feat(uat-p5): activity-feed module, signing-order tri-state, webhook health card

- Activity-feed: shared formatting module
  (src/components/shared/activity-formatting.ts) centralises action
  verbs, badge variants, entity-type labels, enum-value normalisation,
  shortValue, and buildDiffLine. The dashboard widget feed and the
  per-entity audit feed now both consume it - duplicate ~250 lines
  collapsed, vocabularies aligned, badge palette unified.
- Signing order setting becomes tri-state. The new
  TEMPLATE_DEFAULT value (the new default) skips overriding the
  template's own signingOrder so each Documenso template's stored
  setting wins. PARALLEL / SEQUENTIAL keep forcing the override.
- Admin Documenso page now ships a Webhook health card backed by
  /api/v1/admin/documenso-webhook/health (secret status,
  expected URL, last received event, recent secret rejections) and
  a "Test now" button that fires a synthetic DOCUMENT_OPENED through
  /api/v1/admin/documenso-webhook/test against the local receiver
  to verify the full pipeline without driving a real Documenso event.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/port-config.ts

@@ -422,7 +422,10 @@ export async function getPortDocumensoConfig(portId: string): Promise<PortDocume
     readSetting<string>(SETTING_KEYS.documensoApproverLabel, portId),
     readSetting<string>(SETTING_KEYS.documensoDeveloperUserId, portId),
     readSetting<string>(SETTING_KEYS.documensoApproverUserId, portId),
-    readSetting<'PARALLEL' | 'SEQUENTIAL'>(SETTING_KEYS.documensoSigningOrder, portId),
+    readSetting<'PARALLEL' | 'SEQUENTIAL' | 'TEMPLATE_DEFAULT'>(
+      SETTING_KEYS.documensoSigningOrder,
+      portId,
+    ),
     readSetting<string>(SETTING_KEYS.documensoRedirectUrl, portId),
     readSetting<string>(SETTING_KEYS.publicSiteUrl, portId),
   ]);
@@ -462,7 +465,13 @@ export async function getPortDocumensoConfig(portId: string): Promise<PortDocume
     approverLabel: approverLabel ?? 'Approver',
     developerUserId: developerUserId ?? null,
     approverUserId: approverUserId ?? null,
-    signingOrder: signingOrder ?? null,
+    // TEMPLATE_DEFAULT is the new tri-state default - it normalises to
+    // `null` here so downstream consumers (documenso-payload, signing-
+    // automation) skip passing signingOrder entirely and let the
+    // template's own setting win. PARALLEL / SEQUENTIAL still force
+    // the override.
+    signingOrder:
+      signingOrder === 'PARALLEL' || signingOrder === 'SEQUENTIAL' ? signingOrder : null,
     // Resolution chain: explicit Documenso override → port's marketing
     // site URL → null (Documenso falls back to its own default, which is
     // typically the configured APP_URL = the CRM login - not what we want