feat: activity audit log written from all resource routes

Add the activity_log table, a best-effort recordActivity() service and a
GET /api/activity feed, and write entries on create/update/delete of
patients, notes, appointments, prescriptions and tasks. The Activity page
now shows the real audit trail (actor, action, patient context, time);
the fabricated signing hashes / approval badges are gone — that vision
stays deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/types/activity.ts

@@ -0,0 +1,21 @@
+// The canonical activity-log entry returned by the API. A plain, tamper-evident
+// audit trail of record changes within a clinic. (The blockchain-style signing /
+// patient-approval flow from the product vision is separate and not built yet.)
+export type ActivityEntityType =
+  | "patient"
+  | "note"
+  | "appointment"
+  | "prescription"
+  | "task";
+
+export type ActivityEntry = {
+  id: string;
+  actorName: string;
+  actorInitials: string;
+  action: string;
+  entityType: ActivityEntityType;
+  entityId: string | null;
+  patientName: string | null;
+  patientFileNumber: string | null;
+  createdAt: string;
+};