Add lockedAt to database, DB layer and exposed API

We can delete it, but in the next release (or at least _after_ whenever this goes out). I should raise a bug so I don't forget about it.

As for naming, none of these stored procedures have gone out yet, so I can do a separate PR to rename them to be `*_v?`.