refactor(services): one periodic-task shape, one APScheduler job shape, one token hash, one summary rule — the services pass of the shape audit (#2830, milestone 296)

- background.start_periodic(interval, work, label=) replaces the three hand-rolled
  while-True/sleep/try loops in logging, auth and notifications.
- services/scheduler.ScheduledJob replaces the four private BackgroundScheduler
  copies in recurrence/version_pinning/trash/db_maintenance schedulers; public
  start_/stop_/reschedule_ surfaces unchanged.
- api_keys.hash_token is the one sha256 helper; auth.py used to inline it 5x.
- auth.is_registration_open reads via settings.get_admin_setting; notification
  prefs read via settings.get_setting; _fire_share_email uses _get_user_email.
- projects.get_project_summary / milestones.get_project_milestone_summary are
  now the one-id view of their batch siblings instead of a second copy of the
  queries; sharing.best_permission_by (was _deduplicate_by_permission) is the
  one rank-dedup, now also used by list_projects_for_user.
- backup: the row builders for every section both exporters carry are named
  functions, so a column added to one export cannot silently miss the other.
- iso() from models.base replaces the attr.isoformat()-if-attr-else-None idiom
  and db_maintenance._iso across services; backup keeps its explicit shape.
- trash.py hoists the sql_delete/timedelta imports it re-imported per function.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/services/sharing.py

@@ -10,6 +10,7 @@ from scribe.models.note import Note
 from scribe.models.project import Project
 from scribe.models.share import NoteShare, ProjectShare
 from scribe.models.user import User
+from scribe.models.base import iso
 
 logger = logging.getLogger(__name__)
 
@@ -31,7 +32,7 @@ async def _enrich_shares(session, shares) -> list[dict]:
     return result
 
 
-def _deduplicate_by_permission(shares, id_attr: str) -> dict[int, str]:
+def best_permission_by(shares, id_attr: str) -> dict[int, str]:
     """Return {resource_id: best_permission} keeping the highest-ranked permission per resource."""
     from scribe.services.access import PERMISSION_RANK
     seen: dict[int, str] = {}
@@ -210,7 +211,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                 )
             )).scalars().all()
 
-        seen_projects = _deduplicate_by_permission(list(proj_direct) + list(proj_group), "project_id")
+        seen_projects = best_permission_by(list(proj_direct) + list(proj_group), "project_id")
 
         projects = []
         for pid, perm in seen_projects.items():
@@ -223,7 +224,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                     "description": proj.description,
                     "status": proj.status,
                     "color": proj.color,
-                    "updated_at": proj.updated_at.isoformat(),
+                    "updated_at": iso(proj.updated_at),
                     "owner_username": owner.username if owner else None,
                     "permission": perm,
                 })
@@ -241,7 +242,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                 )
             )).scalars().all()
 
-        seen_notes = _deduplicate_by_permission(list(note_direct) + list(note_group), "note_id")
+        seen_notes = best_permission_by(list(note_direct) + list(note_group), "note_id")
 
         notes = []
         for nid, perm in seen_notes.items():
@@ -253,7 +254,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                     "title": note.title,
                     "is_task": note.is_task,
                     "project_id": note.project_id,
-                    "updated_at": note.updated_at.isoformat(),
+                    "updated_at": iso(note.updated_at),
                     "owner_username": owner.username if owner else None,
                     "permission": perm,
                 })