Collapse Opake time injection into a single microsecond clock
Opake took two parallel time function pointers — now: fn() -> String and
now_micros: fn() -> u64 — even though both wrapped the same underlying
clock on each platform (chrono on CLI, js_sys::Date on WASM). The RFC 3339
string is just a formatted view of the same instant.
Derive the string inside core from the microsecond source via a new
timestamp::rfc3339_from_micros helper (Hinnant's civil-from-days, no
chrono dep in core — platform-free stays platform-free). One injection,
one source of truth, identical formatting between CLI and WASM.
Also fix two callsites in opake-wasm/src/opake_wasm.rs::check_session that
were bypassing the injection and calling now_iso() directly — they now
route through opake.now() like every other consumer.