Fix: Prolific Visitors stat now works

Bug: the "Prolific Visitors" card on /stats always showed "Nothing yet." regardless of actual site activity.

Root cause: the query joined users to login_attempts WHERE successful = 1. But login_attempts only ever records failed attempts — it's a rate-limit tracker, and successful attempts wipe their failure rows rather than inserting a success row. Zero matches forever.

Fix:

• Added users.login_count INT UNSIGNED DEFAULT 0, backfilled to 1 for anyone with a last_login_at so existing accounts appear right away
• AuthController now increments the counter on both successful-login paths (standard + 2FA-required), in the same spot that writes last_login_at
• Stats query rewritten to ORDER BY login_count DESC, last_login_at DESC — recent visitors tiebreak equal counts

Label on the card changed from "logins" to "visits" to match the phrasing that sparked the fix.