chore(backend): deprecation sweep — Pydantic V1 -> V2, utcnow -> tz-aware

Two low-risk Pydantic V1 idioms that will be hard errors in V3:
  - Query(regex=...) -> Query(pattern=...) (audit_routes, control_generator_routes)
  - class Config: from_attributes=True -> model_config = ConfigDict(...)
    in source_policy_router.py (schemas.py is intentionally skipped — it is
    the Phase 1 schema-split target and the ConfigDict conversion is most
    efficient to do during that split).

Naive -> aware datetime sweep across 47 files:
  - datetime.utcnow() -> datetime.now(timezone.utc)
  - default=datetime.utcnow -> default=lambda: datetime.now(timezone.utc)
  - onupdate=datetime.utcnow -> onupdate=lambda: datetime.now(timezone.utc)

All SQLAlchemy DateTime columns in the project already declare
timezone=True, so the DB schema expects aware datetimes. Before this
commit, the in-Python side was generating naive values and the driver
was silently coercing them. This is a latent-bug fix, not a behavior
change at the DB boundary.

Verified:
  - 173/173 pytest compliance/tests/ pass (same as baseline)
  - tests/contracts/test_openapi_baseline.py passes (360 paths,
    484 operations unchanged)
  - DeprecationWarning count dropped from 158 -> 35

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/tests/test_legal_document_routes.py

@@ -7,7 +7,7 @@ Rejection-Flow, approval history.
 
 import pytest
 from unittest.mock import MagicMock, patch
-from datetime import datetime
+from datetime import datetime, timezone
 import uuid
 
 
@@ -27,7 +27,7 @@ def make_document(type='privacy_policy', name='Datenschutzerklärung', tenant_id
     doc.name = name
     doc.description = 'Test description'
     doc.mandatory = False
-    doc.created_at = datetime.utcnow()
+    doc.created_at = datetime.now(timezone.utc)
     doc.updated_at = None
     return doc
 
@@ -46,7 +46,7 @@ def make_version(document_id=None, version='1.0', status='draft', title='Test Ve
     v.approved_by = None
     v.approved_at = None
     v.rejection_reason = None
-    v.created_at = datetime.utcnow()
+    v.created_at = datetime.now(timezone.utc)
     v.updated_at = None
     return v
 
@@ -58,7 +58,7 @@ def make_approval(version_id=None, action='created'):
     a.action = action
     a.approver = 'admin@test.de'
     a.comment = None
-    a.created_at = datetime.utcnow()
+    a.created_at = datetime.now(timezone.utc)
     return a
 
 
@@ -179,7 +179,7 @@ class TestVersionToResponse:
         from compliance.api.legal_document_routes import _version_to_response
         v = make_version(status='approved')
         v.approved_by = 'dpo@company.de'
-        v.approved_at = datetime.utcnow()
+        v.approved_at = datetime.now(timezone.utc)
         resp = _version_to_response(v)
         assert resp.status == 'approved'
         assert resp.approved_by == 'dpo@company.de'
@@ -254,7 +254,7 @@ class TestApprovalWorkflow:
         # Step 2: Approve
         mock_db.reset_mock()
         _transition(mock_db, str(v.id), ['review'], 'approved', 'approved', 'dpo', 'Korrekt',
-                    extra_updates={'approved_by': 'dpo', 'approved_at': datetime.utcnow()})
+                    extra_updates={'approved_by': 'dpo', 'approved_at': datetime.now(timezone.utc)})
         assert v.status == 'approved'
 
         # Step 3: Publish