feat: add the admin columns and the frontend permissions table

- users.permissions and users.last_seen as additive columns
- golem15_user_frontend_permissions (code, label, tab, comment)
- User gains LastSeen, read-only CreatedAt and UpdatedAt and the
  filterByGroup list scope; none of them is serialized
- migration tests roll back by position past the three new steps

updates/user_groups_test.go

@@ -54,7 +54,8 @@ func TestUserGroupsMigration(t *testing.T) {
 		t.Fatalf("users_groups primary key = %q", pk)
 	}
 
-	for range 2 { // API tokens, then user groups.
+	// Frontend permissions, last seen, API tokens, user permissions, then user groups.
+	for range 5 {
 		if err := m.RollbackLast(); err != nil {
 			t.Fatal(err)
 		}