feat: per-board activity log

Adds an audit trail per board, visible from a new clock-icon button on the
toolbar. Useful for review-style work where someone wants to see who
contributed which references and when.

Logged events (high-signal only — canvas-edit noise intentionally skipped):
- image / video / pdf added (whether dropped, pasted, or pulled from a URL)
- board created / renamed / deleted
- thread started, resolved, reopened
- comment posted on a thread

Backend:
- new activity_logs table (id, board_id, user_id, denormalised actor name +
  email, action, target_type/id/label, metadata JSON, created_at) with an
  index on (board_id, created_at DESC).
- logActivity helper resolves the user once at log time and stores their
  display name + email so entries survive deactivation/rename.
- recordActivity wraps logActivity + a Socket.IO emit to the board's room
  so the panel updates live without polling.
- GET /api/boards/:id/activity?limit=&before= for pagination
  (collection-membership gated, viewer+).

Frontend:
- ActivityPanel side-drawer: time-grouped feed (Today / Yesterday / older),
  per-action icons + tone colours (add/remove/edit/comment), pagination
  via "Load older", live append on Socket.IO 'activity:new'.
- Relative timestamps refresh every 30s.
- Wired into Editor + Toolbar.

README updated; roadmap entry checked off.

backend/routes/upload.js

@@ -6,9 +6,10 @@ const https = require('https');
 const http = require('http');
 const { URL } = require('url');
 const { authMiddleware } = require('../auth');
-const { getBoard, getCollectionMember, createImage, createMediaJob, createPdfPage, updateImagePageCount } = require('../db');
+const { getBoard, getCollectionMember, createImage, getImage, createMediaJob, createPdfPage, updateImagePageCount } = require('../db');
 const { putBuffer, getImageUrl, MIME_TO_EXT, MAX_FILE_SIZE } = require('../minio');
 const { pdfInfo, bufferToTempFile } = require('../pdf-utils');
+const { recordActivity } = require('../activity');
 
 const router = Router();
 
@@ -192,6 +193,15 @@ router.post('/boards/:boardId/images', upload.single('image'), async (req, res)
           });
         }
 
+        recordActivity(req, {
+          boardId: board.id,
+          action: 'pdf.added',
+          targetType: 'pdf',
+          targetId: imageId,
+          targetLabel: originalname,
+          metadata: { pageCount: info.pageCount, fileSize: size },
+        });
+
         return res.status(201).json({
           id: image.id,
           media_type: 'pdf',
@@ -233,6 +243,15 @@ router.post('/boards/:boardId/images', upload.single('image'), async (req, res)
       createMediaJob({ id: jobId, imageId, boardId: board.id, type: 'poster' });
     }
 
+    recordActivity(req, {
+      boardId: board.id,
+      action: `${mediaType}.added`,
+      targetType: mediaType,
+      targetId: imageId,
+      targetLabel: originalname,
+      metadata: { fileSize: size, mimeType: mimetype, source: 'upload' },
+    });
+
     return res.status(201).json({
       id: image.id,
       url: publicUrl,
@@ -354,6 +373,15 @@ router.post('/boards/:boardId/images/from-url', async (req, res) => {
       createMediaJob({ id: jobId, imageId, boardId: board.id, type: 'poster' });
     }
 
+    recordActivity(req, {
+      boardId: board.id,
+      action: `${mediaType}.added`,
+      targetType: mediaType,
+      targetId: imageId,
+      targetLabel: filename,
+      metadata: { fileSize: buffer.length, mimeType, source: 'url', sourceUrl: url },
+    });
+
     return res.status(201).json({
       id: image.id,
       url: publicUrl,