refactor(api): code-review fixes — widen iso() to date, fix import order (R6 S1a)

/code-review high round 1 (5 findings):
- iso(dt) now typed `date | None` — MediaAsset.upload_date is a plain `date`, not a
  datetime; the helper's signature was too narrow for the type-contract epic. +test.
- restore alphabetical app.* import order in audit.py and plex.py (the new iso/_common
  imports had been dropped in mid-block).
The other 3 findings are deliberate design choices, left as-is for UAT: push/push-plan
now gate write-scope before the 404 (dependency ordering); the unified 403 message; and
owned_or_404's owner_attr kept for S1b's DownloadShare.to_user_id-style owners.

Gate: ruff clean, pytest 164 green.

backend/app/routes/audit.py

@@ -10,9 +10,9 @@ from sqlalchemy.orm import Session
 from app import audit
 from app.audit import AuditAction
 from app.db import get_db
-from app.utils import iso
 from app.models import AuditLog, User
 from app.routes.admin import admin_user
+from app.utils import iso
 
 router = APIRouter(prefix="/api/admin/audit", tags=["admin"])