refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/admin/settings_test.go

@@ -528,11 +528,12 @@ func TestUpdateBusinessSettings_VatNumber_TooLong(t *testing.T) {
 	}
 }
 
-// TestUpdateBusinessSettings_VatNumber_Boundary accepts a 20-char VAT number.
+// TestUpdateBusinessSettings_VatNumber_Boundary accepts a valid UK VAT number.
 func TestUpdateBusinessSettings_VatNumber_Boundary(t *testing.T) {
 	ctx, _ := testutils.SetupTestTx(t)
 
-	vatNum := strings.Repeat("A", 20)
+	// Standard UK VAT number: GB + 9 digits
+	vatNum := "GB123456789"
 	handler := http.HandlerFunc(UpdateBusinessSettings)
 	body := UpdateBusinessSettingsRequest{
 		VATRegistrationNumber: stringPtr(vatNum),
@@ -550,6 +551,16 @@ func TestUpdateBusinessSettings_VatNumber_Boundary(t *testing.T) {
 	if s.VATRegistrationNumber == nil || *s.VATRegistrationNumber != vatNum {
 		t.Errorf("expected VAT number %q, got %v", vatNum, s.VATRegistrationNumber)
 	}
+
+	// UK branch VAT number: GB + 12 digits
+	branchVat := "GB123456789012"
+	body2 := UpdateBusinessSettingsRequest{
+		VATRegistrationNumber: stringPtr(branchVat),
+	}
+	w2 := makeAdminRequest(handler, "PUT", "/api/admin/settings", body2, ctx)
+	if w2.Code != http.StatusOK {
+		t.Errorf("expected status 200 for valid branch VAT number, got %d. body: %s", w2.Code, w2.Body.String())
+	}
 }
 
 // ─── website_url validation ──────────────────────────────────────────────────