fix(audit-wave-11): asset hygiene + datetime correctness

**asset-auditor C1+C2+H1+H3 — image normalization**

Add `src/lib/services/image-normalize.ts` and wire it into
`uploadFile()` so every accepted image is re-encoded via sharp before
hitting storage:

- Strips EXIF (GPS coords, device serial, photographer) so uploaded
  photos don't leak per-pixel PII to anyone with a download URL (C1).
- Caps dimensions at 4096px via `resize({fit:'inside',withoutEnlargement:true})`
  so a 30000×30000 palette PNG can't decompression-bomb a downstream
  sharp decode (C2).
- Re-encode drops polyglot trailers (PDF+JPEG sandwiches that beat
  the prefix-only magic-byte check) (H1).
- Freezes animated GIFs to first frame (H3).

Avatar route already funnels through uploadFile so it's covered by
the single change.

**asset-auditor M2 — sanitizeFilename strips RTL/zero-width**

Add Unicode NFC + a strip of bidi-control (U+202A-U+202E, U+2066-U+2069)
+ zero-width chars (U+200B-U+200F, U+FEFF) to `sanitizeFilename`.
Closes the classic Windows-icon-spoof vector
(`invoice_‮fdp.exe` displaying as `invoice_exe.pdf`) plus folder-listing
collision spoofs.

**datetime-auditor C1 — reminder dueAt drift on every save**

The `<input type="datetime-local">` round-trip in reminder-form.tsx
used `iso.slice(0,16)` (load) and `new Date(value).toISOString()`
(submit). The slice drops the `Z` so a UTC instant is mis-interpreted
as local on load, then converted back to UTC on save — every save
of an existing Warsaw reminder drifted backwards by 2h (CEST). After
two saves the reminder appears at 06:00 instead of 10:00.

Add `toLocalDatetimeLocal(d: Date)` helper that builds the local
YYYY-MM-DDTHH:MM string from getter methods so the round-trip is
TZ-safe. snooze-dialog already did this correctly; the contact-log
dialog also uses the correct localIsoString pattern.

**datetime-auditor C2 — BullMQ cron in UTC, not port-local**

`upsertJobScheduler` defaulted `tz` to UTC. Patterns like
`0 8 * * *` were intended as "8 AM Warsaw" but fired at 09:00 winter
/ 10:00 summer. Pass `tz: process.env.SCHEDULER_TZ ?? 'Europe/Warsaw'`.
Sub-hourly / hourly patterns are TZ-invariant and stay UTC.

**datetime-auditor C3 — report-scheduler never advanced next_run_at**

The minutely scheduler selected `nextRunAt <= now()` and enqueued
generate-report — but never bumped nextRunAt. For weekly/monthly
reports this meant the job re-fired every single minute until a
human zeroed the row out, flooding recipients with dupes.

Now uses `cron-parser` (added as a dep) to compute the next fire
from `report.schedule` and UPDATEs the row BEFORE the enqueue.
Malformed cron expressions disable the row instead of re-attempting
every minute.

Tests 1315/1315. Migration 0058 applied via psql.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/queue/scheduler.ts

@@ -67,15 +67,36 @@ export async function registerRecurringJobs(): Promise<void> {
     { queue: 'maintenance', name: 'website-submissions-retention', pattern: '0 7 * * *' },
   ];
 
+  // BullMQ defaults `tz` to UTC. The cron patterns above are spelled
+  // in port-local time (e.g. "0 8 * * *" = 8 AM local), so without an
+  // explicit `tz` the jobs fire in UTC and silently drift across DST
+  // — twice a year the local firing time shifts by an hour and admin
+  // docs ("daily check at 8 AM") break. datetime-auditor C2.
+  //
+  // The CRM is single-port today (Port Nimara, Europe/Warsaw); when
+  // multi-port admin schedules ship, this should resolve per-job from
+  // the owning port's `ports.timezone`. SCHEDULER_TZ overrides for
+  // ops debugging without a redeploy.
+  const schedulerTz = process.env.SCHEDULER_TZ ?? 'Europe/Warsaw';
+
   for (const job of recurring) {
     const queue = getQueue(job.queue);
+    // Sub-hourly / hourly patterns are TZ-invariant; skip the `tz`
+    // option for them so a misconfigured SCHEDULER_TZ can't perturb
+    // them.
+    const tzInvariant = /^\*|\*\/\d+ \*|^0 \*/.test(job.pattern);
     await queue.upsertJobScheduler(
       job.name,
-      { pattern: job.pattern },
+      { pattern: job.pattern, ...(tzInvariant ? {} : { tz: schedulerTz }) },
       { data: {}, name: job.name },
     );
     logger.info(
-      { queue: job.queue, job: job.name, pattern: job.pattern },
+      {
+        queue: job.queue,
+        job: job.name,
+        pattern: job.pattern,
+        tz: tzInvariant ? 'UTC (invariant)' : schedulerTz,
+      },
       'Registered recurring job',
     );
   }