feat: per-board activity log

Adds an audit trail per board, visible from a new clock-icon button on the
toolbar. Useful for review-style work where someone wants to see who
contributed which references and when.

Logged events (high-signal only — canvas-edit noise intentionally skipped):
- image / video / pdf added (whether dropped, pasted, or pulled from a URL)
- board created / renamed / deleted
- thread started, resolved, reopened
- comment posted on a thread

Backend:
- new activity_logs table (id, board_id, user_id, denormalised actor name +
  email, action, target_type/id/label, metadata JSON, created_at) with an
  index on (board_id, created_at DESC).
- logActivity helper resolves the user once at log time and stores their
  display name + email so entries survive deactivation/rename.
- recordActivity wraps logActivity + a Socket.IO emit to the board's room
  so the panel updates live without polling.
- GET /api/boards/:id/activity?limit=&before= for pagination
  (collection-membership gated, viewer+).

Frontend:
- ActivityPanel side-drawer: time-grouped feed (Today / Yesterday / older),
  per-action icons + tone colours (add/remove/edit/comment), pagination
  via "Load older", live append on Socket.IO 'activity:new'.
- Relative timestamps refresh every 30s.
- Wired into Editor + Toolbar.

README updated; roadmap entry checked off.

README.md

@@ -39,6 +39,11 @@ Built because we needed PureRef's painlessness, Miro's collaboration, and a code
 - Threaded comments with status (open / resolved)
 - Review mode toggles a clean overlay for walking through feedback
 
+**Activity log**
+- Per-board audit trail visible from the toolbar — uploads, board renames, threads, replies
+- Live updates over Socket.IO (no refresh needed when collaborators are working)
+- Time-grouped feed (Today / Yesterday / older), pagination, deactivation-safe author labels
+
 **Media pipeline**
 - Image variants (thumbnail / hires / LOD) generated on upload via Sharp
 - Video poster + duration + dimensions extracted via ffmpeg
@@ -283,7 +288,7 @@ See [CHANGELOG.md](CHANGELOG.md) for the version history (v0.1.0 → v0.5.0).
 ## Roadmap
 
 - [x] Admin dashboard frontend (live at `/admin` — user create / reset-password / role / deactivate)
-- [ ] Per-board activity log (who added/deleted what, when)
+- [x] Per-board activity log (uploads, board events, threads, comments — live via Socket.IO)
 - [ ] Mobile-friendly read-only board view
 - [ ] Export board → PDF / image grid
 - [ ] Optional remote storage adapters (S3 direct, R2)