Add lockedAt to database, DB layer and exposed API

suggest moving this to module-level constant