docs: rfc3339 wire timestamps convention + audit-log field notes

docs/web-ui/dashboard.md

@@ -676,7 +676,7 @@ target / outcome / detail); the filter box is a client-side substring
 match over the cached rows. The outcome badge colours `ok` green and
 `err` red, with an `err` whose `detail` starts `denied:` (a capability
 refusal) shown amber and labelled `denied` so it reads apart from an
-execution failure. `ts_unix` is unix seconds; a 30 s ticker keeps the
+execution failure. `ts_unix` is an RFC 3339 string; a 30 s ticker keeps the
 relative "ago" column honest while the tab is in view. The backing
 `audit_log` store records every privileged-action attempt (ok / err /
 denied). New entries live-append without a refresh: an `audit_entry_added`
@@ -1076,7 +1076,7 @@ that's a browser-level decision, not ours.
   a managed container; rendered in the side panel.
 - `GET /api/audit-log` — agent-initiated privileged-action audit
   trail. Returns `{ entries, total }`: `entries` is a `Vec<AuditEntry>`
-  (`id`, `ts_unix` in seconds, `agent`, `action`, `target`, `outcome`
+  (`id`, `ts_unix` as RFC 3339, `agent`, `action`, `target`, `outcome`
   `"ok"`/`"err"`, `detail` nullable), newest first, server-clamped to
   500; `total` is the full row count for a "latest 500 of N" header.
   Backs the LOGS page AUDIT sub-tab.