Keep when each account was added and when it last signed in

users.created comes back, beside a new last_login, for whoever maintains
the server. A password sign-in, the token link and a request through the
proxy all count, recorded to the hour so the proxy's per-request vouching
is not a write each time. Settings -> Users and ipx user list show both.
The three user queries now share one row mapping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

docs/architecture.md

@@ -50,7 +50,7 @@ entries     feed_id, guid, title, link, published, description, first_seen,
             image, duration, episode, season            PK (feed_id, guid)
 enclosures  id, feed_id, guid, url UNIQUE, mime, length, path, state,
             bytes_done, downloaded_at, last_error
-users       id, name, pass_hash, is_admin
+users       id, name, pass_hash, is_admin, created, last_login
 sessions    token, user_id, seen
 subscriptions  user_id, feed_id, keywords, auto_download, allow_explicit,
                max_new_per_check                         PK (user_id, feed_id)
@@ -63,11 +63,10 @@ before accounts; two bugs came from queries still reading them, and `migrate()`
 older database.
 
 Schema changes: add the table or column to `SCHEMA`. `CREATE TABLE IF NOT EXISTS` leaves a table
-that already exists alone, so a new column on one also needs an `ALTER TABLE ADD COLUMN` in
-`migrate()`, checked with `PRAGMA table_info` the way its `retired` list is for drops. None is
-needed today: every column added so far predates 0.3.0, the oldest version an upgrade may start
-from. `Db::memory()` runs the same path as `Db::open`, so a migration cannot pass the tests while
-missing in production.
+that already exists alone, so a new column on one also goes in `migrate()`'s `wanted` list, and a
+retired one in its `retired` list; both are checked with `PRAGMA table_info`. Columns from before
+0.3.0, the oldest version an upgrade may start from, need no entry. `Db::memory()` runs the same
+path as `Db::open`, so a migration cannot pass the tests while missing in production.
 
 ## Control socket
 

docs/history.md

@@ -21,6 +21,12 @@ column drops earlier the same day, and one stray `entry_state` row. The code had
 - `Db::subscribed_feed_ids` had no callers, though its doc said the scanner walked it.
   `Db::subscriber_count` had one caller asking whether it was above zero, which
   `subscriber_counts().contains_key` answers. `Managed.orphaned` was selected and never read.
+- `users.created` came back the same afternoon, with `last_login` beside it. Nothing read it, but
+  when an account was made and when it last signed in is what you want to know when tidying
+  accounts, and it cannot be recovered later. Both existing accounts got their creation times back
+  from the backup taken before the drop, and a last sign-in from their newest session in it.
+  `last_login` is kept to the hour, because the proxy vouches for every request and that would
+  otherwise be a write each time.
 
 ## 2026-09-12 — Cutting what had outlived its reason