feat(engine): event normalizer

[sepehr-safari]

What & why

Second slice of S1 — Engine core: src/ocpp/normalizer.zig, which turns raw
TraceEventInput entries into canonical Events. Mirrors the toolkit's
core/normalizer.ts — the shared conformance contract — including its exact
action tables and the 10^12 epoch threshold, so the two implementations agree.

Changes

• Message classification / field extraction — classifyMessageType plus
  extractAction / extractPayload / extractErrorCode /
  extractErrorDescription, reading [typeId, uniqueId, …] off the
  std.json.Value boundary.
• Timestamp normalization — normalizeTimestamp handles ISO 8601 (UTC and
  ±hh:mm offset, with optional fractional seconds) via a self-contained
  days-from-civil parser, plus epoch seconds / milliseconds (as JSON number or
  numeric string) split on the 10^12 threshold. Missing zone ⇒ UTC, so results
  don't depend on the host's local time.
• Direction — inferDirection from the CS→CSMS / CSMS→CS action tables
  (DataTransfer, present in both, resolves CS→CSMS), reverseDirection, and a
  two-pass normalizeEvents that resolves each response's direction from its
  matched Call. Explicit input direction (even unknown) is respected;
  sequential evt-0001 ids; input order preserved.

Security (untrusted input)

Timestamps come from untrusted traces, so the numeric paths guard against
overflow: seconds→ms multiplication uses checked std.math.mul, and the
float→int cast is range-checked. Absurd magnitudes (e.g. 1e300) return null
instead of panicking — covered by a test.

Testing

• native test -Dplatform=null → 17/17 pass (9 new normalizer tests ported
  from the toolkit: timestamp variants, direction inference/reversal, field
  extraction, response matching, explicit-direction respect, empty input).
• The ISO instant 2024-01-15T10:00:00Z and its +02:00 equivalent both resolve
  to 1_705_312_800_000, matching the toolkit's Date.parse.
• native check --strict and zig fmt --check clean.

Closes #12