fix(saas): P0-2/P0-3 — usage endpoint + refresh token type mismatch

P0-2: GET /usage 500 "text >= timestamptz" — usage_records.created_at
is TEXT in actual DB despite migration declaring TIMESTAMPTZ. Fixed by
using dynamic SQL with ::timestamptz explicit casts for all date
comparisons, avoiding sqlx NULL-without-type-OID binding issues.

P0-3: POST /auth/refresh 500 — refresh_tokens.expires_at/used_at are
TEXT columns. Added ::timestamptz cast to SQL queries in auth handlers
and cleanup worker.

crates/zclaw-saas/src/workers/cleanup_refresh_tokens.rs

@@ -22,7 +22,7 @@ impl Worker for CleanupRefreshTokensWorker {
     async fn perform(&self, db: &PgPool, _args: Self::Args) -> SaasResult<()> {
         let now = chrono::Utc::now();
         let result = sqlx::query(
-            "DELETE FROM refresh_tokens WHERE expires_at < $1 OR used_at IS NOT NULL"
+            "DELETE FROM refresh_tokens WHERE expires_at::timestamptz < $1 OR used_at IS NOT NULL"
         )
         .bind(&now)
         .execute(db)