fix: place log events in real time, reset the data cap on send, export runs (v0.23.29-beta)

Three reports from this morning.

**Event timestamps were not the times the events happened.** RouterOS writes log
times in the device's own timezone and never says so, and it uses more than one
format. The parser handled `sep/03 08:37:38` and `08:37:38` but labelled both
UTC, shifting every event by the device's offset — reported as an event log
seven hours out from the device page. It did not handle
`2026-09-03 08:37:38` at all, which is what current RouterOS actually returns
over the API, so those fell through to the collection time instead: plausible on
a live poll, badly wrong for a backlog, where a thousand historical lines all
arrive stamped "now".

Devices now report their clock, and timestamps are converted from device-local
to UTC through it, with the numeric gmt-offset as a fallback and daylight saving
handled by the runtime rather than a fixed number. Where the zone is unknown the
parser returns null and the caller falls back to collection time, deliberately —
a confidently wrong timestamp is worse than an openly approximate one.

Verified on hardware: 18 of 18 events in a steady-state window now store exactly
seven hours ahead of what the device printed, which is the offset the device
itself reports. Existing rows are left alone; they were written by three
different code paths and cannot be corrected uniformly.

**The data-cap counter kept climbing after the SMS was sent.** Reported from the
field, and correct: the message is what zeroes the carrier's allowance — it is
the alternative to waiting for midnight — so ours has to follow. Left as it was,
two things went wrong: the bar counted against an allowance that no longer
applied, and usage stayed above the threshold, so the rule would re-fire on
every cooldown for the rest of the day. Both send paths now restart the count.

**Command runs export to CSV**, asked for on #118 for archiving and audit.
Output is quoted so multi-line device responses survive, and timestamps are ISO
rather than the driver's default string form, which no spreadsheet parses. The
download goes through the authenticated client rather than a plain link, because
a link cannot carry a Bearer header and would simply 401.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -417,6 +417,12 @@ export const commandsApi = {
   listRuns: () => api.get<CommandRunSummary[]>('/commands/runs'),
   getRun: (id: number) => api.get<CommandRunDetail>(`/commands/runs/${id}`),
   cancelRun: (id: number) => api.post<{ message: string }>(`/commands/runs/${id}/cancel`),
+  /**
+   * Fetched through the authenticated client, not a bare link. Auth is a Bearer
+   * header, which an <a download> cannot send — the link would simply 401.
+   */
+  exportCsv: (id: number) =>
+    api.get(`/commands/runs/${id}/export`, { responseType: 'blob' }),
 };
 
 export const devicesApi = {