fix: use Harper @createdTime instead of hand-rolled created_at

[claude]

Summary

• Annotate created_at with Harper's @createdTime directive on csrf_tokens, mcp_auth_codes, and mcp_refresh_families, and stop hand-writing the field in app code — Harper now assigns it on insert (epoch ms) and retains it across rotation writes.
• Remove the reinvented created_at from the app DTOs (MCPAuthCodeRecord, MCPRefreshFamilyRecord), their encode/decode paths, and the manual Date.now() / nowSeconds() writes (CSRFTokenManager, mcp/callback.ts, mcp/token.ts). These fields were write-only / informational, so nothing reads them for logic.
• Keep harper_oauth_mcp_keys.created_at as a hand-managed seconds field — keyStore deliberately mutates it to reorder GC/signer selection, which @createdTime (pinned to original insert time) cannot express. Added a schema comment documenting why it's the exception and why it's seconds.

This resolves the unit footgun called out in #168 (ms in two tables, seconds in three): created_at is now Harper-owned everywhere it's just informational, and the one place it's app-logic is explicitly documented.

Test plan

• npm run build (tsc)
• npm run lint (0 errors)
• npm run format:check (only untracked .harper-skills/ flagged)
• npm test — 840 pass, 0 fail
• bun test — 840 pass, 0 fail
• Regression: flipped CSRFTokenManager / OAuthProvider / callback assertions to require created_at is not hand-written (fails before this change, passes after).

Closes #168

[claude]

Reviewed; no blockers found.

[github-actions]

Reviewed; no blockers found.

Suggestions (non-blocking)

• test/lib/mcp/token.test.js:142 (and tokenAuditHook.test.js:148) — remove created_at from the seedCode helper. The app code no longer reads this field for auth codes (it is dropped in decodeRecord), so keeping it in the test seeds is unnecessary and inconsistent with the PR's goal of removing hand-written timestamps.
• test/lib/CSRFTokenManager.test.js:104 — remove created_at from the malformed-data test seed. Since the manager no longer reads or writes this field, removing it from the manual seed keeps the test aligned with the move to Harper-managed @createdTime.