feat: times in the reader's own zone; the audit log shows exact moments (milestone 490)

- users.time_zone (0034). An account without one takes the browser's zone
  on its first page (POST /account/time-zone/adopt, never over a choice made
  by hand); the session follows the account on every request.
- /account: who you are and the zone every page writes its times in,
  reached from your name in the sidebar.
- formatting.when: 'Today 06:58', 'Yesterday 23:41', 'Tue 6 Oct 14:12',
  '6 Oct 2025 14:12', 24-hour, in the reader's zone; |ago's hover is the
  exact local moment instead of UTC; tz_label() for column headers.
- Audit log: When (EDT) with exact times, one detail fact a line, on classes.
- tzdata in the image, and the airgapped smoke checks a zone resolves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/models/users.py

@@ -36,3 +36,7 @@ class User(Base):
     auth_source: Mapped[str] = mapped_column(String(16), nullable=False, default="local", server_default="local")
     # The provider's stable id: the LDAP entry DN, or the OIDC `sub`. None for local users.
     external_id: Mapped[str | None] = mapped_column(String(512), nullable=True)
+    # The IANA zone this user reads times in (milestone 490), e.g.
+    # "America/New_York". Their browser's zone is saved the first time they
+    # sign in without one; they change it on the Account page. None reads as UTC.
+    time_zone: Mapped[str | None] = mapped_column(String(64), nullable=True)