feat(users): Willkommensmail mit Wellen-Kopf und Logo, Spalte Letzte Anmeldung

POST /users/:id/welcome-mail (gleiche Rechte wie Bearbeiten, jederzeit sendbar),
GET /users/welcome-mail/status; HTML-Mail (Tabellenlayout, Inline-Stile,
Kopfbild als CID-PNG aus assets/mail/welcome-header.svg, erzeugt mit
scripts/render-mail-header.mjs) plus Textfassung. Verzeichniskonten: Hinweis
auf Windows-Passwort; lokale Konten: Link Passwort festlegen (7 Tage, einmalig).
Neue Spalte User.welcomeMailSentAt (Migration 20260930120000). Benutzerliste:
Spalte Letzte Anmeldung, Zeilenaktionen als Symbole. Dockerfile kopiert
apps/api/assets. Lokal per MailHog nachgewiesen.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -535,6 +535,8 @@
       "displayName": "Display Name",
       "role": "Role",
       "status": "Status",
+      "lastLogin": "Last sign-in",
+      "neverLoggedIn": "Never",
       "actions": "Actions",
       "password": "Password",
       "noUsers": "No users found",
@@ -557,6 +559,20 @@
         "generic": "The action could not be completed. Please try again.",
         "network": "The server is not reachable. Please try again.",
         "loadFailed": "The user list could not be loaded. Please reload the page."
+      },
+      "welcomeMail": {
+        "button": "Send welcome email",
+        "resend": "Send again",
+        "sentAt": "Welcome email sent on {date}",
+        "noEmail": "No email address on file – please add one first.",
+        "noSmtp": "No SMTP server has been set up yet (Administrator → SMTP).",
+        "inactive": "The account is deactivated.",
+        "dialogTitle": "Send welcome email",
+        "dialogText": "Tessera will send a welcome email with the address, username and first sign-in instructions to:",
+        "dialogResend": "A welcome email was already sent on {date}. It will be sent again.",
+        "send": "Send",
+        "sending": "Sending …",
+        "success": "The welcome email to {email} has been sent."
       }
     },
     "tenants": {