Add handler-level endpoint tests for activity unknown-actor path

[martsokha]

Context

PR #244 fixed the activity list/export filter so that:

• an actor username matching no account short-circuits to an empty result rather than filtering on a nil-UUID sentinel, and
• the date window is validated before that short-circuit, so an inverted from/to range returns 400 regardless of the actor (consistent with the export endpoint).

The ordering is currently guarded by a unit test on ActivityFilterQuery::to_filter (crates/nvisy-server/src/handler/request/activities.rs), which asserts an inverted window is rejected. As CodeRabbit noted (review), that test would still pass if list_activities reintroduced the early ActorFilter::Unknown return before building the filter — it does not cover the handler-level ordering.

Ask

Add handler-level (endpoint) tests for GET /workspaces/{slug}/activities/ covering:

1. ?actor=<missing>&from=2026-02-01&to=2026-01-01 (inverted window) → HTTP 400.
2. ?actor=<missing> with a valid window → HTTP 200 with an empty page.

Why this is deferred, not done in the PR

The handler test harness (crates/nvisy-server/src/handler/mod.rs, axum_test::TestServer) is DB-backed and #[ignore]d (needs Postgres + key files). Auth runs before the validation being tested, so an endpoint test needs a full fixture that does not exist today: account creation, Ed25519 JWT signing, and workspace + membership setup. That fixture is worth building once as shared test infrastructure (it would unblock endpoint tests across handlers), rather than bolting onto this PR.

Suggested scope

• Introduce a reusable authed-request fixture in the handler test module (create account → sign JWT → create workspace + membership → return an authorized TestServer request builder).
• Use it for the two activity cases above; it then generalizes to other workspace-scoped handlers.