Fixed email confirmation link expiry

Some users reported that email confirmation links were expiring too quickly — sometimes within minutes instead of the expected 48 hours.

Root cause

A timezone mismatch in the token validation logic. The token was created with a UTC timestamp, but validated against the server's local time. For servers running in US timezones, this could shorten the expiry window by up to 8 hours.

The fix

All timestamp comparisons now use UTC consistently:

// Before (broken)
const isExpired = new Date() > token.expiresAt;

// After (fixed)
const isExpired = Date.now() > token.expiresAt.getTime();

Confirmation links now correctly expire after 48 hours regardless of server timezone.