Keep when each account was added and when it last signed in

users.created comes back, beside a new last_login, for whoever maintains
the server. A password sign-in, the token link and a request through the
proxy all count, recorded to the hour so the proxy's per-request vouching
is not a write each time. Settings -> Users and ipx user list show both.
The three user queries now share one row mapping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

tests/ui/app.spec.js

@@ -433,6 +433,9 @@ test('an admin adds someone, makes them an admin, and removes them', async ({ pa
   await page.locator('#uadd').click();
   const row = userRow(page, 'pat');
   await expect(row).toBeVisible();
+  // When each account was added and last signed in; the admin signed in with the token link.
+  await expect(row).toContainText(/Added .* never signed in/);
+  await expect(userRow(page, 'admin')).toContainText(/signed in \d+m ago/);
   await expect(row.locator('[data-a="admin"]')).not.toBeChecked();
 
   await row.locator('[data-a="admin"]').check();