fix(db): read the clock as UTC in raw SQL and prove it on a Berlin database

Every raw-SQL clock read against a timestamp column without a zone now
writes NOW() AT TIME ZONE 'UTC', so passkey and login challenges, rate
limits, provider pauses, coach usage stamps, tombstone and measurement
windows no longer pass through the session time zone even where the
per-connection pin cannot apply. The regression-window bounds stay naive
UTC timestamps instead of being turned into timestamptz. A structural
guard keeps bare NOW() / CURRENT_TIMESTAMP out of raw SQL outside a short
list of timestamptz targets. The integration test sets the database
default to Europe/Berlin and drives challenge claims, session expiry, the
native sign-in handoff freshness check and the rate-limit window through
the app's client, plus the challenge claim through an unpinned client.
Self-hosting docs describe the pin for an existing or shared Postgres.

src/app/api/measurements/series/route.ts

@@ -378,7 +378,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
           AND "type" = 'BLOOD_PRESSURE_SYS'::"measurement_type"
           AND "deleted_at" IS NULL
           AND "value" >= $3
-          AND "measured_at" >= date_trunc('day', $2::timestamptz)
+          AND "measured_at" >= date_trunc('day', $2::timestamptz AT TIME ZONE 'UTC')
         ORDER BY date_trunc('day', "measured_at"), (${rank}), "source"::text
       ) c
         ON c.d = date_trunc('day', m."measured_at")