milestone 29: activity — history, live and policy simulation on one surface

query log, live and lookup merge into /activity. history filters live
in the url, so a pasted link or back/forward reproduces the exact
view; the result column separates servfail and nxdomain from success
in the list. live is follow-by-default with freeze, and a streamed
row opens its in-memory provenance detail — no correlation invented
for rows sqlite has not written. lookup survives as the current
policy simulation under /activity/test. investigation links carry
absolute bounds, and the diagnostics page now honors since/until
instead of ignoring them. the old routes are gone without aliases.

admin/src/auth/LoginPage.test.tsx

@@ -87,8 +87,8 @@ test("429 login shows a ticking countdown and keeps submit disabled until it end
 
 test("safeRedirect only allows same-origin absolute paths", () => {
 	expect(safeRedirect(undefined)).toBe("/");
-	expect(safeRedirect("/queries")).toBe("/queries");
-	expect(safeRedirect("/queries?x=1")).toBe("/queries?x=1");
+	expect(safeRedirect("/activity")).toBe("/activity");
+	expect(safeRedirect("/activity?x=1")).toBe("/activity?x=1");
 	expect(safeRedirect("//evil.example")).toBe("/");
 	expect(safeRedirect("https://evil.example")).toBe("/");
 	expect(safeRedirect("/\\evil.example")).toBe("/");