refactor(api): code-review fixes — widen iso() to date, fix import order (R6 S1a)

/code-review high round 1 (5 findings):
- iso(dt) now typed `date | None` — MediaAsset.upload_date is a plain `date`, not a
  datetime; the helper's signature was too narrow for the type-contract epic. +test.
- restore alphabetical app.* import order in audit.py and plex.py (the new iso/_common
  imports had been dropped in mid-block).
The other 3 findings are deliberate design choices, left as-is for UAT: push/push-plan
now gate write-scope before the 404 (dependency ordering); the unified 403 message; and
owned_or_404's owner_attr kept for S1b's DownloadShare.to_user_id-style owners.

Gate: ruff clean, pytest 164 green.

backend/app/utils.py

@@ -1,12 +1,13 @@
 """Small cross-cutting helpers shared across modules (kept dependency-light on purpose)."""
 import re
-from datetime import datetime, timezone
+from datetime import date, datetime, timezone
 
 
-def iso(dt: datetime | None) -> str | None:
-    """Serialize a datetime for a JSON response: ISO-8601, or None when the column is NULL.
-    Single source of truth for the `x.isoformat() if x else None` idiom the routes had
-    hand-rolled ~17 times — so a future tz/format tweak lands in one place."""
+def iso(dt: date | None) -> str | None:
+    """Serialize a date/datetime for a JSON response: ISO-8601, or None when the column is
+    NULL. Single source of truth for the `x.isoformat() if x else None` idiom the routes had
+    hand-rolled ~17 times — so a future tz/format tweak lands in one place. Accepts `date`
+    too (datetime is a subclass) — e.g. MediaAsset.upload_date is a plain `date`."""
     return dt.isoformat() if dt is not None else None
 
 # Single source of truth for "looks like an email" — used by every endpoint that accepts an