list row beside it only says how long ago. Null has two different
+                meanings, so it says which: nothing recorded yet, or the shared demo account, which is
+                deliberately never stamped. */}
+            <AccessRow
+              icon={LogIn}
+              label={t("users.account.lastLogin")}
+              value={
+                a.last_login_at
+                  ? formatDateTime(a.last_login_at)
+                  : a.is_demo
+                    ? t("users.account.lastLoginDemo")
+                    : t("users.account.lastLoginNone")
+              }
+            />
             {/* The gate that explains a Google sign-in silently becoming a fresh access request. */}
             {!a.is_allowed && (
               <AccessRow