refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/ratelimit_test.go

@@ -7,6 +7,8 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"crussell/clock"
 )
 
 // TestProgressiveRateLimiter_SingleRequest verifies no delay for first request.
@@ -60,12 +62,12 @@ func TestProgressiveRateLimiter_SustainedAllowsNormal(t *testing.T) {
 		state, exists := prl.requests[ip]
 		if !exists {
 			prl.requests[ip] = &ipProgressiveState{
-				timestamps: []time.Time{time.Now().Add(-time.Duration(60-i*2) * time.Second)},
+				timestamps: []time.Time{clock.Now().Add(-time.Duration(60-i*2) * time.Second)},
 			}
 			prl.mu.Unlock()
 			continue
 		}
-		state.timestamps = append(state.timestamps, time.Now().Add(-time.Duration(60-i*2)*time.Second))
+		state.timestamps = append(state.timestamps, clock.Now().Add(-time.Duration(60-i*2)*time.Second))
 		prl.mu.Unlock()
 	}
 
@@ -81,7 +83,7 @@ func TestProgressiveRateLimiter_ExcessSustainedDelays(t *testing.T) {
 	prl := NewProgressiveRateLimiter()
 	ip := "192.168.1.3"
 
-	now := time.Now()
+	now := clock.Now()
 	prl.mu.Lock()
 	state := &ipProgressiveState{timestamps: make([]time.Time, 130)}
 	for i := 0; i < 130; i++ {
@@ -118,7 +120,7 @@ func TestProgressiveRateLimiter_CleanupRemovesStaleEntries(t *testing.T) {
 
 	prl.mu.Lock()
 	prl.requests["stale-ip"] = &ipProgressiveState{
-		timestamps: []time.Time{time.Now().Add(-120 * time.Second)},
+		timestamps: []time.Time{clock.Now().Add(-120 * time.Second)},
 	}
 	prl.mu.Unlock()