chore(backend): deprecation sweep — Pydantic V1 -> V2, utcnow -> tz-aware

Two low-risk Pydantic V1 idioms that will be hard errors in V3:
  - Query(regex=...) -> Query(pattern=...) (audit_routes, control_generator_routes)
  - class Config: from_attributes=True -> model_config = ConfigDict(...)
    in source_policy_router.py (schemas.py is intentionally skipped — it is
    the Phase 1 schema-split target and the ConfigDict conversion is most
    efficient to do during that split).

Naive -> aware datetime sweep across 47 files:
  - datetime.utcnow() -> datetime.now(timezone.utc)
  - default=datetime.utcnow -> default=lambda: datetime.now(timezone.utc)
  - onupdate=datetime.utcnow -> onupdate=lambda: datetime.now(timezone.utc)

All SQLAlchemy DateTime columns in the project already declare
timezone=True, so the DB schema expects aware datetimes. Before this
commit, the in-Python side was generating naive values and the driver
was silently coercing them. This is a latent-bug fix, not a behavior
change at the DB boundary.

Verified:
  - 173/173 pytest compliance/tests/ pass (same as baseline)
  - tests/contracts/test_openapi_baseline.py passes (360 paths,
    484 operations unchanged)
  - DeprecationWarning count dropped from 158 -> 35

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/tests/test_dsr_routes.py

@@ -6,7 +6,7 @@ Pattern: app.dependency_overrides[get_db] for FastAPI DI.
 import uuid
 import os
 import sys
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 import pytest
 from fastapi import FastAPI
@@ -75,7 +75,7 @@ def db_session():
 
 def _create_dsr_in_db(db, **kwargs):
     """Helper to create a DSR directly in DB."""
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc)
     defaults = {
         "tenant_id": uuid.UUID(TENANT_ID),
         "request_number": f"DSR-2026-{str(uuid.uuid4())[:6].upper()}",
@@ -241,8 +241,8 @@ class TestListDSR:
         assert len(data["requests"]) == 2
 
     def test_list_overdue_only(self, db_session):
-        _create_dsr_in_db(db_session, deadline_at=datetime.utcnow() - timedelta(days=5), status="processing")
-        _create_dsr_in_db(db_session, deadline_at=datetime.utcnow() + timedelta(days=20), status="processing")
+        _create_dsr_in_db(db_session, deadline_at=datetime.now(timezone.utc) - timedelta(days=5), status="processing")
+        _create_dsr_in_db(db_session, deadline_at=datetime.now(timezone.utc) + timedelta(days=20), status="processing")
 
         resp = client.get("/api/compliance/dsr?overdue_only=true", headers=HEADERS)
         assert resp.status_code == 200
@@ -339,7 +339,7 @@ class TestDSRStats:
         _create_dsr_in_db(db_session, status="intake", request_type="access")
         _create_dsr_in_db(db_session, status="processing", request_type="erasure")
         _create_dsr_in_db(db_session, status="completed", request_type="access",
-                          completed_at=datetime.utcnow())
+                          completed_at=datetime.now(timezone.utc))
 
         resp = client.get("/api/compliance/dsr/stats", headers=HEADERS)
         assert resp.status_code == 200
@@ -561,9 +561,9 @@ class TestDeadlineProcessing:
 
     def test_process_deadlines_with_overdue(self, db_session):
         _create_dsr_in_db(db_session, status="processing",
-                          deadline_at=datetime.utcnow() - timedelta(days=5))
+                          deadline_at=datetime.now(timezone.utc) - timedelta(days=5))
         _create_dsr_in_db(db_session, status="processing",
-                          deadline_at=datetime.utcnow() + timedelta(days=20))
+                          deadline_at=datetime.now(timezone.utc) + timedelta(days=20))
 
         resp = client.post("/api/compliance/dsr/deadlines/process", headers=HEADERS)
         assert resp.status_code == 200
@@ -609,7 +609,7 @@ class TestDSRTemplates:
             subject="Bestaetigung",
             body_html="<p>Test</p>",
             status="published",
-            published_at=datetime.utcnow(),
+            published_at=datetime.now(timezone.utc),
         )
         db_session.add(v)
         db_session.commit()