feat: per-board activity log

Adds an audit trail per board, visible from a new clock-icon button on the
toolbar. Useful for review-style work where someone wants to see who
contributed which references and when.

Logged events (high-signal only — canvas-edit noise intentionally skipped):
- image / video / pdf added (whether dropped, pasted, or pulled from a URL)
- board created / renamed / deleted
- thread started, resolved, reopened
- comment posted on a thread

Backend:
- new activity_logs table (id, board_id, user_id, denormalised actor name +
  email, action, target_type/id/label, metadata JSON, created_at) with an
  index on (board_id, created_at DESC).
- logActivity helper resolves the user once at log time and stores their
  display name + email so entries survive deactivation/rename.
- recordActivity wraps logActivity + a Socket.IO emit to the board's room
  so the panel updates live without polling.
- GET /api/boards/:id/activity?limit=&before= for pagination
  (collection-membership gated, viewer+).

Frontend:
- ActivityPanel side-drawer: time-grouped feed (Today / Yesterday / older),
  per-action icons + tone colours (add/remove/edit/comment), pagination
  via "Load older", live append on Socket.IO 'activity:new'.
- Relative timestamps refresh every 30s.
- Wired into Editor + Toolbar.

README updated; roadmap entry checked off.

backend/routes/boards.js

@@ -12,6 +12,7 @@ const {
   getCollectionMember,
 } = require('../db');
 const { deleteBoardImages: deleteBoardMinioImages } = require('../minio');
+const { recordActivity } = require('../activity');
 
 const router = Router();
 
@@ -81,6 +82,14 @@ router.post('/', (req, res) => {
       createdBy: req.user.id,
     });
 
+    recordActivity(req, {
+      boardId: board.id,
+      action: 'board.created',
+      targetType: 'board',
+      targetId: board.id,
+      targetLabel: board.name,
+    });
+
     return res.status(201).json({ board });
   } catch (err) {
     console.error('[boards] create error:', err);
@@ -171,8 +180,20 @@ router.put('/:boardId', (req, res) => {
     if (!result) return;
 
     const { name, description } = req.body;
+    const prevName = result.board.name;
     const updated = updateBoard(result.board.id, { name, description });
 
+    if (typeof name === 'string' && name.trim() && name.trim() !== prevName) {
+      recordActivity(req, {
+        boardId: updated.id,
+        action: 'board.renamed',
+        targetType: 'board',
+        targetId: updated.id,
+        targetLabel: updated.name,
+        metadata: { from: prevName, to: updated.name },
+      });
+    }
+
     return res.json({ board: updated });
   } catch (err) {
     console.error('[boards] update error:', err);
@@ -195,6 +216,14 @@ router.delete('/:boardId', async (req, res) => {
       console.error('[boards] MinIO cleanup error:', e);
     }
 
+    recordActivity(req, {
+      boardId: result.board.id,
+      action: 'board.deleted',
+      targetType: 'board',
+      targetId: result.board.id,
+      targetLabel: result.board.name,
+    });
+
     deleteBoard(result.board.id);
 
     return res.json({ message: 'Board deleted' });