feat(dates): foundation for the true-instant date contract (#114)

Populate the new-contract date columns at ingest while keeping the
legacy date_taken column byte-identical (ADR-0001):

- camera_tz module: offset cascade (offset tag -> GPS zone -> server
  zone) as a pure, testable function; bundled offline TZF geometry for
  GPS -> IANA resolution; DST-correct offsets for the capture date;
  display-zone helpers (DEFAULT_DISPLAY_TZ, display_zone_for,
  display_zone_offset_minutes) for the read-side cutover.
- EXIF branch: kamadak-exif now collects OffsetTime* tags paired with
  the winning date tag; resolve_date_taken takes an ExifPrior and
  emits (date_utc, camera_offset_minutes, date_taken_tz_source) per
  branch: exif -> cascade, exiftool/fs_time -> utc_direct, filename
  -> unclassified (pending #116).
- Schema: migration adds image_exif.date_utc /
  camera_offset_minutes / date_taken_tz_source and
  user_ai_prefs.display_tz (all nullable; down.sql drops them).
- DAO + ingest: backfill_date_taken persists the triple alongside the
  legacy pair; watcher, upload, and set_image_gps call sites feed the
  cascade.
- Response surface: ExifMetadata and ExifSummary carry the triple so
  /image/metadata and /photos/exif expose it (null for unconverted
  rows); reel requests mirror display_tz into prefs.

cargo build + clippy clean; 625 lib + 702 bin tests pass (the one
failing doctest in utils.rs is pre-existing at the base commit).

migrations/2026-09-24-000000_add_true_utc_dates/down.sql

@@ -0,0 +1,4 @@
+ALTER TABLE user_ai_prefs DROP COLUMN display_tz;
+ALTER TABLE image_exif DROP COLUMN date_taken_tz_source;
+ALTER TABLE image_exif DROP COLUMN camera_offset_minutes;
+ALTER TABLE image_exif DROP COLUMN date_utc;

migrations/2026-09-24-000000_add_true_utc_dates/up.sql

@@ -0,0 +1,19 @@
+-- True-instant date contract (ADR-0001 / spec #113, ticket #114).
+--
+-- image_exif gains the new-contract columns alongside the untouched legacy
+-- `date_taken`:
+--   date_utc              — true UTC instant (unix seconds) under the new
+--                           contract; NULL while the row is still on the
+--                           legacy convention (drain pending).
+--   camera_offset_minutes — camera local − UTC in minutes that produced
+--                           date_utc (NULL for direct-UTC branches).
+--   date_taken_tz_source  — why the offset is what it is:
+--                           offset_tag | gps | assumed_server | utc_direct
+--                           | manual.
+-- user_ai_prefs gains the DST-proof display zone (IANA name); the legacy
+-- tz_offset_minutes column stays frozen for rollback.
+
+ALTER TABLE image_exif ADD COLUMN date_utc BIGINT;
+ALTER TABLE image_exif ADD COLUMN camera_offset_minutes INTEGER;
+ALTER TABLE image_exif ADD COLUMN date_taken_tz_source TEXT;
+ALTER TABLE user_ai_prefs ADD COLUMN display_tz TEXT;