Add Activity update/delete endpoints + edit/delete UI

Problem

Activity declares routes: ['index','store','show','update','destroy'] but only Store/Index/Show actions exist. There's no way to edit or delete a run, and no UI for it.

Acceptance

• ActivityUpdateAction (PATCH /api/activities/{id}) + ActivityDestroyAction (DELETE) with ownership checks.
• Edit/delete controls on the activity detail page for the owner.

Done in 2a9913c.

Backend

• ActivityUpdateAction — PATCH /api/activities/{id}, owner-only (session-derived). Type/notes/trail always editable; measured fields (distance, duration, moving_time, pace, elevation, completed_at) only on manual entries. On GPS-recorded runs they're rejected with an explicit 422 ("Locked for GPS-recorded activities: …") so an edit can never retroactively alter a track that claimed/conquered territory.
• ActivityDestroyAction — DELETE /api/activities/{id}, owner-only. Kudos + comments cascade; territories and history rows that reference the run keep the land but get their activity_id provenance nulled first (references cleared before the parent delete, so the inline FKs can't trip and deleting a run never un-conquers ground).
• hasGps surfaced on index/show so clients know which fields are locked.

Frontend

• Owner-only Edit/Delete on the activity detail page: inline edit panel (measured inputs hidden on GPS runs), two-step delete confirm, deleted state with back-to-feed. Logic in useActivityEditor composable; updateActivity/deleteActivity in game-api; store patchActivity/removeActivity.
• Notes now display on the detail page.

Verified by scripts/verify-activity-crud.ts (22 checks): owner edit, foreign-user 403s, GPS-lock 422, no-fields/bad-type 422s, 404s, cascade counts exact, territory survives claim-run deletion with provenance nulled, history unlinked not deleted, delete replay 404. All 5 existing suites still green.