fix: 校验加固（嵌套敏感键/naive时间防御）

- _depth_ok 与敏感键扫描合并为单次递归 _walk_props，dict 所有层级键均过
  _SENSITIVE（此前嵌套键不扫描，utm 白名单内可夹带敏感键）
- occurred_at 为 naive datetime 时返回 invalid_occurred_at（原为 TypeError 500）
- 删除未使用的 timedelta 导入
- 深度超限即停止下探，10 万层嵌套不爆栈

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/tests/test_validation.py

@@ -40,3 +40,10 @@ def test_sanitize_url_drops_sensitive_params():
     u = sanitize_url("/p?email=a@b.com&token=x&id=3&utm_source=google&monkey=1")
     assert "email=" not in u and "token=" not in u and "utm_source=google" in u
     assert "monkey=1" in u          # fullmatch：含 key 子串的正常参数不误伤
+
+def test_nested_sensitive_key_rejected():
+    r = validate_event(_ev(properties={"utm": {"utm_a": 1, "user_password": "x"}}))
+    assert "sensitive" in r         # utm 在 page_view 白名单内，嵌套敏感键仍须命中
+
+def test_naive_datetime_rejected():
+    assert validate_event(_ev(occurred_at=NOW.replace(tzinfo=None))) == "invalid_occurred_at"