fix(admin): cascade base_url to opds/api URLs, fix pending registration time format

- UpdateSystemConfiguration: when base_url changes, automatically
  update opds_base_url and api_base_url derived configs
- convertPending: format time.Time as RFC3339 string instead of
  relying on string type assertion which would panic

internal/handlers/sidecar.go

@@ -417,6 +417,25 @@ func (h *SidecarHandler) UpdateSystemConfiguration(c *echo.Context) error {
 		}
 	}
 
+	if newBaseURL, ok := req["base_url"]; ok && newBaseURL != "" {
+		derivedConfigs := map[string]string{
+			"opds_base_url": newBaseURL + "/opds",
+			"api_base_url":  newBaseURL + "/api",
+		}
+		for derivedKey, derivedValue := range derivedConfigs {
+			_, err := h.db.SetSystemConfig(ctx, database.SetSystemConfigParams{
+				Key:       derivedKey,
+				Value:     derivedValue,
+				UpdatedBy: pgUserID,
+			})
+			if err != nil {
+				return c.JSON(http.StatusInternalServerError, map[string]string{
+					"error": fmt.Sprintf("failed to update derived config key: %s", derivedKey),
+				})
+			}
+		}
+	}
+
 	// Check for HTMX request
 	if c.Request().Header.Get("HX-Request") == "true" {
 		// Fetch updated base_url for template

internal/router/helpers.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"log"
 	"net/url"
+	"time"
 
 	"bookhoard/internal/database"
 	"bookhoard/templates"
@@ -66,7 +67,7 @@ func convertPending(pending []map[string]interface{}) []templates.PendingRegistr
 			RegistrationID: p["registration_id"].(string),
 			DeviceName:     p["device_name"].(string),
 			DeviceType:     p["device_type"].(string),
-			ExpiresAt:      p["expires_at"].(string),
+			ExpiresAt:      p["expires_at"].(time.Time).Format(time.RFC3339),
 		}
 	}
 	return result