fix(auth): new users inherit the system-wide default timezone

default_timezone existed as a system setting (admin-editable, exposed
via SettingsRegistry.DefaultTimezone) but nothing read it at user
creation — the CreateUser query didn't even carry the column, so every
new user got the DB default UTC regardless. Both creation paths
(public register + admin create) now seed the user's timezone from the
setting, validated with time.LoadLocation and falling back to UTC when
unwired/empty/invalid.

Test-infra fixes surfaced by the run: TestUpdateProfileSelfEdit was
self-editing the SHARED admin (renaming it past the harness cleanup's
preserve-list, leaking a second admin row that broke the last-admin
tests) — it now edits a dedicated user with a unique name; the
last-admin tests get an ensureSingleAdmin precondition helper; the
websocket collection name is run-unique (non-test names persist in the
shared DB and UNIQUE(user_id,name) 409s on rerun).

cmd/server/tests/websocket_test.go

@@ -240,9 +240,11 @@ func TestWebSocketUserScopedBroadcast(t *testing.T) {
 	// Use pre-created admin user (setup.Token) and regular user (setup.RegularToken)
 	// Both users already created by setupTestServer()
 
-	// Create a collection for admin user
+	// Create a collection for admin user. Unique name: the shared DB keeps
+	// non-"test"-named collections across runs, and UNIQUE(user_id, name)
+	// turns a fixed name into a 409 on the second run.
 	collectionReq := map[string]interface{}{
-		"name":        "Admin Collection",
+		"name":        "Admin Collection " + uuid.New().String()[:8],
 		"description": "Test collection for WebSocket test",
 	}
 	collectionBody, _ := json.Marshal(collectionReq)