Fix: UTC fuer interne Timer, Berlin nur fuer Anzeige

Korrektur: Alle DB-Timestamps (refresh_log, created_at, updated_at,
auth, notifications) bleiben UTC fuer korrekte Timer-Vergleiche.
Europe/Berlin nur fuer angezeigte Werte (Exporte, Prompts, API).
Verhindert zu fruehes Ausloesen des Auto-Refresh-Timers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routers/incidents.py

@@ -5,7 +5,7 @@ from models import IncidentCreate, IncidentUpdate, IncidentResponse, Subscriptio
 from auth import get_current_user
 from middleware.license_check import require_writable_license
 from database import db_dependency, get_db
-from datetime import datetime
+from datetime import datetime, timezone
 from config import TIMEZONE
 import asyncio
 import aiosqlite
@@ -102,7 +102,7 @@ async def create_incident(
 ):
     """Neue Lage anlegen."""
     tenant_id = current_user.get("tenant_id")
-    now = datetime.now(TIMEZONE).strftime('%Y-%m-%d %H:%M:%S')
+    now = datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M:%S')
     cursor = await db.execute(
         """INSERT INTO incidents (title, description, type, refresh_mode, refresh_interval,
            retention_days, international_sources, visibility,
@@ -184,7 +184,7 @@ async def update_incident(
     if not updates:
         return await _enrich_incident(db, row)
 
-    updates["updated_at"] = datetime.now(TIMEZONE).strftime('%Y-%m-%d %H:%M:%S')
+    updates["updated_at"] = datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M:%S')
     set_clause = ", ".join(f"{k} = ?" for k in updates)
     values = list(updates.values()) + [incident_id]
 
@@ -667,7 +667,7 @@ def _build_markdown_export(
                 lines.append(snap_summary)
                 lines.append("")
 
-    now = datetime.now(TIMEZONE).strftime("%Y-%m-%d %H:%M UTC")
+    now = datetime.now(TIMEZONE).strftime("%Y-%m-%d %H:%M Uhr")
     lines.append("---")
     lines.append(f"*Exportiert am {now} aus AegisSight Monitor*")
     return "\n".join(lines)