feat(uat-p5): activity-feed module, signing-order tri-state, webhook health card

- Activity-feed: shared formatting module
  (src/components/shared/activity-formatting.ts) centralises action
  verbs, badge variants, entity-type labels, enum-value normalisation,
  shortValue, and buildDiffLine. The dashboard widget feed and the
  per-entity audit feed now both consume it - duplicate ~250 lines
  collapsed, vocabularies aligned, badge palette unified.
- Signing order setting becomes tri-state. The new
  TEMPLATE_DEFAULT value (the new default) skips overriding the
  template's own signingOrder so each Documenso template's stored
  setting wins. PARALLEL / SEQUENTIAL keep forcing the override.
- Admin Documenso page now ships a Webhook health card backed by
  /api/v1/admin/documenso-webhook/health (secret status,
  expected URL, last received event, recent secret rejections) and
  a "Test now" button that fires a synthetic DOCUMENT_OPENED through
  /api/v1/admin/documenso-webhook/test against the local receiver
  to verify the full pipeline without driving a real Documenso event.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/port-config.ts

@@ -422,7 +422,10 @@ export async function getPortDocumensoConfig(portId: string): Promise<PortDocume
     readSetting<string>(SETTING_KEYS.documensoApproverLabel, portId),
     readSetting<string>(SETTING_KEYS.documensoDeveloperUserId, portId),
     readSetting<string>(SETTING_KEYS.documensoApproverUserId, portId),
-    readSetting<'PARALLEL' | 'SEQUENTIAL'>(SETTING_KEYS.documensoSigningOrder, portId),
+    readSetting<'PARALLEL' | 'SEQUENTIAL' | 'TEMPLATE_DEFAULT'>(
+      SETTING_KEYS.documensoSigningOrder,
+      portId,
+    ),
     readSetting<string>(SETTING_KEYS.documensoRedirectUrl, portId),
     readSetting<string>(SETTING_KEYS.publicSiteUrl, portId),
   ]);
@@ -462,7 +465,13 @@ export async function getPortDocumensoConfig(portId: string): Promise<PortDocume
     approverLabel: approverLabel ?? 'Approver',
     developerUserId: developerUserId ?? null,
     approverUserId: approverUserId ?? null,
-    signingOrder: signingOrder ?? null,
+    // TEMPLATE_DEFAULT is the new tri-state default - it normalises to
+    // `null` here so downstream consumers (documenso-payload, signing-
+    // automation) skip passing signingOrder entirely and let the
+    // template's own setting win. PARALLEL / SEQUENTIAL still force
+    // the override.
+    signingOrder:
+      signingOrder === 'PARALLEL' || signingOrder === 'SEQUENTIAL' ? signingOrder : null,
     // Resolution chain: explicit Documenso override → port's marketing
     // site URL → null (Documenso falls back to its own default, which is
     // typically the configured APP_URL = the CRM login - not what we want

src/lib/settings/registry.ts

@@ -241,14 +241,18 @@ export const REGISTRY: SettingEntry[] = [
     section: 'documenso.behavior',
     label: 'Signing order',
     description:
-      'PARALLEL = all recipients can sign at once. SEQUENTIAL = each waits for the previous (v2 only — v1 always parallel).',
+      'Default flow when this port creates an envelope. Leave on "Use template default" to honour each Documenso template\'s own setting; pick PARALLEL or SEQUENTIAL to override every envelope this port creates (v2 only - v1 is always parallel).',
     type: 'radio',
     options: [
-      { value: 'PARALLEL', label: 'Parallel — all recipients sign concurrently' },
-      { value: 'SEQUENTIAL', label: 'Sequential — order matters (v2 only)' },
+      {
+        value: 'TEMPLATE_DEFAULT',
+        label: 'Use template default (recommended)',
+      },
+      { value: 'PARALLEL', label: 'Parallel - all recipients sign concurrently' },
+      { value: 'SEQUENTIAL', label: 'Sequential - order matters (v2 only)' },
     ],
     scope: 'port',
-    defaultValue: 'PARALLEL',
+    defaultValue: 'TEMPLATE_DEFAULT',
   },
   {
     key: 'documenso_redirect_url',