Stamp UTC on naive API timestamps before serializing (B-35)

SQLite/aiosqlite returns DateTime columns as naive even though every
value is written in UTC, so a bare .isoformat() dropped the offset and
the frontend's new Date() parsed it as local time. Add a shared
isoformat_utc() helper and use it at every call site that was missing
the fix already applied ad hoc in rounds.py.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/routes/users.py

@@ -4,6 +4,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.errors import http_error
+from app.api.timeutil import isoformat_utc
 from app.auth.dependencies import get_current_user
 from app.auth.security import MIN_PASSWORD_LENGTH, create_access_token, hash_password, verify_password
 from app.db.models import Round, RoundParticipant, User
@@ -36,7 +37,7 @@ async def me(
         balance_sats=user.cached_balance_sats,
         pending_balance_sats=pending_balance_sats,
         has_pending=has_pending,
-        created_at=user.created_at.isoformat(),
+        created_at=isoformat_utc(user.created_at),
     )