feat: activity audit log written from all resource routes

Add the activity_log table, a best-effort recordActivity() service and a
GET /api/activity feed, and write entries on create/update/delete of
patients, notes, appointments, prescriptions and tasks. The Activity page
now shows the real audit trail (actor, action, patient context, time);
the fabricated signing hashes / approval badges are gone — that vision
stays deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/activity.ts

@@ -0,0 +1,17 @@
+import { Router } from "express";
+
+import { requireAuth, requireOrg } from "../middleware/auth.js";
+import * as service from "../services/activity.js";
+
+export const activityRouter = Router();
+
+// The audit feed is readable by any clinic member.
+activityRouter.use(requireAuth, requireOrg);
+
+activityRouter.get("/", async (req, res, next) => {
+  try {
+    res.json(await service.listActivity(req.organizationId!));
+  } catch (err) {
+    next(err);
+  }
+});