Replace deprecated datetime.utcnow with shared naive-UTC helper

All 29 call sites now use app.timeutil.utcnow(), which returns naive
UTC via the non-deprecated API. Semantics are unchanged on purpose:
every datetime column is TIMESTAMP WITHOUT TIME ZONE, so going aware
here would poison naive/aware comparisons. The TIMESTAMPTZ migration
(Phase 2) now has a single place to change. (BE-01)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/api/v1/endpoints/accounts.py

@@ -5,6 +5,7 @@ from sqlmodel import Session, select
 
 from app.auth import get_current_user
 from app.db import get_session
+from app.timeutil import utcnow
 from app.models.models import Account, AccountCreate, AccountRead, AccountUpdate
 
 router = APIRouter(prefix="/accounts", tags=["accounts"])
@@ -44,7 +45,7 @@ def update_account(
     update_data = data.model_dump(exclude_unset=True)
     for key, value in update_data.items():
         setattr(account, key, value)
-    account.updated_at = datetime.utcnow()
+    account.updated_at = utcnow()
     session.add(account)
     session.commit()
     session.refresh(account)

backend/app/api/v1/endpoints/budget.py

@@ -7,6 +7,7 @@ from sqlmodel import Session, select
 
 from app.auth import get_current_user
 from app.db import get_session
+from app.timeutil import utcnow
 from app.models.models import (
     BalanceOverride,
     BalanceOverrideCreate,
@@ -259,7 +260,7 @@ def upsert_balance_override(
 
     if existing:
         existing.override_balance = data.override_balance
-        existing.updated_at = datetime.utcnow()
+        existing.updated_at = utcnow()
         session.add(existing)
         session.commit()
         session.refresh(existing)

backend/app/api/v1/endpoints/savings_accrual.py

@@ -5,6 +5,7 @@ from sqlmodel import Session, col, select
 
 from app.auth import get_current_user
 from app.db import get_session
+from app.timeutil import utcnow
 from app.models.models import (
     SavingsAccrual,
     SavingsAccrualCreate,
@@ -44,7 +45,7 @@ def create_accrual(
             detail=f"Accrual for {data.year}-{data.month:02d} already exists (id={existing.id})",
         )
     accrual = SavingsAccrual.model_validate(data)
-    accrual.applied_at = datetime.utcnow()
+    accrual.applied_at = utcnow()
     session.add(accrual)
     session.commit()
     session.refresh(accrual)

backend/app/api/v1/endpoints/settings.py

@@ -5,6 +5,7 @@ from sqlmodel import Session, select
 
 from app.auth import get_current_user
 from app.db import get_session
+from app.timeutil import utcnow
 from app.models.models import UserSettings, UserSettingsRead, UserSettingsUpdate
 
 router = APIRouter(prefix="/settings", tags=["settings"])
@@ -52,7 +53,7 @@ def update_settings(
         settings = UserSettings(key="default", data=body.data)
     else:
         settings.data = body.data
-    settings.updated_at = datetime.utcnow()
+    settings.updated_at = utcnow()
     session.add(settings)
     session.commit()
     session.refresh(settings)

backend/app/api/v1/endpoints/tokens.py

@@ -8,6 +8,7 @@ from sqlmodel import Session, select
 
 from app.auth import get_current_user, hash_token
 from app.db import get_session
+from app.timeutil import utcnow
 from app.models.models import APIToken, APITokenCreate, APITokenRead
 
 router = APIRouter(prefix="/tokens", tags=["tokens"])
@@ -28,7 +29,7 @@ def create_token(
     plaintext = secrets.token_urlsafe(32)
     expires_at = None
     if data.expires_days:
-        expires_at = datetime.utcnow() + timedelta(days=data.expires_days)
+        expires_at = utcnow() + timedelta(days=data.expires_days)
 
     api_token = APIToken(
         name=data.name,