chore(backend): deprecation sweep — Pydantic V1 -> V2, utcnow -> tz-aware

Two low-risk Pydantic V1 idioms that will be hard errors in V3:
  - Query(regex=...) -> Query(pattern=...) (audit_routes, control_generator_routes)
  - class Config: from_attributes=True -> model_config = ConfigDict(...)
    in source_policy_router.py (schemas.py is intentionally skipped — it is
    the Phase 1 schema-split target and the ConfigDict conversion is most
    efficient to do during that split).

Naive -> aware datetime sweep across 47 files:
  - datetime.utcnow() -> datetime.now(timezone.utc)
  - default=datetime.utcnow -> default=lambda: datetime.now(timezone.utc)
  - onupdate=datetime.utcnow -> onupdate=lambda: datetime.now(timezone.utc)

All SQLAlchemy DateTime columns in the project already declare
timezone=True, so the DB schema expects aware datetimes. Before this
commit, the in-Python side was generating naive values and the driver
was silently coercing them. This is a latent-bug fix, not a behavior
change at the DB boundary.

Verified:
  - 173/173 pytest compliance/tests/ pass (same as baseline)
  - tests/contracts/test_openapi_baseline.py passes (360 paths,
    484 operations unchanged)
  - DeprecationWarning count dropped from 158 -> 35

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/tests/test_compliance_routes.py

@@ -8,7 +8,7 @@ Run with: pytest compliance/tests/test_compliance_routes.py -v
 """
 
 import pytest
-from datetime import datetime
+from datetime import datetime, timezone
 from unittest.mock import MagicMock
 from uuid import uuid4
 
@@ -41,8 +41,8 @@ def sample_regulation():
         name="Datenschutz-Grundverordnung",
         full_name="Verordnung (EU) 2016/679",
         is_active=True,
-        created_at=datetime.utcnow(),
-        updated_at=datetime.utcnow(),
+        created_at=datetime.now(timezone.utc),
+        updated_at=datetime.now(timezone.utc),
     )
 
 
@@ -57,8 +57,8 @@ def sample_requirement(sample_regulation):
         description="Personenbezogene Daten duerfen nur verarbeitet werden, wenn eine Rechtsgrundlage vorliegt.",
         priority=4,
         is_applicable=True,
-        created_at=datetime.utcnow(),
-        updated_at=datetime.utcnow(),
+        created_at=datetime.now(timezone.utc),
+        updated_at=datetime.now(timezone.utc),
     )
 
 
@@ -74,8 +74,8 @@ def sample_ai_system():
         classification=AIClassificationEnum.UNCLASSIFIED,
         status=AISystemStatusEnum.DRAFT,
         obligations=[],
-        created_at=datetime.utcnow(),
-        updated_at=datetime.utcnow(),
+        created_at=datetime.now(timezone.utc),
+        updated_at=datetime.now(timezone.utc),
     )
 
 
@@ -96,8 +96,8 @@ class TestCreateRequirement:
             description="Geeignete technische Massnahmen",
             priority=3,
             is_applicable=True,
-            created_at=datetime.utcnow(),
-            updated_at=datetime.utcnow(),
+            created_at=datetime.now(timezone.utc),
+            updated_at=datetime.now(timezone.utc),
         )
 
         assert req.regulation_id == sample_regulation.id
@@ -196,7 +196,7 @@ class TestUpdateRequirement:
     def test_update_audit_status_sets_audit_date(self, sample_requirement):
         """Updating audit_status should set last_audit_date."""
         sample_requirement.audit_status = "compliant"
-        sample_requirement.last_audit_date = datetime.utcnow()
+        sample_requirement.last_audit_date = datetime.now(timezone.utc)
 
         assert sample_requirement.audit_status == "compliant"
         assert sample_requirement.last_audit_date is not None
@@ -287,7 +287,7 @@ class TestAISystemCRUD:
 
     def test_update_ai_system_with_assessment(self, sample_ai_system):
         """After assessment, system should have assessment_date and result."""
-        sample_ai_system.assessment_date = datetime.utcnow()
+        sample_ai_system.assessment_date = datetime.now(timezone.utc)
         sample_ai_system.assessment_result = {
             "overall_risk": "high",
             "risk_factors": [{"factor": "education sector", "severity": "high"}],