fix: add user creation timestamps

[EvidentLed]

/claim #743

Closes #3311

Summary

• Add a server-owned ISO createdAt timestamp in createUser after caller payload fields are applied.
• Store and return the same timestamp for the in-memory user record.
• Add a focused regression test proving caller-supplied createdAt cannot override the server timestamp.

Demo

Short demo GIF: https://raw.githubusercontent.com/EvidentLed/bug-bounty/codex/demo-assets-3311/evidentled-user-createdat-demo.gif

Backup animated SVG artifact: https://gist.github.com/EvidentLed/0eca084d8b92b82ae149540e6f016e7f

Verification

• Red check before the fix: node --test apps/api/src/tests/userService.test.js failed because the service accepted caller-supplied createdAt.
• node --test apps/api/src/tests/userService.test.js -> 1 pass, 0 fail.
• node --test apps/api/src/tests/*.test.js -> 2 pass, 0 fail.
• git diff --check origin/main..HEAD -> passed.

Provenance

This PR was prepared with AI assistance under the EvidentLed GitHub identity.