Stamp UTC on naive API timestamps before serializing (B-35)

SQLite/aiosqlite returns DateTime columns as naive even though every
value is written in UTC, so a bare .isoformat() dropped the offset and
the frontend's new Date() parsed it as local time. Add a shared
isoformat_utc() helper and use it at every call site that was missing
the fix already applied ad hoc in rounds.py.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/timeutil.py

@@ -0,0 +1,17 @@
+from datetime import datetime, timezone
+
+
+def isoformat_utc(dt: datetime | None) -> str | None:
+    """Serialize a datetime for API responses, stamping it UTC first.
+
+    Every DateTime column is written via app.db.models.utcnow() but SQLite/aiosqlite
+    round-trips it as a naive datetime, so a bare .isoformat() drops the "Z"/offset
+    and JavaScript's `new Date()` on the frontend parses the result as local time
+    instead of UTC (B-35). All stored values are UTC in practice, so a naive value
+    can be safely stamped rather than converted.
+    """
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.isoformat()