[management] Record proxy logins and mesh activity for active-user accounting

Activity accounting counts a user as active from their last login or from a
peer of theirs being seen. Neither timestamp moved when someone reached a
service through the reverse proxy, so a person who only ever uses
proxy-protected services and never opens the dashboard has no login on
record at all and is skipped outright.

The two proxy entry points mean different things, so they write different
things. GenerateSessionToken is only reached after an ID token was verified,
so a completed SSO sign-in records a login on the user. ValidateTunnelPeer
authorises by tunnel IP with no IdP involved, so it records that the peer
was seen instead; the owner counts through that. Both write on the granted
path only, in UTC, and log and drop failures — no authorisation decision
reads them back.

The peer write is throttled to once an hour against the peer already in
hand, so a busy peer does not rewrite its row behind every request. Both
store methods update one column and leave the session-ownership fields to
the sync stream that owns them.

Peers that accounting excludes, embedded proxy peers and browser clients,
are skipped rather than written for nothing.

management/server/peer/peer.go

@@ -477,6 +477,13 @@ func sameMultiset[T comparable](a, b []T) bool {
 	return len(counts) == 0
 }
 
+// CountsTowardActivity reports whether the peer represents a device a person
+// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
+// clients are ephemeral sessions, so activity accounting ignores both.
+func (p *Peer) CountsTowardActivity() bool {
+	return !p.ProxyMeta.Embedded && p.Meta.KernelVersion != "wasm"
+}
+
 // GetLastLogin returns the last login time of the peer.
 func (p *Peer) GetLastLogin() time.Time {
 	if p.LastLogin != nil {