The only way to set it is in dispatcher.php or earlier, which makes me suspicious.
As for APP_TIMEZONE the current method is to simply define it in index.php
<?php define('APP_TIMEZONE', 'America/Los_Angeles'); require('concrete/dispatcher.php');
I added this pull request for doing in the file config
I'm not exactly sure yet all of it wraps together though.
I'm curious about your thoughts of 'system' vs. 'app' time though. Some Localization\Service\Date methods are using 'system', even the new toDB method. Wouldn't 'app' be a more useful default since it's very explicit and defaults back to system if it doesn't exist?
Btw, it would be great if toDB had an option for specifying toTimezone as well. I'm storing all dates as UTC to minimize confusion, the default 'system' could lead to problems if the data is moved across time zones.