M9 S5 (backend): _serialize_device adopts common.iso()

The two `x.isoformat() if x else None` copies in auth's device serializer
now use the shared iso() helper — completes the isoformat-idiom sweep
outside notes.py (auth + sync done; notes.py's remain, tied to its split).
_serialize_user is unchanged (no datetime, no cross-module duplicate) and
stays in auth.py rather than relocating for no DRY gain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

src/thoughtsync/auth.py

@@ -7,6 +7,7 @@ from datetime import datetime, timezone
 from quart import Blueprint, g, jsonify, request, session
 from sqlalchemy import func, select
 
+from .common import iso
 from .db import session_scope
 from .models.device_token import DeviceToken
 from .models.user import User
@@ -182,8 +183,8 @@ def _serialize_device(d: DeviceToken) -> dict:
     return {
         "id": str(d.id),
         "name": d.name,
-        "created_at": d.created_at.isoformat() if d.created_at else None,
-        "last_used_at": d.last_used_at.isoformat() if d.last_used_at else None,
+        "created_at": iso(d.created_at),
+        "last_used_at": iso(d.last_used_at),
     }