v0.2.3: Resolve the account timezone before reading the clock (#55)

_tzinfo() read self._timezone while stamping, but on a cold client
_ensure_auth() hadn't run yet, so it fell back to Eastern. The first
entry in a fresh container stamped +3h for a Pacific user while every
later one was correct, which read as intermittent drift. add_serving was
the reported case; ~15 other sites default a date the same way.

Resolve inside _tzinfo(), which every consumer funnels through, checking
the `CRONOMETER_ACCOUNT_TZ` override first so an injected zone needs no
login. Fall back to UTC, not Eastern -- a plausible zone is what let the
skew hide. Validate the login response, and accept an explicit null in
the session cache so zoneless accounts don't re-login on every start.