fix(session): use utcnow_naive across session routes (#1116) (#5003)

Replace remaining datetime.utcnow() call sites in session CRUD, incognito
purge cutoff, and webhook payloads with core.database.utcnow_naive.

tests/test_session_routes_utcnow.py

@@ -0,0 +1,11 @@
+"""Regression: session routes must not call datetime.utcnow() (#1116)."""
+
+import inspect
+
+import routes.session_routes as sr
+
+
+def test_session_routes_module_does_not_reference_utcnow():
+    source = inspect.getsource(sr)
+    assert "datetime.utcnow()" not in source
+    assert "_dt.utcnow()" not in source