refactor: drop fetch_url body cap and modernize datetime usage

- fetch_url: remove the 1MB body cap and the streaming helper. The
  manual redirect loop with allowlist re-check (the SSRF fix) is kept
  intact; the body is now read in full via resp.text. Drop the now-
  meaningless `truncated` field from FetchUrlResult and the tests that
  asserted on it. Switched from httpx.stream() back to httpx.get()
  for the redirect loop — cleaner without the body cap.

- datetime: replace deprecated datetime.utcnow() with
  datetime.now(timezone.utc) in submit.py (3 sites) and
  core/job_writer.py (1 site). Update the stale comment in
  core/pending_store.py that referenced the old call.

- Clean up an unused `from common.config import settings` import in
  submit.py that ruff flagged.

Co-Authored-By: Claude <noreply@anthropic.com>

spark_executor/server.py

@@ -549,7 +549,6 @@ def _update_job_file(req: UpdateJobFileRequest):
         "guardrails — the allowlist is the only gate — so keep it tight. The "
         "Connection's saved auth is reused, so the agent does not need cluster "
         "credentials.\n\n"
-        "**Limits:** response body capped at 1 MB (truncated=true if larger), "
         "30s timeout, redirects followed."
     ),
 )