feat(server): add immutable activity/audit feed API

[martsokha]

Context

An activity response type exists but lacks the queryable, immutable audit trail with tamper-evidence guarantees required by the runtime's compliance documentation.

Requirements

• Append-only activity records for every mutating action (create, update, delete, role change, policy update)
• Each record includes: actor identity, action type, affected resource, timestamp, change summary
• Records cannot be modified or deleted before their retention period expires
• API supports filtering by workspace, actor, action type, and time range
• Cursor-based pagination for large audit trails
• Suitable for compliance reporting and forensic investigation

References

• Server docs: SECURITY.md - Audit Logging
• Runtime: COMPLIANCE.md Section 4