refactor(api): shared serializer + ownership + write-scope helpers (R6 S1a)

Establish the R6 API-contract infra before the S1b payload:dict migration:
- iso(dt) in utils.py replaces the ~16 hand-rolled `x.isoformat() if x else None`
  serializer idioms across the routes.
- get_or_404 / owned_or_404 in routes/_common.py — one 404 + existence-leak policy;
  plex's _own_playlist_or_404 and saved_views' _own_view now delegate to it.
- require_write_scope dependency in auth.py collapses the inline has_write_scope→403
  checks (channels subscribe/unsubscribe, playlists push/push-plan) that had drifted
  into three different messages into one; the conditional delete_playlist guard stays
  inline (its message was already canonical).

No response-shape change (iso == isoformat for a present value). Gate: ruff clean,
pytest 163 green (+ test_utils for iso).

backend/app/routes/playlists.py

@@ -6,7 +6,7 @@ from sqlalchemy import func, select, and_
 from sqlalchemy.orm import Session, aliased
 
 from app import quota
-from app.auth import current_user, has_read_scope, has_write_scope
+from app.auth import current_user, has_read_scope, has_write_scope, require_write_scope
 from app.db import get_db
 from app.models import Channel, Playlist, PlaylistItem, User, Video, VideoState
 from app.routes.feed import _serialize, feed_columns
@@ -316,16 +316,13 @@ def _pushable(db: Session, user: User, playlist_id: int) -> Playlist:
 @router.get("/{playlist_id}/push-plan")
 def push_plan(
     playlist_id: int,
-    user: User = Depends(current_user),
+    user: User = Depends(require_write_scope),
     db: Session = Depends(get_db),
 ) -> dict:
     """Dry run: what 'Sync to YouTube' would do + the quota estimate, so the UI can show a
-    confirm. For a linked playlist this reads the live YouTube state (cheap, 1 unit/page)."""
+    confirm. For a linked playlist this reads the live YouTube state (cheap, 1 unit/page).
+    Write scope is required (require_write_scope) — syncing is a YouTube write."""
     pl = _pushable(db, user, playlist_id)
-    if not has_write_scope(user):
-        raise HTTPException(
-            status_code=403, detail="Enable YouTube editing in Settings first."
-        )
     try:
         with quota.attribute(user.id, quota.QuotaAction.PLAYLISTS_PUSH):
             plan = plan_push(db, user, pl)
@@ -339,17 +336,13 @@ def push_plan(
 @router.post("/{playlist_id}/push")
 def push(
     playlist_id: int,
-    user: User = Depends(current_user),
+    user: User = Depends(require_write_scope),
     db: Session = Depends(get_db),
 ) -> dict:
     """Push a local playlist to YouTube (create it on first push, else reconcile to match
     local — local wins). Refuses if the estimated quota exceeds what's left today, so a
-    big playlist can't strand half-pushed."""
+    big playlist can't strand half-pushed. Write scope required (require_write_scope)."""
     pl = _pushable(db, user, playlist_id)
-    if not has_write_scope(user):
-        raise HTTPException(
-            status_code=403, detail="Enable YouTube editing in Settings first."
-        )
     try:
         with quota.attribute(user.id, quota.QuotaAction.PLAYLISTS_PUSH):
             # Read the live playlist ONCE (linked playlists only) and share it with both the