feat(portal): split Activity into MCP and API Gateway views, PromQL-backed

[cjimti]

Part of #459.

Problem

The current Activity page at ui/src/pages/activity conflates human MCP usage
and 24/7 API gateway ETL traffic. At ETL volume (multiple per second sustained),
the gateway noise completely drowns the MCP signal. The two domains also have
different drilldown shapes: MCP wants user + tool + persona breakdowns; API
gateway wants connection x endpoint x status x identity breakdowns.

Acceptance criteria

• Activity page split into two tabs:
  • MCP (default): the existing per-user / per-tool view, filtered to
    exclude API gateway events (depends on the audit-tagging sub-issue).
  • API Gateway: new view backed by PromQL via the proxy.
• API Gateway view includes:
  • Top connections by request volume over last 1h / 24h / 7d.
  • Per-connection breakdown: total requests, error rate, p50 / p95 / p99
    latency, top endpoints by volume.
  • Per-endpoint drill-down: methods, status class distribution, identity
    breakdown (which API key is driving traffic).
  • Time-series chart on every selected dimension.
• Empty state when the PromQL proxy returns 503
  (Observability backend not configured. See docs.).
• All queries use recording rules where available; raw histograms only for
  drill-downs that need bucket detail.
• E2E test (Playwright): tabs render, switching works, default time range loads,
  drill-down navigation works.

Implementation notes

• Reuse existing portal chart components. Do NOT introduce a new chart library.
• PromQL queries live in ui/src/pages/activity/queries.ts so they can be
  versioned and tested independently of the UI.
• React Query caches with ~30s stale time (matches Prometheus default scrape interval).
• Persona-gated visibility: hide the API Gateway tab for personas without
  observability:read.

Depends on

• Inbound API gateway metrics sub-issue (label shape).
• PromQL proxy sub-issue (data source).
• Audit-tagging sub-issue (so the MCP tab can cleanly exclude gateway events).

Files

• ui/src/pages/activity/*
• portal API client
• E2E tests