fix(api): 收到 API 时钟的 repo 写操作一律用它打时间戳，不再和 PG now() 混用

internal/api/repo.go

@@ -212,6 +212,9 @@ type SessionedUser struct {
 type NewSession struct {
 	TokenHash string
 	UserID    string
+	// CreatedAt is the sign-in instant on the API clock: the session is created
+	// and last seen then, so the staff idle cutoff (also API clock) measures it.
+	CreatedAt time.Time
 	ExpiresAt time.Time
 	UserAgent string
 	ClientIP  string