backups: show timestamps in the site timezone

Backup timestamps read wrong because of two faults stacked, which is why it
looked like a single offset.

The API serialised naive ISO ("2026-08-07T12:00:00"), with nothing saying the
value was UTC. JavaScript's new Date() parses that as BROWSER-LOCAL, so every
timestamp shifted by the viewer's offset before any timezone formatting ran.
Every datetime this plugin stores is naive UTC, so the wire format now carries
a trailing Z.

The history view then formatted with toLocaleString(), i.e. the viewer's zone,
ignoring the site_timezone setting entirely. It now loads that setting and
formats through the shared formatInZone helper, matching NotificationsList.

The panel list label is built server-side with strftime, so a client cannot
correct it afterwards. It now converts to the site zone using the same Setting
lookup the notifications plugin uses - without that it showed UTC, four hours
out at West Jefferson.

Tests cover the wire format and that 16:30Z renders as 12:30 in
America/New_York.

plugins/backups/models/backup.py

@@ -27,6 +27,15 @@ from datetime import datetime
 from shopdb.api import db
 
 
+def _utciso(value):
+    """Naive-UTC datetime -> ISO string marked as UTC, or None.
+
+    Every datetime this plugin stores is naive UTC. Serialising it without the
+    Z leaves the receiver to guess, and JavaScript guesses browser-local.
+    """
+    return value.isoformat() + 'Z' if value else None
+
+
 class BackupRevision(db.Model):
     """A single point-in-time configuration snapshot of an asset."""
 
@@ -123,8 +132,13 @@ class BackupRevision(db.Model):
             # download <machinenumber>.reg without a second round trip.
             'assetnumber': self.asset.assetnumber if self.asset else None,
             'sourcehostname': self.sourcehostname,
-            'collectedat': self.collectedat.isoformat() if self.collectedat else None,
-            'createdat': self.createdat.isoformat() if self.createdat else None,
+            # Both columns hold NAIVE UTC (see collectedat above), so the wire
+            # format says so with a trailing Z. Without it JavaScript's
+            # `new Date('2026-08-07T12:00:00')` parses the string as
+            # BROWSER-LOCAL and the timestamp silently shifts by the viewer's
+            # offset before any site-timezone formatting is applied.
+            'collectedat': _utciso(self.collectedat),
+            'createdat': _utciso(self.createdat),
         }
         if includepayload:
             data['payloadjson'] = self.payload