Stamp UTC on naive API timestamps before serializing (B-35)

SQLite/aiosqlite returns DateTime columns as naive even though every
value is written in UTC, so a bare .isoformat() dropped the offset and
the frontend's new Date() parsed it as local time. Add a shared
isoformat_utc() helper and use it at every call site that was missing
the fix already applied ad hoc in rounds.py.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_api_timeutil.py

@@ -0,0 +1,21 @@
+from datetime import datetime, timezone
+
+from app.api.timeutil import isoformat_utc
+
+
+def test_naive_datetime_is_stamped_utc():
+    # SQLite/aiosqlite round-trips DateTime columns as naive even though every
+    # value written is UTC (app.db.models.utcnow) — this is the exact shape
+    # returned by the ORM after a read (B-35).
+    naive = datetime(2026, 7, 27, 6, 56, 47, 489110)
+    result = isoformat_utc(naive)
+    assert result == "2026-07-27T06:56:47.489110+00:00"
+
+
+def test_aware_datetime_is_left_unchanged():
+    aware = datetime(2026, 7, 27, 6, 56, 47, tzinfo=timezone.utc)
+    assert isoformat_utc(aware) == aware.isoformat()
+
+
+def test_none_passes_through():
+    assert isoformat_utc(None) is None