feat: add online presence tracking with last_seen column and configurable timeout

Add `last_seen` column to users table with index, implement `set_last_seen` and `get_online_users` database functions, expose presence config env vars (`PRESENCE_TIMEOUT_SECONDS`, `PRESENCE_ONLINE_LIMIT`, `PRESENCE_ONLINE_MARGIN_SECONDS`), include `last_seen` in follow list responses, and update profile docs to mention online indicator.

tests/api/messages/index.py

@@ -154,3 +154,29 @@ def test_unauthenticated_json_request_is_401_not_redirect(app_server):
     # browser guest still redirects to login
     rh = requests.get(f"{BASE_URL}/messages", allow_redirects=False)
     assert rh.status_code == 303
+
+
+def test_messages_conversation_renders_presence_indicator(app_server):
+    sender, _ = _member()
+    _, other_name = _member()
+    other_uid = _db_user(other_name)["uid"]
+    r = sender.get(f"{BASE_URL}/messages?with_uid={other_uid}")
+    assert r.status_code == 200
+    assert "messages-presence" in r.text
+    assert f'data-presence-uid="{other_uid}"' in r.text
+
+
+def test_messages_conversation_list_avatar_has_presence_dot(app_server):
+    sender, _ = _member()
+    _, other_name = _member()
+    other_uid = _db_user(other_name)["uid"]
+    sent = sender.post(
+        f"{BASE_URL}/messages/send",
+        data={"receiver_uid": other_uid, "content": "hi there"},
+        allow_redirects=True,
+    )
+    assert sent.status_code == 200, sent.text[:300]
+    html = sender.get(f"{BASE_URL}/messages").text
+    assert "conversation-item" in html
+    assert "presence-dot" in html
+    assert f'data-presence-uid="{other_uid}"' in html