refactor(api): code-review fixes — widen iso() to date, fix import order (R6 S1a)

/code-review high round 1 (5 findings):
- iso(dt) now typed `date | None` — MediaAsset.upload_date is a plain `date`, not a
  datetime; the helper's signature was too narrow for the type-contract epic. +test.
- restore alphabetical app.* import order in audit.py and plex.py (the new iso/_common
  imports had been dropped in mid-block).
The other 3 findings are deliberate design choices, left as-is for UAT: push/push-plan
now gate write-scope before the 404 (dependency ordering); the unified 403 message; and
owned_or_404's owner_attr kept for S1b's DownloadShare.to_user_id-style owners.

Gate: ruff clean, pytest 164 green.

backend/tests/test_utils.py

@@ -1,5 +1,5 @@
-"""iso(): the single datetime→JSON serializer the routes share (R6 S1a)."""
-from datetime import datetime, timezone
+"""iso(): the single date/datetime→JSON serializer the routes share (R6 S1a)."""
+from datetime import date, datetime, timezone
 
 from app.utils import iso
 
@@ -8,6 +8,11 @@ def test_none_maps_to_none():
     assert iso(None) is None
 
 
+def test_plain_date_serializes_as_iso_date():
+    # MediaAsset.upload_date is a `date`, not a datetime — the contract must accept it.
+    assert iso(date(2026, 7, 26)) == "2026-07-26"
+
+
 def test_aware_datetime_keeps_offset():
     dt = datetime(2026, 7, 26, 12, 30, 0, tzinfo=timezone.utc)
     assert iso(dt) == "2026-07-26T12:30:00+00:00"