v4.0.10: 관리자 계정 변경 안전장치와 접속시간 지표 추가

역할 변경은 명시적으로 버튼을 눌렀을 때만 가능하게 제한하고, 마지막 접속시간과 비밀번호 분실 안내를 추가해 운영 관리성을 높인다.

Co-authored-by: Cursor <cursoragent@cursor.com>

api/src/routes/admin.js

@@ -69,7 +69,8 @@ export function createAdminRouter(db) {
             `).get(like, like, like).c;
             rows = db.prepare(`
                 SELECT id, email, username, display_name AS displayName, avatar_url AS avatarUrl,
-                       role, is_active AS isActive, created_at AS createdAt, updated_at AS updatedAt
+                       role, is_active AS isActive, last_login_at AS lastLoginAt,
+                       created_at AS createdAt, updated_at AS updatedAt
                 FROM users
                 WHERE email LIKE ? OR username LIKE ? OR display_name LIKE ?
                 ORDER BY created_at DESC LIMIT ? OFFSET ?
@@ -78,7 +79,8 @@ export function createAdminRouter(db) {
             total = db.prepare('SELECT COUNT(*) AS c FROM users').get().c;
             rows = db.prepare(`
                 SELECT id, email, username, display_name AS displayName, avatar_url AS avatarUrl,
-                       role, is_active AS isActive, created_at AS createdAt, updated_at AS updatedAt
+                       role, is_active AS isActive, last_login_at AS lastLoginAt,
+                       created_at AS createdAt, updated_at AS updatedAt
                 FROM users ORDER BY created_at DESC LIMIT ? OFFSET ?
             `).all(Number(limit), offset);
         }
@@ -100,7 +102,8 @@ export function createAdminRouter(db) {
     router.get('/users/:id', (req, res) => {
         const user = db.prepare(`
             SELECT id, email, username, display_name AS displayName, avatar_url AS avatarUrl,
-                   role, is_active AS isActive, created_at AS createdAt, updated_at AS updatedAt
+                   role, is_active AS isActive, last_login_at AS lastLoginAt,
+                   created_at AS createdAt, updated_at AS updatedAt
             FROM users WHERE id = ?
         `).get(req.params.id);
 
@@ -188,7 +191,8 @@ export function createAdminRouter(db) {
 
         const updated = db.prepare(`
             SELECT id, email, username, display_name AS displayName, avatar_url AS avatarUrl,
-                   role, is_active AS isActive, created_at AS createdAt, updated_at AS updatedAt
+                   role, is_active AS isActive, last_login_at AS lastLoginAt,
+                   created_at AS createdAt, updated_at AS updatedAt
             FROM users WHERE id = ?
         `).get(targetId);
         updated.avatarUrl = getAvatarUrl(updated.id) || updated.avatarUrl;