refactor(api): shared serializer + ownership + write-scope helpers (R6 S1a)

Establish the R6 API-contract infra before the S1b payload:dict migration:
- iso(dt) in utils.py replaces the ~16 hand-rolled `x.isoformat() if x else None`
  serializer idioms across the routes.
- get_or_404 / owned_or_404 in routes/_common.py — one 404 + existence-leak policy;
  plex's _own_playlist_or_404 and saved_views' _own_view now delegate to it.
- require_write_scope dependency in auth.py collapses the inline has_write_scope→403
  checks (channels subscribe/unsubscribe, playlists push/push-plan) that had drifted
  into three different messages into one; the conditional delete_playlist guard stays
  inline (its message was already canonical).

No response-shape change (iso == isoformat for a present value). Gate: ruff clean,
pytest 163 green (+ test_utils for iso).

backend/app/auth.py

@@ -1010,6 +1010,19 @@ def require_human(user: User = Depends(current_user)) -> User:
     return user
 
 
+def require_write_scope(user: User = Depends(require_human)) -> User:
+    """Dependency: require the YouTube write scope (subscribe/unsubscribe, playlist export/edit).
+    Single source of truth for the write gate — replaces the inline `if not has_write_scope(user)`
+    checks that had drifted into three different 403 messages across channels/playlists. Layers on
+    `require_human` because writing to YouTube needs a real, non-demo identity."""
+    if not has_write_scope(user):
+        raise HTTPException(
+            status_code=403,
+            detail="Enable YouTube editing in Settings first.",
+        )
+    return user
+
+
 def admin_user(user: User = Depends(current_user)) -> User:
     """Dependency: require the signed-in user to be an admin. Single source of truth for the
     admin gate — every admin route/action depends on this rather than re-checking the role."""