feat: activity audit log written from all resource routes

Add the activity_log table, a best-effort recordActivity() service and a
GET /api/activity feed, and write entries on create/update/delete of
patients, notes, appointments, prescriptions and tasks. The Activity page
now shows the real audit trail (actor, action, patient context, time);
the fabricated signing hashes / approval badges are gone — that vision
stays deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/lib/activity.ts

@@ -0,0 +1,27 @@
+import { apiFetch } from "@/lib/api-client";
+
+// An audit-log entry. Mirrors the backend `src/types/activity.ts`. A plain,
+// tamper-evident trail of record changes in the active clinic. (The signing /
+// patient-approval vision is separate and not built yet.)
+export type ActivityEntityType =
+  | "patient"
+  | "note"
+  | "appointment"
+  | "prescription"
+  | "task";
+
+export type ActivityEntry = {
+  id: string;
+  actorName: string;
+  actorInitials: string;
+  action: string;
+  entityType: ActivityEntityType;
+  entityId: string | null;
+  patientName: string | null;
+  patientFileNumber: string | null;
+  createdAt: string;
+};
+
+export function listActivity(): Promise<ActivityEntry[]> {
+  return apiFetch<ActivityEntry[]>("/api/activity");
+}