T2/Phase 2A: port auth + infrastructure routes to Hono (~8 routes)

- /api/health: DB ping + version + uptime
   - /api/auth/*: NextAuth -> Auth.js standalone (credentials + passkey)
   - /api/domains: full CRUD
   - /api/realtime: SSE with PostgreSQL LISTEN/NOTIFY
   - /mcp: JSON-RPC 2.0 (initialize, tools/list, tools/call, resources/*)

   Parent: t_e1cbd87d -> t_d8654a91 (T1)

apps/api/src/middleware/activity.ts

@@ -0,0 +1,26 @@
+import { db, sql, activityFeed } from "@project-e/db";
+
+export interface RecordActivityParams {
+  actor: string;
+  action: string;
+  entityType: string;
+  entityId: string;
+  changes?: Record<string, unknown>;
+  workspaceId: string;
+}
+
+export async function recordActivity(params: RecordActivityParams): Promise<void> {
+  const { actor, action, entityType, entityId, changes, workspaceId } = params;
+
+  await db.insert(activityFeed).values({
+    actor,
+    action,
+    entityType,
+    entityId,
+    changes: changes ?? null,
+    workspaceId,
+  });
+
+  const payload = JSON.stringify({ type: entityType, action, id: entityId, workspace_id: workspaceId });
+  await sql`SELECT pg_notify(project_e_events, ${payload}::text)`;
+}