fix: validate participant uploads and correct account creation dates

[bepes-code]

Participant image and CV updates previously accepted arbitrary strings, while new account timestamps reused the date captured at process startup. This change validates uploads on every account/registration write and computes a fresh UTC timestamp for each account.

• Accept file data only: PNG/JPEG/WebP profile images and PDF CVs, maximum 1 MiB decoded per file. Decode and re-encode image pixels; reject PDF scripts, active actions, attachments, malformed and encrypted documents, then rebuild pages without annotations or metadata.
• Bound image dimensions and PDF page/object counts. Allow a 3 MiB request body for two 1 MiB files plus base64/JSON overhead; individual file limits remain enforced.
• Return creation timestamps with time and UTC offset. Existing historical dates and files are not rewritten.
• Refresh the stale verification-response test to validate the existing intentional session response and verified account ownership; authentication behavior is unchanged.

Validation: 114 backend tests pass, including 17 upload/timestamp regressions, malicious and spoofed inputs, API bypass attempts and base64 transport overhead. Rebased onto current refactor-backend. Frontend companion changes are in LleidaHack/hackeps#16. See docs/participant-uploads.md for rollout details and limits.