nginx error-log timestamp normalization fix
Bare nginx error-log timestamps (2026/05/25 16:45:24) weren't normalized on the generic log path, so every error line in a scanner burst got a unique cache key and triggered a fresh LLM classification. Stabilizes the prefix so they collapse to one call plus cache hits.