refactor(api): shared serializer + ownership + write-scope helpers (R6 S1a)

Establish the R6 API-contract infra before the S1b payload:dict migration:
- iso(dt) in utils.py replaces the ~16 hand-rolled `x.isoformat() if x else None`
  serializer idioms across the routes.
- get_or_404 / owned_or_404 in routes/_common.py — one 404 + existence-leak policy;
  plex's _own_playlist_or_404 and saved_views' _own_view now delegate to it.
- require_write_scope dependency in auth.py collapses the inline has_write_scope→403
  checks (channels subscribe/unsubscribe, playlists push/push-plan) that had drifted
  into three different messages into one; the conditional delete_playlist guard stays
  inline (its message was already canonical).

No response-shape change (iso == isoformat for a present value). Gate: ruff clean,
pytest 163 green (+ test_utils for iso).

backend/app/routes/feed.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm.exc import StaleDataError
 from app import quota
 from app.auth import current_user
 from app.db import get_db
+from app.utils import iso
 from app.models import (
     LIVE_OR_UPCOMING,
     BlockedChannel,
@@ -97,7 +98,7 @@ def _serialize(row) -> dict:
         "channel_title": row.channel_title,
         "channel_thumbnail": row.channel_thumbnail,
         "channel_url": _channel_url(row.channel_id, row.channel_handle),
-        "published_at": row.published_at.isoformat() if row.published_at else None,
+        "published_at": iso(row.published_at),
         "thumbnail_url": row.thumbnail_url,
         "duration_seconds": row.duration_seconds,
         "view_count": row.view_count,
@@ -732,7 +733,7 @@ def get_video_detail(
             "in_db": True,
             "channel_id": v.channel_id,
             "channel_title": v.channel.title if v.channel else None,
-            "published_at": v.published_at.isoformat() if v.published_at else None,
+            "published_at": iso(v.published_at),
             "view_count": v.view_count,
             "duration_seconds": v.duration_seconds,
         }