feat: Phase 1 foundation - schema, auth, realtime, shell

- Rewrote Drizzle schema: 20 tables with enums, relations, indexes
- Generated migration with DROP TABLE records (v1 EAV removal)
- Added passkey auth routes (register/login)
- Added requireWorkspaceAccess helper
- Added seedDefaultData for Personal workspace + welcome note
- Updated SSE endpoint for v2 entities + workspace_id filtering
- Created recordActivity helper (insert + pg_notify)
- Updated sidebar: Graph replaces Reports, removed Analytics
- Updated command palette for v2 entities
- Created AGENTS.md with locked contract
- Created llm-wiki scaffold (5 stubs)
- Added inline AGENT INSTRUCTION comments to all 50 API route files
- Fixed globals.css border-border class conflict
- Updated database.ts stub for v1 compatibility

apps/web/lib/activity.ts

@@ -0,0 +1,39 @@
+import { db, sql, activityFeed } from '@project-e/db';
+
+export interface RecordActivityParams {
+  actor: string;
+  action: string;
+  entityType: string;
+  entityId: string;
+  changes?: Record<string, unknown>;
+  workspaceId: string;
+}
+
+/**
+ * Record an activity feed entry and fire a pg_notify event.
+ * Every write API route MUST call this after every INSERT/UPDATE/DELETE.
+ */
+export async function recordActivity(params: RecordActivityParams): Promise<void> {
+  const { actor, action, entityType, entityId, changes, workspaceId } = params;
+
+  await db.insert(activityFeed).values({
+    actor,
+    action,
+    entityType,
+    entityId,
+    changes: changes ?? null,
+    workspaceId,
+  });
+
+  // Notify SSE subscribers
+  await sql.unsafe(
+    `SELECT pg_notify('project_e_events', ${JSON.stringify(
+      JSON.stringify({
+        type: entityType,
+        action,
+        id: entityId,
+        workspace_id: workspaceId,
+      })
+    )})`
+  );
+}