fix: gate the recent-activity fetch on audit:read

[Altamimi-Dev]

Closes #63.

useMiniCardStatuses fetched /api/logs/activity unconditionally, so every caller without audit:read (every non-admin under the default backend roles, including team_admin) fired a guaranteed 403 on each home load. The failure is swallowed by the mini cards, so it only showed up as 403 noise in network and server logs.

This adds an enabled option to useRecentActivity, mirroring the flag useSystemHealth already has for the admin-only /version probe, and gates the home call on hasPermission("audit:read"). While disabled the hook makes no request and returns an empty feed; permissions load async, so the gate starts closed and the hook fetches when it opens. The gate checks audit:read only, not security:read, since the security-events half is additive server-side.

The gate lives in the hook rather than the call site so the upcoming ActivityView consumer gets it for free.

[a-effort]

Thanks for contributing! 🙌 No blockers; approving.

LLM-assisted feedback on improvements that could be included in this PR or added as followups:

Gate is correct, and the backend backs it up: log_search.py requires audit:read and folds security events in additively. One bug in the hook contract:

isLoading is never true for the fetch that happens: hasPermission fails closed while permissions load (AuthContext.tsx:256), so enabled starts false for every authenticated caller, not just non-admins. The disabled branch sets isLoading false; when the gate opens, the effect calls fetchOnce without setting it back. During the one real request the hook returns { isLoading: false, items: [] }.

Confirmed against this branch with a delayed handler:

rerender({ enabled: true });
IN FLIGHT -> { isLoading: false, items: 0 }

The mini cards only destructure items, so home is unaffected. It matters for the next consumer: ActivityView would render "no recent activity" and then pop into the list. Same on team switch: the permissions effect sets loading: true on selectedTeamId change, re-closing the gate.

     const controller = new AbortController();
+    setIsLoading(true);
     void fetchOnce(controller.signal);

Worth a comment on that line: it belongs in the effect body, not inside fetchOnce, or the 30s poll flashes a spinner on every tick.

Please add a test asserting isLoading is true between the rerender and the resolve; the current disabled-state test doesn't cover it

[a-effort]

No blocking changes needed. 🚀