feat: add the admin columns and the frontend permissions table

- users.permissions and users.last_seen as additive columns
- golem15_user_frontend_permissions (code, label, tab, comment)
- User gains LastSeen, read-only CreatedAt and UpdatedAt and the
  filterByGroup list scope; none of them is serialized
- migration tests roll back by position past the three new steps

updates/user_session_test.go

@@ -47,8 +47,9 @@ func TestExtendUsersMigration(t *testing.T) {
 	if !row.HasSelfSetPassword || row.IsActivated || row.MarketingConsent || row.IsOnboarded {
 		t.Fatalf("defaults = %+v", row)
 	}
-	// API tokens, user groups, jwt blacklist, throttle, then extend-users.
-	for range 5 {
+	// The three admin migrations, API tokens, user groups, jwt blacklist,
+	// throttle, then extend-users.
+	for range 8 {
 		if err := m.RollbackLast(); err != nil {
 			t.Fatal(err)
 		}
@@ -87,8 +88,8 @@ func TestCreateUserThrottleMigration(t *testing.T) {
 			t.Fatalf("missing column %s", col)
 		}
 	}
-	// API tokens, user groups, jwt blacklist, then throttle.
-	for range 4 {
+	// The three admin migrations, API tokens, user groups, jwt blacklist, then throttle.
+	for range 7 {
 		if err := m.RollbackLast(); err != nil {
 			t.Fatal(err)
 		}
@@ -119,8 +120,8 @@ func TestCreateJwtBlacklistMigration(t *testing.T) {
 			t.Fatalf("missing column %s", col)
 		}
 	}
-	// API tokens, user groups, then jwt blacklist.
-	for range 3 {
+	// The three admin migrations, API tokens, user groups, then jwt blacklist.
+	for range 6 {
 		if err := m.RollbackLast(); err != nil {
 			t.Fatal(err)
 		}