next: Put server predefined user attributes in record or auth user profile

[Steven-Chan]

Affected attributes:

• last_seen_at
• last_login_at
• disabled
• disabled_message
• disabled_expiry
• verified (not implemented yet, #781)
• xxx_verified (not implemented yet, #781)

If record gear is enabled, these attributes would be put in user record, otherwise put in auth user profile.

xxx_verified would change when server configuration is changed. To avoid changing db schema when configuration changed, I suggest using a json field to replace the original xxx_verified fields.