fix(audit): centraliser l'horloge UTC

app/routes/auth.py

@@ -8,7 +8,7 @@ password policy enforcement and sign-up screening.
 import os
 import secrets
 import time
-from datetime import datetime, timedelta
+from datetime import timedelta
 from urllib.parse import urlencode, urlparse
 
 import requests
@@ -22,6 +22,7 @@ from app.forms import form_gamertags
 from app.i18n import LOCALE_SESSION_KEY
 from app.logging_config import log_auth_event
 from app.models import ESPORT_GAMES, Player, User
+from app.time_utils import utc_now_naive
 from app.validators import LoginSchema, RegisterSchema, validate_discord_user_id
 
 #: Session key holding the pending OAuth2 anti-forgery token.
@@ -294,7 +295,7 @@ def login():
             )
             if user.failed_login_attempts >= MAX_LOGIN_ATTEMPTS:
                 minutes = cooloff_minutes(user.failed_login_attempts)
-                user.locked_until = datetime.utcnow() + timedelta(minutes=minutes)
+                user.locked_until = utc_now_naive() + timedelta(minutes=minutes)
                 log_auth_event(
                     'account.throttled',
                     username=username,