Keep when each account was added and when it last signed in

users.created comes back, beside a new last_login, for whoever maintains
the server. A password sign-in, the token link and a request through the
proxy all count, recorded to the hour so the proxy's per-request vouching
is not a write each time. Settings -> Users and ipx user list show both.
The three user queries now share one row mapping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

docs/architecture.md

@@ -50,7 +50,7 @@ entries     feed_id, guid, title, link, published, description, first_seen,
             image, duration, episode, season            PK (feed_id, guid)
 enclosures  id, feed_id, guid, url UNIQUE, mime, length, path, state,
             bytes_done, downloaded_at, last_error
-users       id, name, pass_hash, is_admin
+users       id, name, pass_hash, is_admin, created, last_login
 sessions    token, user_id, seen
 subscriptions  user_id, feed_id, keywords, auto_download, allow_explicit,
                max_new_per_check                         PK (user_id, feed_id)
@@ -63,11 +63,10 @@ before accounts; two bugs came from queries still reading them, and `migrate()`
 older database.
 
 Schema changes: add the table or column to `SCHEMA`. `CREATE TABLE IF NOT EXISTS` leaves a table
-that already exists alone, so a new column on one also needs an `ALTER TABLE ADD COLUMN` in
-`migrate()`, checked with `PRAGMA table_info` the way its `retired` list is for drops. None is
-needed today: every column added so far predates 0.3.0, the oldest version an upgrade may start
-from. `Db::memory()` runs the same path as `Db::open`, so a migration cannot pass the tests while
-missing in production.
+that already exists alone, so a new column on one also goes in `migrate()`'s `wanted` list, and a
+retired one in its `retired` list; both are checked with `PRAGMA table_info`. Columns from before
+0.3.0, the oldest version an upgrade may start from, need no entry. `Db::memory()` runs the same
+path as `Db::open`, so a migration cannot pass the tests while missing in production.
 
 ## Control socket