refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/user/guest.go

@@ -105,8 +105,16 @@ func CreateGuestUserHandler(w http.ResponseWriter, r *http.Request) {
 	// Each booking is a disposable account; we don't track identity across guest bookings.
 
 	// Create new guest user
+	tx, err := db.Conn.Begin(r.Context())
+	if err != nil {
+		log.Printf("Failed to begin transaction: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+	defer tx.Rollback(r.Context())
+
 	var userID string
-	err = db.Conn.QueryRow(r.Context(), `
+	err = tx.QueryRow(r.Context(), `
 		INSERT INTO users
 			(n_first_name, n_last_name, email, phone, date_of_birth,
 			 account_role, account_type, password_hash, privacy_policy_and_terms_consent)
@@ -120,9 +128,15 @@ func CreateGuestUserHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := tx.Commit(r.Context()); err != nil {
+		log.Printf("Failed to commit transaction: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
 	// Note: We intentionally don't sync to CardDAV - guests don't need calendar contacts
 
-	w.Header().Set("Content-Type", "application/json")
+
 	w.WriteHeader(http.StatusCreated)
 	json.NewEncoder(w).Encode(CreateGuestUserResponse{ID: userID, Role: "guest"})
 }
@@ -178,7 +192,7 @@ func CheckEmailHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
+
 	json.NewEncoder(w).Encode(map[string]interface{}{
 		"suggestion": suggestion,
 	})