RFC 3161 timestamping, and a publication that never left is finally visible

Added

• RFC 3161 timestamping, optional. Without it a certificate’s issue date is declarative, and the document prints exactly that. With it, an independent authority attests that the signature existed at a given instant — which makes backdating a forgery impossible even with a stolen key. The authority address is empty by default: while it is, issuance makes no network call at all. Two conditions for it to be worth anything: an https:// address and an authority recognised by macOS; the settings screen says so and gives a verified example.
• An Archiving category in reports: archive, revision, storage node, path, last integrity check with its date.
• CSV/TSV import with a reusable column mapping, a preview before anything is written, and a rejection report with reasons. An ambiguous date is refused, never guessed.

Fixed

• A certificate whose registry publication never left. The printed QR answered “number unknown to this registry” and the issuer only learned it from their buyer. The issuing screen now warns before issuing, naming the cause.
• A permanent server refusal can be abandoned. Its reason is kept and readable; the alert stops once the decision is made, instead of returning indefinitely.
• Three record queries scanned a whole table. At the specification’s ceiling, a complete entry now takes 27 ms.