Stamp UTC on naive API timestamps before serializing (B-35)

SQLite/aiosqlite returns DateTime columns as naive even though every
value is written in UTC, so a bare .isoformat() dropped the offset and
the frontend's new Date() parsed it as local time. Add a shared
isoformat_utc() helper and use it at every call site that was missing
the fix already applied ad hoc in rounds.py.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_users.py

@@ -162,3 +162,17 @@ async def test_register_rejects_weak_credentials(client, payload):
 async def test_register_accepts_valid_credentials(client):
     resp = await client.post("/auth/register", json={"username": "goodname", "password": "longenough1"})
     assert resp.status_code == 201
+
+
+async def test_me_created_at_is_utc_stamped(client):
+    """B-35: SQLite/aiosqlite returns DateTime columns as naive, even though every
+    value written is UTC (app.db.models.utcnow). A bare .isoformat() on that naive
+    value has no "Z"/offset, and JavaScript's `new Date()` then parses it as local
+    time instead of UTC."""
+    token = await _register(client)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    resp = await client.get("/users/me", headers=headers)
+    assert resp.status_code == 200
+    created_at = resp.json()["created_at"]
+    assert created_at.endswith("+00:00") or created_at.endswith("Z")