Keep when each account was added and when it last signed in

users.created comes back, beside a new last_login, for whoever maintains
the server. A password sign-in, the token link and a request through the
proxy all count, recorded to the hour so the proxy's per-request vouching
is not a write each time. Settings -> Users and ipx user list show both.
The three user queries now share one row mapping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

web/index.html

@@ -1708,7 +1708,9 @@ async function usersModal(){
   const users = await api('/api/users') || [];
   openModal(`<h3>Users</h3>
     ${users.map(u=>`<div class="inline" data-id="${u.id}" style="margin-bottom:8px">
-      <b style="flex:1;overflow-wrap:anywhere">${esc(u.name)}</b>
+      <div style="flex:1;min-width:0"><b style="overflow-wrap:anywhere">${esc(u.name)}</b>
+        <small style="display:block;color:var(--faint)">${u.created?`Added ${dateOf(u.created)}`:'Added before this was kept'} · ${
+          u.last_login?`signed in ${ago(u.last_login)}`:'never signed in'}</small></div>
       ${u.password?'':'<span class="tag" title="No password: signs in through the proxy">Proxy</span>'}
       <label class="check" style="margin:0"><input type="checkbox" data-a="admin" ${u.admin?'checked':''}> Admin</label>
       <button class="btn ico danger" data-a="rm" title="Remove ${esc(u.name)}" aria-label="Remove ${esc(u.name)}">${ICON.trash}</button></div>`).join('')}