feat: per-patient record history + summary PDF export

Add GET /api/activity/patient/:fileNumber (every audited change on one chart,
newest first, readable by any clinic member) and surface it as a Record
history timeline in the patient detail sheet. Add a Download summary action
that builds a clean, printable one-page clinical summary in the browser
(Save as PDF) — no PDF dependency, nothing leaves the server.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/activity.ts

@@ -25,3 +25,18 @@ activityRouter.get("/", async (req, res, next) => {
     next(err);
   }
 });
+
+// A single patient's record history (who added/changed what, when). Any clinic
+// member can read it — it's the audit trail for that chart.
+activityRouter.get("/patient/:fileNumber", async (req, res, next) => {
+  try {
+    res.json(
+      await service.listPatientActivity(
+        req.organizationId!,
+        req.params.fileNumber as string,
+      ),
+    );
+  } catch (err) {
+    next(err);
+  }
+});

backend/src/services/activity.ts

@@ -54,6 +54,28 @@ export async function recordActivity(params: {
   }
 }
 
+// Lists every audit entry tied to a single patient (by file number), newest
+// first. Unlike the clinic feed this is NOT scoped to one actor: a patient's
+// record history should show every clinician who added or changed data on it.
+export async function listPatientActivity(
+  orgId: string,
+  fileNumber: string,
+  limit = 100,
+): Promise<ActivityEntry[]> {
+  const rows = await db
+    .select()
+    .from(activityLog)
+    .where(
+      and(
+        eq(activityLog.organizationId, orgId),
+        eq(activityLog.patientFileNumber, fileNumber),
+      ),
+    )
+    .orderBy(desc(activityLog.createdAt))
+    .limit(limit);
+  return rows.map(toEntry);
+}
+
 // Lists the clinic's audit feed. When `actorId` is given, only that user's own
 // actions are returned (each employee sees their own activity); admins/owners
 // call without it to see the whole clinic.