refactor: move auth, GDPR, and booking cleanup to centralized scheduler

Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/user/gdpr_export.go

@@ -24,28 +24,20 @@ type gdprCacheEntry struct {
 	generating bool
 }
 
-func init() {
-	go func() {
-		ticker := time.NewTicker(5 * time.Minute)
-		defer ticker.Stop()
-		for range ticker.C {
-			func() {
-				defer func() {
-					if r := recover(); r != nil {
-						log.Printf("Panic recovered in GDPR export cache cleanup ticker: %v", r)
-					}
-				}()
-				gdprExportCacheMu.Lock()
-				now := clock.Now()
-				for k, v := range gdprExportCache {
-					if now.After(v.expiresAt) {
-						delete(gdprExportCache, k)
-					}
-				}
-				gdprExportCacheMu.Unlock()
-			}()
+// CleanupGDPRExportCache removes expired entries from the GDPR export cache.
+// Called by the centralised jobs scheduler.
+func CleanupGDPRExportCache(ctx context.Context) (int, error) {
+	gdprExportCacheMu.Lock()
+	defer gdprExportCacheMu.Unlock()
+	now := clock.Now()
+	var n int
+	for k, v := range gdprExportCache {
+		if now.After(v.expiresAt) {
+			delete(gdprExportCache, k)
+			n++
 		}
-	}()
+	}
+	return n, nil
 }
 
 // GET /api/user/gdpr-export