feat: add the admin columns and the frontend permissions table

- users.permissions and users.last_seen as additive columns
- golem15_user_frontend_permissions (code, label, tab, comment)
- User gains LastSeen, read-only CreatedAt and UpdatedAt and the
  filterByGroup list scope; none of them is serialized
- migration tests roll back by position past the three new steps

models/user.go

@@ -29,7 +29,15 @@ type User struct {
 	TokensValidAfter          *time.Time     `gorm:"column:tokens_valid_after"`
 	CreatedIPAddress          *string        `gorm:"column:created_ip_address"`
 	LastIPAddress             *string        `gorm:"column:last_ip_address"`
-	DeletedAt                 gorm.DeletedAt `gorm:"column:deleted_at"`
+	// LastSeen is stamped by login and token refresh, at most once per five
+	// minutes (classes.TouchLastSeen). It is shown in the admin list and is
+	// never part of a user API payload.
+	LastSeen *time.Time `gorm:"column:last_seen" json:"-"`
+	// CreatedAt and UpdatedAt are read-only: the database defaults fill them
+	// and GORM never writes or stamps them through this model.
+	CreatedAt time.Time      `gorm:"column:created_at;->" json:"-"`
+	UpdatedAt time.Time      `gorm:"column:updated_at;->" json:"-"`
+	DeletedAt gorm.DeletedAt `gorm:"column:deleted_at"`
 	// Groups is the PHP belongsToMany groups relation through users_groups.
 	// It is loaded only on request, written only by a caller that
 	// associates groups, and never serialized: the user API answers
@@ -66,6 +74,25 @@ func (User) Rules() map[string]string {
 	}
 }
 
+// FilterByGroup is the admin list scope that keeps the members of one group,
+// the PHP User::scopeFilterByGroup.
+const FilterByGroup = "filterByGroup"
+
+// FilterScopes lists the scope names a config_filter.yaml may call.
+func (User) FilterScopes() []string { return []string{FilterByGroup} }
+
+// FilterScope narrows db to the members of the group whose id is value. Any
+// other scope name matches nothing.
+func (User) FilterScope(name string, db *gorm.DB, value any) *gorm.DB {
+	if db == nil {
+		return db
+	}
+	if name != FilterByGroup {
+		return db.Where("1 = 0")
+	}
+	return db.Where("users.id IN (SELECT user_id FROM users_groups WHERE user_group_id = ?)", value)
+}
+
 func init() {
 	Register(User{})
 }