Merge events and commands into one Activity feed, and lead with live state

Two changes to the PC page, both about what a responder meets first.

LIVE STATE FIRST. The contributed panels moved to the head of the card flow.
The grid is a two-column FLOW (column-count, with display:contents on the
column wrappers), so a card cannot be pinned to a side and only document order
decides where it lands - putting the panels first fills the left column with
endpoint status, services, processes, interfaces and activity, and leaves
identity, hardware, network and location to the right. Panels still self-order
among themselves by declared position and still self-hide when no plugin
answers for the asset type.

ONE ACTIVITY FEED replaces the Recent events card. Events and commands answer
the same question - what happened to this box - and reading them as two lists
meant interleaving by eye. GET /api/endpoints/asset/<id>/activity merges them
newest-first, capped at 15. Both are keyed by assetid, so it is two indexed
reads and a merge sort rather than a join, and it renders through the existing
ADR-010 list renderer with no bespoke frontend work. A failed command is marked
critical, because that is the row somebody needs to notice. Not collapsed by
default, unlike the card it replaces.

The core AuditLog is deliberately NOT a third source: its rows carry the action
as the entity name and the asset only inside a details string, so including it
would mean parsing prose to find out which machine a row belongs to.

Requester names are withheld from callers who cannot themselves issue commands,
via caller_holds. A read-only viewer - a guest, on a site that grants this
panel - gets the history without a roster of who restarted what, and the lookup
is skipped entirely rather than fetched and discarded. requestedby holds a user
ID, so names resolve through one batched query, not one per row.

Verified on dev telemetry: a queued command shows as 'Collect now / Pending by
admin' above the Windows events, ordered by time.

Full suite 2124 passed, vitest 260 passed, naming/contract/parity gates green,
spec regenerated at 332 paths.

plugins/endpoints/plugin.py

@@ -289,10 +289,16 @@ class EndpointsPlugin(BasePlugin):
                 'position': 13,
             },
             {
-                'id': 'endpoints-events',
-                'title': 'Recent events',
+                # One feed instead of two cards. Events and commands answer the
+                # same question - what happened to this box - and reading them
+                # separately meant interleaving two lists by eye. Sits high on
+                # the page because it is the first thing looked at when
+                # something has gone wrong, and NOT collapsed by default for
+                # the same reason.
+                'id': 'endpoints-activity',
+                'title': 'Activity',
                 'assettypes': ['computer'],
-                'endpoint': '/api/endpoints/asset/{assetid}/recentevents',
+                'endpoint': '/api/endpoints/asset/{assetid}/activity',
                 'render': 'list',
                 'collapsible': True,
                 'status': {
@@ -314,12 +320,12 @@ class EndpointsPlugin(BasePlugin):
                         },
                     },
                     'meta': [
+                        {'key': 'detail'},
                         {'key': 'eventtime', 'label': 'At', 'format': 'date'},
                     ],
                 },
-                'empty': 'No recent events.',
-                'collapsedDefault': True,
-                'position': 90,
+                'empty': 'Nothing recorded for this endpoint yet.',
+                'position': 20,
             },
             {
                 'id': 'endpoints-interfaces',