fix: standardize UTC timestamp handling

app/routes.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import os
 import hashlib
 import secrets
-from datetime import datetime, timedelta
+from datetime import timedelta
 
 from flask import (
     Blueprint,
@@ -26,7 +26,7 @@ from .extensions import db
 from .models import AppSetting, PasswordResetToken, UploadRecord, User
 from .prediction import PredictionError, run_prediction
 from .security import new_captcha
-from .time_utils import format_datetime_for_timezone
+from .time_utils import format_datetime_for_timezone, utc_now
 
 bp = Blueprint("main", __name__)
 REFERENCE_PDF_NAME = "20260630标准文本——供水管道健康状态与剩余寿命评估技术导则.pdf"
@@ -60,7 +60,7 @@ def password_reset_token_hash(token: str) -> str:
 
 def password_reset_expiry() -> datetime:
     minutes = max(int(current_app.config["PASSWORD_RESET_TOKEN_MINUTES"]), 1)
-    return datetime.utcnow() + timedelta(minutes=minutes)
+    return utc_now() + timedelta(minutes=minutes)
 
 
 def format_app_datetime(value: datetime | None) -> str:
@@ -74,7 +74,7 @@ def active_password_reset_token(token: str) -> PasswordResetToken | None:
     if (
         reset_token is None
         or reset_token.used_at is not None
-        or reset_token.expires_at <= datetime.utcnow()
+        or reset_token.expires_at <= utc_now()
     ):
         return None
     return reset_token
@@ -137,7 +137,7 @@ def prediction_result_payload(artifacts, record: UploadRecord) -> dict:
     )
     return {
         "original_filename": artifacts.original_filename,
-        "generated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        "generated_at": format_app_datetime(record.upload_time),
         "image_url": image_url,
         "importance_url": importance_url,
         "excel_url": url_for("main.download_file", record_id=record.id, file_type="prediction"),
@@ -238,7 +238,7 @@ def password_reset(token: str):
         ), 400
 
     reset_token.user.set_password(password)
-    reset_token.used_at = datetime.utcnow()
+    reset_token.used_at = utc_now()
     db.session.commit()
     flash("密码已重置，请使用新密码登录", "info")
     return render_auth_template("login", captcha=refresh_captcha())
@@ -326,7 +326,7 @@ def create_password_reset_link(user_id: int):
     if user.is_admin:
         return jsonify({"error": "管理员账号不支持通过此入口重置密码"}), 403
 
-    now = datetime.utcnow()
+    now = utc_now()
     PasswordResetToken.query.filter_by(user_id=user.id, used_at=None).update(
         {"used_at": now}
     )