feat(web): add last seen to authorized clients

[extoci]

What Changed

Adds a relative "Last seen" line to each authorized client.

Live sessions show "Last seen now". Older sessions show values such as "Last seen 12m ago". Sessions without a timestamp show "Never seen".

UI Changes

Before:

After:

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for the UI change

Checks: targeted timestamp tests and web typecheck passed.

Built by Codex on behalf of Exotic using GPT-5.6 Sol in T3 Code.

---

Note

Medium Risk
Changes persisted semantics of lastConnectedAt on auth sessions, which may affect other readers of that field beyond the new UI.

Overview
Adds a Last seen line on each authorized client in Connections settings, using relative time when offline and Last seen now while the session is live (or Never seen when no timestamp exists).

To support that, SessionStore now persists lastConnectedAt when a session’s last connection drops (ref-count hits zero), not only on the first connect. Partial disconnects (e.g. one of several sockets) leave the timestamp and connected state unchanged; a full disconnect writes the disconnect time, and a later reconnect updates it again. Connect path is refactored to share a setLastConnectedAtNow helper.

Note: anything that treated lastConnectedAt as “when the client last connected” will now see the final disconnect time for idle sessions instead.

^{Reviewed by Cursor Bugbot for commit 5762c9e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add last-seen timestamp tracking to authorized client connections

• markDisconnected in SessionStore now persists the current time to lastConnectedAt only when the final connection reference disconnects; intermediate disconnects just decrement the count.
• ConnectedClientListRow in the web settings displays a last-seen label: live clients show "Last seen now", disconnected clients show a relative time, and clients without a timestamp show "Never seen".
• Tests in SessionStore.test.ts verify that intermediate disconnects preserve the initial timestamp, final disconnects update it, and reconnects produce a newer timestamp.
• Behavioral Change: lastConnectedAt is now updated on final disconnect rather than only on connect, so consumers reading that field may see disconnect times where they previously saw the last connection start time.

^{Macroscope summarized 5762c9e.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This feature changes production authorized-session persistence and adds user-facing behavior in the settings UI, including logic in a sensitive auth directory. An unresolved Medium finding also questions the timestamp semantics, so the runtime behavior should receive human validation.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}