feat: per-board activity log

Adds an audit trail per board, visible from a new clock-icon button on the
toolbar. Useful for review-style work where someone wants to see who
contributed which references and when.

Logged events (high-signal only — canvas-edit noise intentionally skipped):
- image / video / pdf added (whether dropped, pasted, or pulled from a URL)
- board created / renamed / deleted
- thread started, resolved, reopened
- comment posted on a thread

Backend:
- new activity_logs table (id, board_id, user_id, denormalised actor name +
  email, action, target_type/id/label, metadata JSON, created_at) with an
  index on (board_id, created_at DESC).
- logActivity helper resolves the user once at log time and stores their
  display name + email so entries survive deactivation/rename.
- recordActivity wraps logActivity + a Socket.IO emit to the board's room
  so the panel updates live without polling.
- GET /api/boards/:id/activity?limit=&before= for pagination
  (collection-membership gated, viewer+).

Frontend:
- ActivityPanel side-drawer: time-grouped feed (Today / Yesterday / older),
  per-action icons + tone colours (add/remove/edit/comment), pagination
  via "Load older", live append on Socket.IO 'activity:new'.
- Relative timestamps refresh every 30s.
- Wired into Editor + Toolbar.

README updated; roadmap entry checked off.

backend/routes/activity.js

@@ -0,0 +1,35 @@
+const { Router } = require('express');
+const { authMiddleware } = require('../auth');
+const { getBoardActivity } = require('../db');
+const { resolveBoard } = require('./board-access');
+const { formatRow } = require('../activity');
+
+const router = Router();
+router.use(authMiddleware);
+
+/**
+ * GET /api/boards/:boardId/activity
+ * Returns recent activity entries for a board, newest first.
+ *
+ * Query params:
+ *   limit  — max entries to return (1-200, default 50)
+ *   before — ISO timestamp; only entries created strictly before this
+ */
+router.get('/:boardId/activity', (req, res) => {
+  try {
+    const result = resolveBoard(req, res, 'viewer');
+    if (!result) return;
+
+    const { limit, before } = req.query;
+    const rows = getBoardActivity(result.board.id, { limit, before });
+    return res.json({
+      activity: rows.map(formatRow),
+      hasMore: rows.length === Math.max(1, Math.min(parseInt(limit, 10) || 50, 200)),
+    });
+  } catch (err) {
+    console.error('[activity] list error:', err);
+    return res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+module.exports = router;