feat: show each account's last sign-in in Users

A right-aligned column at the end of every Users & roles row says how long ago the
account signed in, with the exact moment as the hint and as a line in the account
panel; a dash where nothing is recorded, and the demo account says it is not recorded.
formatDateTime formats that moment in the UI language rather than the browser's.

frontend/src/components/AdminUsers.dom.test.tsx

@@ -36,6 +36,7 @@ vi.mock("../lib/errorDialog", () => ({ reportError: vi.fn() }));
 
 import AdminUsers from "./AdminUsers";
 import { api, type AdminUserRow } from "../lib/api";
+import { relativeTime } from "../lib/format";
 import i18n from "../i18n";
 
 const row = {
@@ -76,6 +77,27 @@ function mount() {
   return users;
 }
 
+describe("the last sign-in column (E22 S1)", () => {
+  it("says how long ago each account signed in, and a dash where nothing is recorded", async () => {
+    const at = new Date(Date.now() - 3 * 86_400_000).toISOString();
+    vi.spyOn(api, "adminUsers").mockResolvedValue([
+      { ...row, id: 3, email: "seen@x", last_login_at: at },
+      { ...row, id: 4, email: "never@x", last_login_at: null },
+      { ...row, id: 5, email: "demo@x", is_demo: true, last_login_at: null },
+    ] as never);
+    render(
+      <QueryClientProvider
+        client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}
+      >
+        <AdminUsers />
+      </QueryClientProvider>,
+    );
+
+    expect(await screen.findByText(relativeTime(at))).toBeTruthy();
+    expect(screen.getAllByText("—")).toHaveLength(2);
+  });
+});
+
 describe("a user action that fails", () => {
   it("says a user who is gone, and refetches the list", async () => {
     const users = mount();