feat(detections): add recorded_at field for capture-time sequence linking

[Acruve15]

Closes #510

Motivation

The POST /detections endpoint imposed created_at = utcnow(), so detections cached on the engine and uploaded in a burst all landed at virtually the same DB timestamp, even though they were captured minutes or hours apart. Sequence linking buckets detections by time, so a burst upload either grouped unrelated captures or split a real sequence depending on upload timing.

This adds a recorded_at field carrying the on-device capture time (UTC) and switches all sequence linking and time-window logic to use it. created_at stays as the trusted DB insertion clock.

Per the issue thread (frgfm / fe51 / MateoLostanlen): both fields are kept on purpose. created_at is the timestamp we can always trust; the created_at - recorded_at gap is a useful signal for spotting cameras with connection lag. The EXIF-extraction idea was considered and deferred (not all cameras expose it, TZ handling, latency) in favor of the engine sending recorded_at explicitly.

What changed

• Model / schema: Detection.recorded_at (naive-UTC, default_factory=utcnow), optional recorded_at on DetectionCreate. Read endpoints (/detections/{id}, /detections/, /sequences/{id}/detections) expose it for free via the inherited read schemas.
• Endpoint (src/app/api/api_v1/endpoints/detections.py): recorded_at is an optional form field defaulting to server now when the engine omits it (so un-updated engines keep working, and the envdenv "alerts in the past" demo just needs a past recorded_at). Sequence candidate lookup, the overlap window, started_at / last_seen_at, and the last-bbox lookup all key on recorded_at; the time-window comparisons anchor on the new detection's capture time instead of utcnow(), so a late upload attaches to the sequence that was active at capture time.
• Sequences (src/app/api/api_v1/endpoints/sequences.py): GET /sequences/{id}/detections orders by recorded_at.
• UTC normalization: a to_utc_naive helper (next to utcnow()) converts timezone-aware payloads (e.g. a France-local +02:00 value) to UTC before storing and before the window comparisons; naive values are assumed UTC. Coercion rather than rejection, so a tz-aware timestamp does the right thing instead of erroring.
• Migration: adds the column as nullable, backfills recorded_at = created_at for existing rows, then sets NOT NULL.

alerts.py and the fromdate endpoints need no change: they filter on started_at / last_seen_at, which now derive from recorded_at transitively.

Tests

• New: payload value honored, tz-aware value converted to UTC, default-to-now, recorded_at-keyed grouping, distant captures don't group.
• Full suite green (503 passed) in the dockerized stack; migration verified up + down + re-up with the column landing as NOT NULL.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.32%. Comparing base (00743b2) to head (25edadc).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #617      +/-   ##
==========================================
+ Coverage   92.30%   92.32%   +0.02%     
==========================================
  Files          56       56              
  Lines        2585     2593       +8     
==========================================
+ Hits         2386     2394       +8     
  Misses        199      199              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.