ui(users): record last_login on /setup + sortable headers

web/templates/pages/users.html

@@ -29,11 +29,27 @@
   </form>
 
   <div class="panel mt-4 rounded-[7px] overflow-hidden">
+    {{/* Header — Username/Email/Role/Last login are clickable sort
+         links. Hrefs are pre-built server-side ($page.SortHrefs) so
+         html/template's URL-attribute escaping doesn't trip on the
+         '=' chars. Same pattern as the audit log. */}}
     <div class="user-row head">
-      <div>Username</div>
-      <div>Email</div>
-      <div>Role</div>
-      <div>Last login</div>
+      <div>
+        <a href="{{index $page.SortHrefs "username"}}"
+           class="sort-header">Username <span class="sort-glyph">{{sortGlyph "username" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "email"}}"
+           class="sort-header">Email <span class="sort-glyph">{{sortGlyph "email" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "role"}}"
+           class="sort-header">Role <span class="sort-glyph">{{sortGlyph "role" $page.Sort $page.Dir}}</span></a>
+      </div>
+      <div>
+        <a href="{{index $page.SortHrefs "last_login_at"}}"
+           class="sort-header">Last login <span class="sort-glyph">{{sortGlyph "last_login_at" $page.Sort $page.Dir}}</span></a>
+      </div>
       <div>Status</div>
       <div></div>
     </div>