Modernise zod idioms to v4

Replace the deprecated v3 string-method forms with the top-level
validator helpers zod 4 prefers:

- z.string().url()      → z.url()      (3 sites)
- z.string().uuid()     → z.uuid()     (5 sites)
- z.string().datetime() → z.iso.datetime() (9 sites)

Also swap the ZodIssueCode.custom compat-shim reference in
demo-bot.server.ts's superRefine for the bare string literal "custom",
which is v4's idiomatic form. No runtime change.

All 147 tests still pass.

The `parsed.error.issues.map(i => ({field, message}))` pattern in the
five journal API route handlers stays as-is — the fields we read are
unchanged in v4, and zod's new error helpers (z.treeifyError,
z.prettifyError) produce different shapes that would change our
public API error contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/api/src/auth.ts

@@ -20,8 +20,8 @@ export const TokenResponseSchema = z.object({
 export const DeviceSchema = z.object({
   id: z.string(),
   deviceName: z.string().nullable(),
-  lastActiveAt: z.string().datetime(),
-  createdAt: z.string().datetime(),
+  lastActiveAt: z.iso.datetime(),
+  createdAt: z.iso.datetime(),
   isCurrent: z.boolean(),
 });