feat: add tamper-evident activity audit log

[LuisD-Dev]

Description

Adds tamper evidence to the durable activity audit log using a deterministic SHA-256 hash chain.

Each persisted activity entry is cryptographically bound to its canonical content and the previous entry's hash. An admin-only verification endpoint validates the stored chain and reports the first affected entry when historical activity data has been modified or deleted.

The feature is scoped to durable PostgreSQL activity storage. Existing mock, memory, file, and synthetic activity behavior remains unchanged.

Linked Issue

Closes #264

Type of Change

• 🐛 Bug fix
• ✨ New feature / enhancement
• 📝 Documentation update
• 🔧 Chore / refactor
• 🧪 Tests only

Changes Made

• Added deterministic canonical serialization and SHA-256 hash chaining for durable activity entries.
• Added monotonic chain sequencing and concurrency-safe PostgreSQL writes to prevent chain forks during simultaneous activity inserts.
• Added migration and deterministic backfill support for existing durable activity data.
• Added chain verification that detects and localizes historical content changes, hash tampering, sequence gaps, predecessor mismatches, and deleted entries.
• Added an admin-protected GET /api/activity/verify endpoint for integrity verification.
• Routed durable activity writers through the shared hash-chain write path.
• Added PostgreSQL security and concurrency tests.
• Documented the hash-chain integrity model and the external anchoring limitation.
• Kept mock, memory, file, synthetic activity, authentication roles, and unrelated business logic unchanged.

Test Evidence

Fresh PostgreSQL integration tests

16 passed
0 failed
0 skipped