feat: community activity log for admins (logins, page views, posts, votes, badges, review, reputation)

[rstrzelecki-inne-projekty]

Proposed Changes

Adds an admin-only Activity log (Admin → Community → Activity log, /admin/activity-log): one place to see what the community is doing — logins, page views, posts, votes, badges, review queue, reputation changes, moderation actions — with filters and a TSV export.

We run Answer as an internal Q&A for a few hundred accountants; the admins asked "what happened today?" and there was no single answer: activity covers reputation-bearing actions only, logins leave just last_login_date, review decisions live in review, badges in badge_award, page views nowhere. This PR records all of it in one table and gives it a screen.

What is recorded

Source	Actions
event queue (eventqueue.Service)	question/answer/comment × create/update/delete, votes as *.vote_up / *.vote_down / *.vote_cancel (the vote service now adds vote_direction to the event; cancelled votes are logged directly so badge rules do not re-run), question.accept, *.flag, *.react, comment.reply (a comment answering another comment; the person answered is the target), user.update, user.share
userRepo.UpdateLastLoginDate	user.login — every login path (password, connectors, user center) goes through it; method is derived from the request path, IP / user agent from the gin context
BadgeAwardService.Award	badge.award (badge name key, award key)
ReviewService	review.queued when a reviewer plugin sends a post to the queue (reason, submitter), review.approve / review.reject on the moderator's decision
UserRankRepo.ChangeUserRank	reputation.change for every reputation change, with the delta and the object / activity that caused it (callers pass them via activity_log.WithRankContext)
UserAdminService	user.role, user.suspend, user.unsuspend, user.delete
UI beacon	page.view — POST /answer/api/v1/activity-log/view from Layout on route change (logged-in users only, same path deduplicated within 10 s); kept for ACTIVITY_LOG_PAGEVIEW_DAYS days (default 90, 0 = forever), removed by a daily cron

Design notes

• activity_log table is created on start-up with Sync2 (no new numbered migration); writes go through a dedicated async queue so requests never wait for the log.
• internal/base/queue now keeps a list of handlers instead of one — RegisterHandler appends, every handler gets every message. The badge handler keeps working unchanged; the log is a second subscriber.
• Hooks that run inside a transaction (ChangeUserRank) do no DB reads — on SQLite a read on another connection would wait for the write lock forever (we hit that). The activity config id is stored and resolved to its key when the log is displayed.
• Empty ids are normalised to 0 before insert (PostgreSQL rejects "" for bigint, SQLite does not).
• DI: the writer (NewActivityLogService) depends only on the repo, the comment repo and the event queue; object/user lookups used to enrich rows are attached by the admin service, because the repos that log (user, rank) sit below object_info / user_common in the graph.

API (admin, role 2)

• GET /answer/admin/api/activity-log?from=&to=&username=&action=a,b&q=&page=&page_size= — rows enriched with actor / target, object title, question / answer ids; q matches detail, action, ip, users (username / display name / e-mail) and object ids.
• GET /answer/admin/api/activity-log/actions?from=&to= — action keys with counts (for the filter).
• GET /answer/admin/api/activity-log/export?… — text/tab-separated-values, UTF-8 with BOM (opens in Excel), streamed in batches, capped at 100 000 rows.
• POST /answer/api/v1/activity-log/view {path, title} — the page-view beacon (any logged-in user).

UI

Admin → Community → Activity log: date presets (Today — default, Yesterday, 7 days, 30 days, Custom from–to), user (with suggestions), action (multi-select with counts), free-text search, Export TSV; table with time, user, action badge, object link (question / answer / comment / page / profile), details, target user and reputation delta. All filters live in the URL so a view can be shared.

Tests / verification

• go test ./internal/service/activity_log/ ./internal/base/queue/ (event → entry mapping incl. vote direction, comment replies, page-view dedup).
• Running in production on our instance (2.0.2 + this patch) on PostgreSQL and in a SQLite smoke test.

🤖 Generated with Claude Code

https://claude.ai/code/session_0181uZ2px83HmPo3HKSEzWQR