Adds a nullable last_seen_at column on users and middleware to update it on each authenticated request.