fix(api): 收到 API 时钟的 repo 写操作一律用它打时间戳，不再和 PG now() 混用

internal/api/session.go

@@ -114,6 +114,7 @@ func (a *API) mintSession(r *http.Request, userID string, proof signInProof) (st
 	return token, NewSession{
 		TokenHash: hashCookie(token),
 		UserID:    userID,
+		CreatedAt: now,
 		ExpiresAt: expires,
 		UserAgent: truncateUTF8(r.UserAgent(), maxSessionUserAgent),
 		ClientIP:  ip,