Slice 3: activity feed and active project (SSE + MCP tools)

Add internal/activity (thread-safe active project + bounded event feed with subscriber fan-out). Service exposes active-project/activity methods and takes the feed. New MCP tools get_active_project/set_active_project/get_activity and HTTP endpoints GET/POST /api/active-project, /api/activity, and /events (SSE). New <activity-feed> component updates live via EventSource; <repo-list> sets the active project on selection. Verified end-to-end in the running app: user actions push live events and set the active project (actor=user), all readable by Claude over MCP.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -98,3 +98,21 @@ Append-only running history of all changes (AGENT.md §9.1). Newest last.
   endpoint directly — no public exposure, no HTTPS needed for this path.
 - **Affects:** `AGENT.md` (§8.1, §11); user's `claude_desktop_config.json` (outside
   the repo). HTTPS/`:8443` from the prior entry stays available but is now optional.
+
+## 2026-09-20 — Slice 3: activity feed + active project (§8.2)
+- **What:** Added `internal/activity` (thread-safe active project + bounded event
+  feed with subscriber fan-out, mirrored to logs, no datastore). Service gained
+  `ActiveProject`/`SetActiveProject`/`RecordActivity`/`Activity`/`SubscribeActivity`
+  (and `service.New` now takes the feed). New MCP tools `get_active_project`,
+  `set_active_project`, `get_activity` (object-wrapped outputs). New HTTP:
+  `GET/POST /api/active-project`, `GET /api/activity`, and `GET /events` (SSE).
+  New `<activity-feed>` component (live via EventSource); `<repo-list>` now sets
+  the active project on selection (a user action). Extended the MCP test to cover
+  the new tools; help page documents the feature.
+- **Why:** The coordination foundation for the graceful project handoff (§8.3):
+  the app and Claude share one active-project + activity view. User actions are
+  recorded as `actor:user`, Claude's as `actor:claude`, so each side can see what
+  the other did.
+- **Affects:** `internal/activity` (new), `internal/service`, `internal/mcp`
+  (+test), `cmd/server/main.go`, `components/activity-feed` (new),
+  `components/repo-list`, `web/templates/{index,help}.html`.