Add lockedAt to database, DB layer and exposed API

Have done it here. Will go and do a separate PR - which will need to be merged prior to this (otherwise :conflicts: (there really should be an emoji for that)).