fix(tz): server-side timezone conversion for all user-facing time displays

The audit showed only 5 of ~11 time-display surfaces converted to the
user's timezone; everything else rendered pgx-decoded UTC. The server
owns conversion — clients (web/app/KOReader) receive display-ready
strings or machine-readable instants and never convert.

- Progress page: LastUpdated formatted in the requesting user's tz
  (was raw UTC).
- Analytics: date-range defaults, day buckets, most-active-day, device
  last-sync, and popular-book last-read all computed in the user's tz —
  evening sessions no longer land on the next UTC day. Also fixed the
  end-date boundary: the query bounds with <= and the end bound was
  midnight, so the end date's own sessions (including 'today') never
  appeared.
- Queue page: new created_at_display field (admin tz) rendered by the
  template; created_at stays RFC3339 for API consumers.
- Admin hash-conflicts SSR bridge: detected date rendered in the
  admin's tz.
- OPDS: .UTC() before the Z-suffixed feed timestamps (honesty fix —
  correct today only because the session zone happens to be UTC).
- KOReader annotation datetimes deliberately untouched (device owns its
  display).

internal/handlers/opds.go

@@ -402,7 +402,7 @@ func (h *OPDSHandler) addAcquisitionEntries(ctx context.Context, feed *opds.Feed
 			author = item.Author.String
 		}
 
-		updated := item.UpdatedAt.Time.Format("2006-01-02T15:04:05Z")
+		updated := item.UpdatedAt.Time.UTC().Format("2006-01-02T15:04:05Z")
 
 		entry := opds.NewEntry(
 			fmt.Sprintf("urn:uuid:%s", bookUUID),
@@ -706,7 +706,7 @@ func (h *OPDSHandler) SearchDeviceCatalog(c *echo.Context) error {
 			author = item.Author.String
 		}
 
-		updated := item.UpdatedAt.Time.Format("2006-01-02T15:04:05Z")
+		updated := item.UpdatedAt.Time.UTC().Format("2006-01-02T15:04:05Z")
 
 		entry := opds.NewEntry(
 			fmt.Sprintf("urn:uuid:%s", bookUUID),