fix(import): normalize timestamps to the DB format at the import door

vault_entries uses SQLite's space-separated UTC format everywhere, and both
sorting and sync last-write-wins compare the strings lexically — so a foreign
JSON import carrying strict-ISO 'T'/millis/Z/offset timestamps would slot in
with a different format and subtly break ordering and merge arbitration.
normalizeImportTimestamp converts any ISO-ish variant to 'YYYY-MM-DD
HH:MM:SS' UTC (bare strings treated as UTC, garbage -> '' = server stamps
now). +1 unit test (69 total).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/tests/harness.js

@@ -146,8 +146,8 @@ function loadApp(overrides = {}) {
         base32Decode, generateTOTP, parseOtpAuthUri,
         // favicon
         faviconHost,
-        // csv
-        parseCSV, findColumn, parseEntriesFromCSV,
+        // csv / import
+        parseCSV, findColumn, parseEntriesFromCSV, normalizeImportTimestamp,
         // strength
         computeStrength: (typeof computeStrength !== 'undefined' ? computeStrength : undefined),
         // merge (async, coupled — tests stub the io seams below)