Dates: true_instant on metadata responses for instant matching

The mobile viewer anchored its "messages around this photo" window on
the legacy date_taken (a wall clock stored as UTC for EXIF rows), while
SMS-API dates are true instants: the window was off by the photo's UTC
offset (4-5 h for photos taken at home; ImageApi #113 user story 3).
Verified SMS-API side: importers store backup epochs as UTC, and 40/40
sampled rows equal their source epochs exactly.

`/image/metadata` (+ GPS / date mutation responses) now carries
`true_instant` from `date_view::file_true_instant`: `row_true_instant`,
else the filename-class instant, else the earliest fs time. Server-side
for the same reason as `wall_clock`: the drain's permanent floor rows
have no `date_utc`. `set_capture_dates` fills both fields at all four
response sites.

dev/e2e: the manifest records each fixture's expected instant (the wall
read in its GPS zone, else America/New_York) and `e2e.sh check` asserts
it (97/97).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/data/mod.rs

@@ -263,6 +263,10 @@ pub struct MetadataResponse {
     /// (`2018-09-29T14:00:00`) — `date_view::file_wall_clock`. Render it
     /// verbatim; never zone-convert it (ADR-0001).
     pub wall_clock: Option<String>,
+    /// True instant of capture (unix seconds) — `date_view::file_true_instant`.
+    /// For instant-to-instant matching (SMS / location windows); never
+    /// render it, render `wall_clock`.
+    pub true_instant: Option<i64>,
 }
 
 impl From<fs::Metadata> for MetadataResponse {
@@ -281,7 +285,8 @@ impl From<fs::Metadata> for MetadataResponse {
             filename_date: None, // Will be set in endpoint handler
             library_id: None,
             library_name: None,
-            wall_clock: None, // Set in the endpoint handler
+            wall_clock: None,   // Set in the endpoint handler
+            true_instant: None, // Set in the endpoint handler
         }
     }
 }