check_cards tests: missing pin time, AUDIT alone, 'no offset means UTC', GRACE_DAYS and the 4xx edges are not pinned

[realmarcin]

From the round-3 review of #212 (follows #232, #234).

Where: tests/test_fleet_page.py CardCheckTests.

Mutation testing found these unguarded:

1. Missing pinned_at_utc: gives an AUDIT row, untested.
2. AUDIT on its own: an unreadable pin time with every site equal should still fail the run, untested.
3. No offset means UTC: the naive-time test would also pass if a naive time were read as local time.
4. The grace period: the tests read GRACE_DAYS rather than pinning the documented 14.
5. The 4xx edges: 400 and 499 (GONE) and 500 (unread) are not asserted.

Fix: add a case for each.