feat: add Activity type system, DB migration, and self-only showActivity in sanitizeUser

- Add Activity, ActivityType, ActivityTimestamps, ActivityAssets types to shared types
- Add activity_update client event and activities field on presence_update server event
- Add userActivities to ready payload and showActivity to User/UpdateUserRequest
- Create shared activities.ts with ACTIVITY_LIMITS, ACTIVITY_PRIORITY, getPrimaryActivity
- Add show_activity column to users table (schema + migration)
- Update sanitizeUser with isSelf parameter; only include showActivity for self
- Fix .map(sanitizeUser) calls to use arrow wrapper to prevent index-as-boolean bug
- Mark auth routes (register/login) as isSelf=true since they return own user data

packages/server/src/utils/sanitize.ts

@@ -1,7 +1,7 @@
 import type { User, ReplicatedInstance } from '@backspace/shared';
 import { schema } from '../db/index.js';
 
-export function sanitizeUser(row: typeof schema.users.$inferSelect): User {
+export function sanitizeUser(row: typeof schema.users.$inferSelect, isSelf = false): User {
   // Tombstoned (deleted) users — return anonymized profile
   if (row.isDeleted === 1) {
     return {
@@ -23,6 +23,7 @@ export function sanitizeUser(row: typeof schema.users.$inferSelect): User {
       homeInstance: null,
       homeUserId: null,
       replicatedInstances: [],
+      ...(isSelf ? { showActivity: false } : {}),
     };
   }
 
@@ -53,5 +54,6 @@ export function sanitizeUser(row: typeof schema.users.$inferSelect): User {
     homeInstance: row.homeInstance ?? null,
     homeUserId: row.homeUserId ?? null,
     replicatedInstances,
+    ...(isSelf ? { showActivity: row.showActivity !== 0 } : {}),
   };
 }