ui(users): record last_login on /setup + sortable headers

web/styles/input.css

@@ -328,12 +328,20 @@
     text-transform: uppercase; letter-spacing: 0.08em;
   }
   .audit-row.head:hover { background: transparent; }
-  .audit-row.head .sort-header {
+  /* Sort-header link styling — shared by .audit-row and .user-row
+     (and any other future sortable table headers). The selectors
+     scope to .head rows so hover and accent-glyph treatment only
+     apply to the header, not data rows that happen to contain a
+     <a class="sort-header">. */
+  .audit-row.head .sort-header,
+  .user-row.head .sort-header {
     color: inherit; text-decoration: none; cursor: pointer;
     display: inline-flex; align-items: baseline; gap: 4px;
   }
-  .audit-row.head .sort-header:hover { color: var(--ink); }
-  .audit-row.head .sort-glyph {
+  .audit-row.head .sort-header:hover,
+  .user-row.head .sort-header:hover { color: var(--ink); }
+  .audit-row.head .sort-glyph,
+  .user-row.head .sort-glyph {
     font-size: 9px; color: var(--accent);
     /* keep the row height stable when the glyph appears/disappears */
     min-width: 8px; display: inline-block;

web/templates/pages/users.html

@@ -29,11 +29,27 @@
   </form>
 
   <div class="panel mt-4 rounded-[7px] overflow-hidden">
+    {{/* Header — Username/Email/Role/Last login are clickable sort
+         links. Hrefs are pre-built server-side ($page.SortHrefs) so
+         html/template's URL-attribute escaping doesn't trip on the
+         '=' chars. Same pattern as the audit log. */}}
     <div class="user-row head">
-      <div>Username</div>
-      <div>Email</div>
-      <div>Role</div>
-      <div>Last login</div>
+      <div>
+        <a href="{{index $page.SortHrefs "username"}}"
+           class="sort-header">Username <span class="sort-glyph">{{sortGlyph "username" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "email"}}"
+           class="sort-header">Email <span class="sort-glyph">{{sortGlyph "email" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "role"}}"
+           class="sort-header">Role <span class="sort-glyph">{{sortGlyph "role" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "last_login_at"}}"
+           class="sort-header">Last login <span class="sort-glyph">{{sortGlyph "last_login_at" $page.Sort $page.Dir}}</span></a>
+      </div>
       <div>Status</div>
       <div></div>
     </div>