fix(platform): return operator session expiry as ISO UTC from confirmation GET (#383)

## Problem
`POST /operator/v1/session` (elevation) serializes `expiresAt` with
`toISOString()` → `2026-10-07T12:13:32.000Z`. `GET /operator/v1/session`
(confirmation) passed the column value through raw:
`operator_sessions.expires_at` is `timestamp without time zone`, and the
string-mode column mapping returns SQL text `2026-10-07 12:13:32` — same
instant, different text. The iOS admin gate validates ISO UTC and
rejected the confirmation response (`admin-session-confirm
incompatibleResponse`, status 200).

## Fix
In the confirmation handler only: parse the timezone-less wall time
explicitly as UTC (`T` separator, `+00:00` — no assumed bare suffix, no
runtime-local guessing) and serialize with `toISOString()`. The response
now carries the same instant and the same ISO text the elevation issued.
The middleware context value is untouched and nothing else reads it, so
blast radius is this one response.

## Test evidence (observed, not expected)
New regression test round-trips the expiry through the real database
conversion (PGlite) and asserts both responses carry byte-identical ISO
text plus the full shape the app validates (apiVersion 1, same user,
eight capability flags as booleans, hostedWorkerOperations a boolean).

- Old code: 7 of 8 pass; the new test fails with the app's exact
complaint — `expected '2026-10-07 12:13:32' to be
'2026-10-07T12:13:32.000Z'`
- With this patch: all 8 of 8 pass — elevation, drain maintenance,
role/suspension enforcement, forgery rejection, dev-bypass rejection,
and input validation all unaffected

```
vp test run --project platform-api-integration platform/packages/api/test/integration/operator-auth.test.ts
```

Co-authored-by: Pluso <pluso@airbuild.local>

Author: Brooooooklyn

platform/packages/api/src/operator/auth.ts

@@ -117,9 +117,17 @@ operatorSessionRoutes.post('/session', async (context) => {
 export const authenticatedSessionRoutes = new Hono<ApiEnv>();
 authenticatedSessionRoutes.get('/session', (context) => {
   const user = context.get('user');
+  // operator_sessions.expires_at is a timestamp without time zone whose wall
+  // time is UTC by convention: the POST above inserts a UTC ISO string. The
+  // string-mode column mapping returns it in SQL text form
+  // ("YYYY-MM-DD HH:MM:SS.sss"), so parse it explicitly as UTC and serialize
+  // with toISOString() — the response then carries the same instant and the
+  // same ISO text the POST returned.
+  const storedExpiry: string = context.get('operatorSession').expiresAt;
+  const expiresAt = new Date(`${storedExpiry.replace(' ', 'T')}+00:00`).toISOString();
   return context.json({
     apiVersion: 1,
-    expiresAt: context.get('operatorSession').expiresAt,
+    expiresAt,
     user: { id: user.id, login: user.login, role: user.role },
     capabilities: getPlatformCapabilities(context.env),
     hostedWorkerOperations: !context.env.PLATFORM_INSTALLATION_ID,

platform/packages/api/test/integration/operator-auth.test.ts

@@ -71,6 +71,56 @@ describe('operator authentication', () => {
     ).toBe(401);
   });
 
+  test('confirmation repeats the exact ISO UTC expiry the elevation issued', async () => {
+    const admin = await createTestUser(
+      env.db,
+      'operator-expiry',
+      'github',
+      undefined,
+      'free',
+      'admin',
+    );
+    const created = await request('/session', admin.jwt, {});
+    expect(created.status).toBe(200);
+    const createdBody = (await created.json()) as { token: string; expiresAt: string };
+
+    const confirmed = await request('/session', createdBody.token);
+    expect(confirmed.status).toBe(200);
+    const confirmedBody = (await confirmed.json()) as {
+      apiVersion: number;
+      expiresAt: string;
+      user: { id: string; login: string; role: string };
+      capabilities: Record<string, unknown>;
+      hostedWorkerOperations: unknown;
+    };
+
+    // The expiry round-trips through Postgres as a timestamp without time zone,
+    // and the string-mode column mapping reformats it as SQL text; the handler
+    // must serialize it back to the ISO UTC text the admin app pins. Assert the
+    // real conversion result, not a fixture.
+    const isoUtc = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+    expect(createdBody.expiresAt).toMatch(isoUtc);
+    expect(confirmedBody.expiresAt).toBe(createdBody.expiresAt);
+    expect(Date.parse(confirmedBody.expiresAt)).toBe(Date.parse(createdBody.expiresAt));
+
+    // The remaining shape the admin app validates before accepting a session.
+    expect(confirmedBody.apiVersion).toBe(1);
+    expect(confirmedBody.user).toEqual({ id: admin.id, login: admin.login, role: 'admin' });
+    for (const name of [
+      'ai',
+      'customDomains',
+      'email',
+      'githubActions',
+      'githubOAuth',
+      'googleOAuth',
+      'managedBuilds',
+      'sandbox',
+    ]) {
+      expect(typeof confirmedBody.capabilities[name]).toBe('boolean');
+    }
+    expect(typeof confirmedBody.hostedWorkerOperations).toBe('boolean');
+  });
+
   test('keeps login, elevation, authenticated drain, session, and logout usable in drain maintenance', async () => {
     const admin = await createTestUser(
       env.db,