Configurable timezone for timestamps in notification emails (currently hardcoded to UTC)

[sawadata]

Is your feature request related to a problem? Please describe.

All timestamps rendered inside notification emails are in UTC, with no timezone
indicator and no way to change it. For example, the "Your account was just logged
into from a new device" email received by a user in Japan (UTC+9) says:

Date: Wednesday, September 09, 2026 at 11:51:50 PM

while the actual login happened on September 10 at 08:51 local time. Since the
rendered string does not even say "UTC", recipients naturally read it as local
time and get confused (it can even show the wrong calendar day, as above).

As far as I can tell this affects every mail that renders a timestamp via
MAIL_DATETIME_FORMAT in crates/defguard_core/src/mail/templates.rs:

• date_now inserted in get_base_tera_mjml() (Utc::now())
• new device login (new_device_login_mail, the created value — a naive UTC
  NaiveDateTime from the DB, formatted without any conversion)
• email MFA code activation/code mails (Utc::now())
• enrollment/desktop activation token expiration times

Setting TZ on the container has no effect because the code never uses local
time for these values.

Describe the solution you'd like

A server-wide setting for the timezone used when formatting timestamps in
outgoing mails — e.g. an env var like

DEFGUARD_MAIL_TIMEZONE=Asia/Tokyo   # IANA name, default: UTC

implemented with chrono-tz, converting the UTC values right before they are
formatted for the template context. Appending the timezone abbreviation/offset
to the formatted string (e.g. "… at 08:51:50 AM JST") would also make the
rendered time self-explanatory.

Describe alternatives you've considered

• Setting TZ=Asia/Tokyo on the core container — no effect, the mail code uses
  Utc::now() / naive UTC DB values directly.
• Patching and building a custom image — works but has to be re-done on every
  upgrade, which defeats the convenience of the floating 2 image tags.
• At minimum, simply appending "UTC" to the formatted timestamps would remove
  the ambiguity even without configurability.

Additional context

Defguard 2.1.0 (core), reproduced with the SMTP notifications
(new device login, email MFA codes, enrollment mails). Happy to test a build
that implements this.