refactor: move auth, GDPR, and booking cleanup to centralized scheduler

Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/clock/clock.go

@@ -1,3 +1,7 @@
+// Package clock provides the single source of truth for time across the
+// application. All wall-clock operations use Now() for UTC consistency with
+// the database. LondonLocation provides Europe/London for cron schedules and
+// scheduling calculations that depend on local business-closing rules.
 package clock
 
 import "time"
@@ -8,3 +12,13 @@ import "time"
 func Now() time.Time {
 	return time.Now().UTC()
 }
+
+// London is the Europe/London timezone location, used for cron schedules and
+// business-closing calculations.
+var London = func() *time.Location {
+	loc, err := time.LoadLocation("Europe/London")
+	if err != nil {
+		panic("clock: failed to load Europe/London timezone: " + err.Error())
+	}
+	return loc
+}()