update

docs/deployment.md

@@ -13,6 +13,7 @@ Set the broker to listen on all addresses on both webservers:
 
 ```dotenv
 TAPM_LISTEN_ADDR=0.0.0.0:8080
+TAPM_DISPLAY_TIME_ZONE=America/Chicago
 ```
 
 The wildcard bind accepts connections through each node's physical address and
@@ -206,8 +207,11 @@ technician's Gitea credentials for package operations.
 - Audit records are retained indefinitely unless an administrator establishes a
   database retention policy. The Codes view previews the newest 15 records; the
   Audit view can filter retained history by event, customer/deployment label,
-  user, host, package, source IP, or details and displays up to the newest 250
-  matching events.
+  user, host, package, LAN/WAN IP, or details and displays up to the newest 250
+  matching events. Audit timestamps are stored in UTC and rendered in
+  `TAPM_DISPLAY_TIME_ZONE`. Deployment exchanges record both the device LAN
+  address reported by TAPM and the WAN/source address received through the
+  trusted proxy chain.
 - Keep `.env` outside Git and readable only by the service administrator.
 - Rotate both Gitea package tokens and the OAuth secret if either webserver is
   compromised.