wire time_format into scope, add settings UI selector, change defaults
to 24h, and replace all user-facing Calendar.strftime calls with
centralized TimeHelpers using the user's timezone and time format.
The My Data page had tabs in a different order (Security before Sessions)
than the main settings page, and tab links used JS.push which never fired
because navigate does a full page load. Now both pages share the same tab
order and links include proper ?tab= query params.
