feat: uplift error handling, tests, auth policy

[emilylm]

📌 Summary

This PR centralizes authorization, standardizes error handling, and introduces shared pagination while aligning the database schema/ORM with timezone-aware timestamps and lease management improvements. It also adds an admin lease-expiry endpoint and updates unit tests to match new behaviors.

---

🔄 Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Refactor (code change that neither fixes a bug nor adds a feature)
• 📚 Documentation update
• ⚙️ CI / build / tooling change

---

🧩 Key Changes

• Centralized authorization policy via policy decorator; migrated endpoints off scattered require_role checks.
• Unified error responses with global handlers for AppError, HTTPException, and validation errors.
• Added shared pagination helper and included in list endpoints; added eager loading for organism experiment reads.
• Added Alembic migration for TIMESTAMPTZ conversions, broker lease lookup indexes, and lat/long constraints.
• Implemented lease-expiry maintenance logic plus admin endpoint to expire all leases.
• Schema & ORM fixes: timezone-aware DateTime defaults, constraints, and indexes; settings hardening (fail-fast config, tightened CORS).
• Updated unit tests to match policy/error behavior and current assembly/genome-note rules.

---

✅ Checklist

• Tests are passing locally / in CI
• New tests have been added for new or changed functionality
• Self-review completed
• Documentation updated (if needed)
• No sensitive data or secrets included

---

🔍 Review Notes

---

📎 Related Issues / Tickets

• Closes #
• Related to #

---