Stamp UTC on naive API timestamps before serializing (B-35)

SQLite/aiosqlite returns DateTime columns as naive even though every
value is written in UTC, so a bare .isoformat() dropped the offset and
the frontend's new Date() parsed it as local time. Add a shared
isoformat_utc() helper and use it at every call site that was missing
the fix already applied ad hoc in rounds.py.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

BUGS.md

@@ -1,11 +1,11 @@
 # Known bugs
 
 A second full-codebase audit on 2026-07-27 found **25 further issues** (4 critical, 6 high,
-7 medium, 8 low), listed below as B-33 … B-49. B-25 through B-34 are fixed (see "Previously
-fixed" below) — no Critical-severity finding remains open; the other 15 are High/Medium/Low.
+7 medium, 8 low), listed below as B-33 … B-49. B-25 through B-35 are fixed (see "Previously
+fixed" below) — no Critical-severity finding remains open; the other 14 are High/Medium/Low.
 The 139-test suite was green at the time of the audit, so none of these were caught by existing
-coverage — every fix lands with a regression test (the ten fixes so far brought the suite
-from 139 to 194).
+coverage — every fix lands with a regression test (the eleven fixes so far brought the suite
+from 139 to 198).
 
 The recurring pattern across the open findings is worth stating once: the code is rigorous
 about the failure modes that have actually been hit, and silent about the ones that have not.
@@ -20,21 +20,6 @@ single-process assumptions, no user-facing history, etc.), see "Known gaps / TOD
 
 ## Medium
 
-### B-35 — Every API timestamp is naive, so the frontend renders it in the wrong timezone
-
-Verified empirically: the `DateTime` columns carry no timezone, so SQLite returns naive
-datetimes and `.isoformat()` produces `2026-07-27T06:56:47.489110` — **no `Z`**. JavaScript's
-`new Date()` parses that as **local time**, so every date in `/admin` (rounds, pending
-transactions, audit log, via `fmtDate` in `app/static/admin.js:50`) and `created_at` in
-`/users/me` display two hours off in Italy.
-
-The codebase knows about this — `api/routes/rounds.py` calls `.replace(tzinfo=timezone.utc)`
-on `opened_at` explicitly — but the fix was never applied systematically.
-
-**Proposed fix.** Make the columns `DateTime(timezone=True)` (Alembic migration) so the value
-round-trips as aware, rather than patching each call site. Until then, at minimum a shared
-serialization helper that stamps UTC, used by every `.isoformat()` in the API layer.
-
 ### B-36 — `_wait_for_next_block` waits forever, with no timeout and no visibility
 
 `rounds/scheduler.py:158-161` loops until a higher block arrives. No timeout, no log, no audit
@@ -195,12 +180,13 @@ already does.
 - **B-29** — a UTXO absent from one server's `listunspent` was marked spent immediately, irreversibly, on a single unauthenticated reply
 - **B-30** — a lost scripthash subscription meant a user's deposits were never credited, with no periodic safety net
 - **B-31** — resubscribing on reconnect ran serially before anything else started, freezing the chain tip (and so an in-flight draw) for the whole sweep
-- **B-32** — an RBF bump's fee delta could fall below BIP125's relay-mandated minimum, so the node rejected it and the same tick retried identically forever; also had no ceiling on how high the fee rate could climb
-- **B-33** — `POST /auth/login` had no rate limiting on a custodial wallet, so a patient distributed attack could brute-force a password against an enumerable username list; fixed with per-username *and* per-IP exponential backoff (`app/auth/rate_limit.py`), registration throttled per-IP too (also bounds B-31's attacker-controlled user count)
-- **B-34** — neither self-service password change nor the admin reset invalidated already-issued JWTs, so a stolen token (or an attacker's own session) survived a password change meant to lock it out; fixed with a `User.token_version` column embedded in every JWT (`"tv"` claim) and checked on every request in `get_current_user`/`get_optional_user`, bumped on both endpoints — change-password hands back a fresh token so the caller's own session keeps working, the admin reset does not
+- **B-32** — an RBF bump could retry forever below BIP125's relay-mandated minimum fee delta, with no ceiling on the fee rate either
+- **B-33** — `POST /auth/login` had no rate limiting, so a password could be brute-forced against an enumerable username list
+- **B-34** — password change/reset didn't invalidate already-issued JWTs, so a stolen token survived a change meant to lock it out
+- **B-35** — API timestamps round-tripped as naive datetimes, so the frontend parsed them as local time instead of UTC
 
 See git history for the fix-by-fix breakdown (commits `f13f685`, `50a43ae`, `933760e`, and the
-B-28/B-29/B-30/B-31/B-32/B-33/B-34 fixes). Suite grew from 139 to 194 tests over the ten.
+B-28/B-29/B-30/B-31/B-32/B-33/B-34/B-35 fixes). Suite grew from 139 to 198 tests over the eleven.
 
 A full-codebase audit on 2026-07-26 (commit `d4e0974`) found 24 bugs across every Python
 module under `app/`, both static frontends, and the Docker/Caddy deployment — 5 critical,