chore(backend): deprecation sweep — Pydantic V1 -> V2, utcnow -> tz-aware

Two low-risk Pydantic V1 idioms that will be hard errors in V3:
  - Query(regex=...) -> Query(pattern=...) (audit_routes, control_generator_routes)
  - class Config: from_attributes=True -> model_config = ConfigDict(...)
    in source_policy_router.py (schemas.py is intentionally skipped — it is
    the Phase 1 schema-split target and the ConfigDict conversion is most
    efficient to do during that split).

Naive -> aware datetime sweep across 47 files:
  - datetime.utcnow() -> datetime.now(timezone.utc)
  - default=datetime.utcnow -> default=lambda: datetime.now(timezone.utc)
  - onupdate=datetime.utcnow -> onupdate=lambda: datetime.now(timezone.utc)

All SQLAlchemy DateTime columns in the project already declare
timezone=True, so the DB schema expects aware datetimes. Before this
commit, the in-Python side was generating naive values and the driver
was silently coercing them. This is a latent-bug fix, not a behavior
change at the DB boundary.

Verified:
  - 173/173 pytest compliance/tests/ pass (same as baseline)
  - tests/contracts/test_openapi_baseline.py passes (360 paths,
    484 operations unchanged)
  - DeprecationWarning count dropped from 158 -> 35

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/db/isms_repository.py

@@ -10,7 +10,7 @@ Provides CRUD operations for ISO 27001 certification-related entities:
 """
 
 import uuid
-from datetime import datetime, date
+from datetime import datetime, date, timezone
 from typing import List, Optional, Dict, Any, Tuple
 
 from sqlalchemy.orm import Session as DBSession
@@ -94,11 +94,11 @@ class ISMSScopeRepository:
         import hashlib
         scope.status = ApprovalStatusEnum.APPROVED
         scope.approved_by = approved_by
-        scope.approved_at = datetime.utcnow()
+        scope.approved_at = datetime.now(timezone.utc)
         scope.effective_date = effective_date
         scope.review_date = review_date
         scope.approval_signature = hashlib.sha256(
-            f"{scope.scope_statement}|{approved_by}|{datetime.utcnow().isoformat()}".encode()
+            f"{scope.scope_statement}|{approved_by}|{datetime.now(timezone.utc).isoformat()}".encode()
         ).hexdigest()
 
         self.db.commit()
@@ -185,7 +185,7 @@ class ISMSPolicyRepository:
         policy.status = ApprovalStatusEnum.APPROVED
         policy.reviewed_by = reviewed_by
         policy.approved_by = approved_by
-        policy.approved_at = datetime.utcnow()
+        policy.approved_at = datetime.now(timezone.utc)
         policy.effective_date = effective_date
         policy.next_review_date = date(
             effective_date.year + (policy.review_frequency_months // 12),
@@ -193,7 +193,7 @@ class ISMSPolicyRepository:
             effective_date.day
         )
         policy.approval_signature = hashlib.sha256(
-            f"{policy.policy_id}|{approved_by}|{datetime.utcnow().isoformat()}".encode()
+            f"{policy.policy_id}|{approved_by}|{datetime.now(timezone.utc).isoformat()}".encode()
         ).hexdigest()
 
         self.db.commit()
@@ -472,7 +472,7 @@ class AuditFindingRepository:
         finding.verification_method = verification_method
         finding.verification_evidence = verification_evidence
         finding.verified_by = closed_by
-        finding.verified_at = datetime.utcnow()
+        finding.verified_at = datetime.now(timezone.utc)
 
         self.db.commit()
         self.db.refresh(finding)
@@ -644,7 +644,7 @@ class ManagementReviewRepository:
 
         review.status = "approved"
         review.approved_by = approved_by
-        review.approved_at = datetime.utcnow()
+        review.approved_at = datetime.now(timezone.utc)
         review.next_review_date = next_review_date
         review.minutes_document_path = minutes_document_path
 
@@ -761,7 +761,7 @@ class AuditTrailRepository:
             new_value=new_value,
             change_summary=change_summary,
             performed_by=performed_by,
-            performed_at=datetime.utcnow(),
+            performed_at=datetime.now(timezone.utc),
             checksum=hashlib.sha256(
                 f"{entity_type}|{entity_id}|{action}|{performed_by}".encode()
             ).hexdigest(),