Fix how the audit log displays entries; record admin-link and domain checks

Entries were stored in UTC without a zone marker and the Audit and
Diagnostic Log pages read them as local time, so every entry showed
shifted by the viewer's UTC offset (two hours early in Sweden). A shared
parseDbTimestamp() now reads them as UTC, and replaces the inline
workaround the Consistency page had.

The Audit Log never displayed an entry's details at all, so adding an
admin link showed only "server #1". Link entries now carry the server
name and the label/URL, and a new Details column shows them, along with
things like a port scan's address and range. Entries made within the
same second are now ordered by id instead of arbitrarily.

A domain's "Check now" was the one user-triggered action that wasn't
audited; it is now.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

web/src/pages/Consistency.tsx

@@ -2,7 +2,7 @@ import { useEffect, useMemo, useState } from "react";
 import { Link } from "react-router-dom";
 import { api, type ConsistencyFinding, type ConsistencyKind, type ConsistencyReport, type ConsistencySeverity, type CurrentUser } from "../api/client";
 import { downloadCsv } from "../utils/csv";
-import { formatDateTime } from "../utils/date";
+import { formatDateTime, parseDbTimestamp } from "../utils/date";
 import { formatAgo } from "../utils/duration";
 import { readableError } from "../utils/errors";
 
@@ -356,7 +356,7 @@ Range (a network like 192.168.16.0/20, or a single address):`,
                     <div className="text-secondary small">
                       {i.reason ? `${i.reason} · ` : ""}
                       {i.createdBy ? `${i.createdBy}, ` : ""}
-                      {formatDateTime(new Date(i.createdAt.includes("T") ? i.createdAt : `${i.createdAt.replace(" ", "T")}Z`))}
+                      {formatDateTime(parseDbTimestamp(i.createdAt))}
                       {!i.stillPresent && " · no longer occurring"}
                     </div>
                   </div>