feat(dates): foundation for the true-instant date contract (#114)

Populate the new-contract date columns at ingest while keeping the
legacy date_taken column byte-identical (ADR-0001):

- camera_tz module: offset cascade (offset tag -> GPS zone -> server
  zone) as a pure, testable function; bundled offline TZF geometry for
  GPS -> IANA resolution; DST-correct offsets for the capture date;
  display-zone helpers (DEFAULT_DISPLAY_TZ, display_zone_for,
  display_zone_offset_minutes) for the read-side cutover.
- EXIF branch: kamadak-exif now collects OffsetTime* tags paired with
  the winning date tag; resolve_date_taken takes an ExifPrior and
  emits (date_utc, camera_offset_minutes, date_taken_tz_source) per
  branch: exif -> cascade, exiftool/fs_time -> utc_direct, filename
  -> unclassified (pending #116).
- Schema: migration adds image_exif.date_utc /
  camera_offset_minutes / date_taken_tz_source and
  user_ai_prefs.display_tz (all nullable; down.sql drops them).
- DAO + ingest: backfill_date_taken persists the triple alongside the
  legacy pair; watcher, upload, and set_image_gps call sites feed the
  cascade.
- Response surface: ExifMetadata and ExifSummary carry the triple so
  /image/metadata and /photos/exif expose it (null for unconverted
  rows); reel requests mirror display_tz into prefs.

cargo build + clippy clean; 625 lib + 702 bin tests pass (the one
failing doctest in utils.rs is pre-existing at the base commit).

src/reels/mod.rs

@@ -103,6 +103,7 @@ fn capture_prefs(
             ),
             library: Some(library),
             updated_at: now as i64,
+            display_tz: req.display_tz.clone().filter(|s| !s.is_empty()),
         },
     )
     .map_err(|e| anyhow::anyhow!("failed to upsert user_ai_prefs: {e}"))
@@ -351,6 +352,12 @@ pub struct CreateReelRequest {
     pub span: Option<MemoriesSpan>,
     #[serde(default)]
     pub timezone_offset_minutes: Option<i32>,
+    /// User's display time zone as an IANA name (DST-proof; e.g.
+    /// "America/New_York"). Mirrored into `user_ai_prefs.display_tz`.
+    /// When omitted, the stored display zone is unchanged (NULL = app
+    /// default). The legacy offset above is still mirrored for rollback.
+    #[serde(default)]
+    pub display_tz: Option<String>,
     #[serde(default)]
     pub library: Option<String>,
     /// Cloned TTS voice for the narration; server default when omitted.