refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/user/gdpr_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	"crussell/clock"
 	"crussell/testutils"
 	"crussell/mw"
 	"crussell/testutils/fixtures"
@@ -86,7 +87,7 @@ func TestGDPRExport_CacheHit(t *testing.T) {
 	gdprExportCacheMu.Lock()
 	gdprExportCache[userID] = &gdprCacheEntry{
 		data:      testData,
-		expiresAt: time.Now().Add(12 * time.Hour),
+		expiresAt: clock.Now().Add(12 * time.Hour),
 	}
 	gdprExportCacheMu.Unlock()
 
@@ -127,7 +128,7 @@ func TestGDPRExport_CacheGenerating(t *testing.T) {
 	gdprExportCacheMu.Lock()
 	gdprExportCache[userID] = &gdprCacheEntry{
 		generating: true,
-		expiresAt:  time.Now().Add(12 * time.Hour),
+		expiresAt:  clock.Now().Add(12 * time.Hour),
 	}
 	gdprExportCacheMu.Unlock()
 
@@ -172,7 +173,7 @@ func TestGDPRExport_ExpiredCacheTriggersRegeneration(t *testing.T) {
 	gdprExportCacheMu.Lock()
 	gdprExportCache[userID] = &gdprCacheEntry{
 		data:      json.RawMessage(`{"old":"data"}`),
-		expiresAt: time.Now().Add(-1 * time.Hour),
+		expiresAt: clock.Now().Add(-1 * time.Hour),
 	}
 	gdprExportCacheMu.Unlock()
 
@@ -1017,7 +1018,7 @@ func TestAnonymizeStaleGuestAccounts_ScrubsAdditionalFields(t *testing.T) {
 		t.Fatalf("failed to update guest fields: %v", err)
 	}
 
-	staleTime := time.Now().Add(-7 * 30 * 24 * time.Hour)
+	staleTime := clock.Now().Add(-7 * 30 * 24 * time.Hour)
 	_, err = tx.Exec(ctx, `
 		INSERT INTO bookings (user_id, start_time, status)
 		VALUES ($1, $2, 'completed')
@@ -1095,7 +1096,7 @@ func TestAnonymizeStaleGuestAccounts_DoesNotAffectActiveGuests(t *testing.T) {
 		t.Fatalf("failed to update guest fields: %v", err)
 	}
 
-	recentTime := time.Now().Add(24 * time.Hour)
+	recentTime := clock.Now().Add(24 * time.Hour)
 	_, err = tx.Exec(ctx, `
 		INSERT INTO bookings (user_id, start_time, status)
 		VALUES ($1, $2, 'pending')