Add lockedAt to database, DB layer and exposed API

> As for naming, none of these stored procedures have gone out yet, so I can do a separate PR to rename them

I don't feel strongly, just a suggestion - your call