[Schema] Add updated_at to the user and keypair APIs and deprecate modified_at

## Objective

Expose updated_at on the user and keypair APIs and mark modified_at deprecated, so clients can move without a breaking release.

## Background

Once the columns are renamed, the API is the last place still calling the field modified_at. Both spellings serve the same value, so they can coexist for a deprecation window instead of forcing a breaking change on the client SDK, the CLI and the WebUI.

## Acceptance Criteria

- UserResponse and KeyPairResponse gain updated_at; modified_at stays, carries the same value, and is marked deprecated on the Pydantic field.
- UserNode, KeyPairNode and the nested user types gain updated_at; their modified_at fields get a deprecation_reason pointing at it.
- UserOrderField, UserOrderFieldGQL and the user export report key gain an UPDATED_AT member; MODIFIED_AT keeps working and is documented as deprecated.
- The client SDK field specs and the CLI admin user commands read updated_at.
- The supergraph schema is regenerated and the deprecation appears in it.

## Notes

- Removing modified_at is out of scope; that is a separate issue once the deprecation window closes.
- KeypairOrderField has no MODIFIED_AT member today, so only the user ordering enums change.
- Roughly 300 lines.

JIRA Issue: BA-7208

Start by locating UserResponse, KeyPairResponse, UserNode, KeyPairNode, the ordering enums, and the user export report key, then inspect the client SDK field specs and CLI admin user commands. Regenerate the supergraph schema and verify updated_at is exposed everywhere, modified_at remains usable with deprecation metadata, and the CLI reads the new field.

Written by the indexing model from the issue text.