fix(import): normalize timestamps to the DB format at the import door

vault_entries uses SQLite's space-separated UTC format everywhere, and both
sorting and sync last-write-wins compare the strings lexically — so a foreign
JSON import carrying strict-ISO 'T'/millis/Z/offset timestamps would slot in
with a different format and subtly break ordering and merge arbitration.
normalizeImportTimestamp converts any ISO-ish variant to 'YYYY-MM-DD
HH:MM:SS' UTC (bare strings treated as UTC, garbage -> '' = server stamps
now). +1 unit test (69 total).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/tests/csv.test.js

@@ -112,3 +112,17 @@ test('parseEntriesFromCSV: throws when no header + data rows', () => {
 test('parseEntriesFromCSV: throws when no title/url/username column present', () => {
     assert.throws(() => T.parseEntriesFromCSV('password,foo\npw,x'), /title\/url or username/i);
 });
+
+// --- Import timestamp normalization (single door into vault_entries) --------
+
+test('normalizeImportTimestamp: every ISO-ish variant lands in DB space-format UTC', () => {
+    // Our own export (DB format, bare UTC) — unchanged.
+    assert.equal(T.normalizeImportTimestamp('2026-07-10 15:56:23'), '2026-07-10 15:56:23');
+    // Strict ISO with T + millis + Z — same instant, space format.
+    assert.equal(T.normalizeImportTimestamp('2026-07-10T15:56:23.123Z'), '2026-07-10 15:56:23');
+    // Explicit offset is converted to UTC.
+    assert.equal(T.normalizeImportTimestamp('2026-07-10T17:56:23+02:00'), '2026-07-10 15:56:23');
+    // Garbage / absent → '' (server stamps "now").
+    assert.equal(T.normalizeImportTimestamp('not-a-date'), '');
+    assert.equal(T.normalizeImportTimestamp(''), '');
+});

js/tests/harness.js

@@ -146,8 +146,8 @@ function loadApp(overrides = {}) {
         base32Decode, generateTOTP, parseOtpAuthUri,
         // favicon
         faviconHost,
-        // csv
-        parseCSV, findColumn, parseEntriesFromCSV,
+        // csv / import
+        parseCSV, findColumn, parseEntriesFromCSV, normalizeImportTimestamp,
         // strength
         computeStrength: (typeof computeStrength !== 'undefined' ? computeStrength : undefined),
         // merge (async, coupled — tests stub the io seams below)