API: Allow updates to `last_active_at`

[jankeesvw]

Allow last_active_at to be set via the API, similar to how created_at can already be set (see PR #2056).

This is useful when importing cards from external systems (like GitHub Issues) where we want to preserve the original activity timeline. Without this, all imported cards would have the same last_active_at (the import time), causing incorrect sorting in the triage column and breaking the "not now" feature.

As discussed with @jeremy in https://github.com/basecamp/fizzy/pull/2056#discussion_r2609560246