fix(api): close M5 frontend contract gaps

docs/BACKEND/API_GUIDES/V2/README.md

@@ -81,6 +81,29 @@ All routes return the same error envelope:
 }
 ```
 
+## 3.1) Time handling
+
+V2 stores operational timestamps in UTC using PostgreSQL `TIMESTAMPTZ`.
+
+Rules:
+
+- frontend sends UTC timestamps to backend
+- backend returns ISO 8601 UTC timestamps for source-of-truth fields
+- frontend converts those timestamps to local time for display
+
+Source-of-truth timestamp fields include:
+
+- `startsAt`
+- `endsAt`
+- `startTime`
+- `endTime`
+- `clockInAt`
+- `clockOutAt`
+- `createdAt`
+- `updatedAt`
+
+Helper fields like `date` are UTC-derived helpers and should not replace the raw timestamp fields.
+
 ## 4) Attendance policy and monitoring
 
 V2 now supports an explicit attendance proof policy: