fix(display): respect TZ env on every CLI/MCP timestamp render

[pszymkowiak]

Summary

Closes #119.

Storage stays in UTC (`DateTime`) — that's the right canonical form for ordering and serialization. But every user-facing timestamp was also printed in UTC, even with `TZ=Asia/Bangkok` set, because the display sites called `dt.format(...)` directly on the UTC value.

Fix

• New helper `icm_core::format_local(dt, fmt)` — wraps `dt.with_timezone(&Local).format(fmt).to_string()`. `chrono::Local` honours the `TZ` env var on Unix (via libc) and the system locale on Windows.
• Threaded through every display-side formatter:
  • CLI (`icm-cli`): `stats`, `show`, `recall` hit ts, `memoir show`, `concept show`, `transcript list/show/stats` (~10 sites).
  • MCP (`icm_stats` tool): oldest / newest.
• Unchanged (machine-readable, intentional): `cloud.rs` and `web.rs` keep `to_rfc3339` (UTC). API consumers parse offsets correctly; humans read the CLI.

Smoke test on the release binary

```
$ TZ=UTC icm stats | grep Oldest # 2026-05-10 08:12
$ TZ=Asia/Bangkok icm stats | grep Oldest # 2026-05-10 15:12 (+7)
$ TZ=America/Los_Angeles icm stats | grep Oldest # 2026-05-10 01:12 (-7)
```

Test plan

• 2 unit tests on `format_local` (non-empty, agrees with explicit `with_timezone(&Local)`)
• Binary smoke test across 3 timezones (above)
• `cargo test --workspace` — 409 passed, 4 ignored
• `cargo clippy --workspace --all-targets -- -D warnings` — clean
• `cargo fmt --check` — clean

The TZ-shift correctness is asserted via the binary smoke test rather than a unit test because `chrono::Local` reads the env var once and Rust tests run in parallel — mutating `TZ` from inside one test would be racy with siblings.

🤖 Generated with Claude Code