[web] Activity: a unified timeline (cycles · fills · flows · attestations) with audit-grade CSV export

[eaitbrahim]

Context (verified)

"Activity" today means one thing: cycles parsed from the engine JSONL log (keel/commands/activity.py, shared by CLI and /api/activity). Meanwhile three more activity-shaped stores exist independently:

• fills/orders — the orders table (see [web] Orders view: the per-order honesty record — expected vs actual fill, fee as paid, provenance #700)
• cash flows — the transactions ledger (CSV import + Coinbase; the purification report derives "owed to charity" from it, keel/execution/equity.py:59-78)
• attestations — asset_attestations, instrument_attestations, venue_trade_scopes, withdrawal attestations

Alpaca's Activities page has the best table UX on their platform: type filter chips (trades / transfers / dividends), date range, search, CSV export. Take the pattern; upgrade the export from spreadsheet to audit record.

Scope

1. Unified timeline joining the four sources into one chronology, with type filter chips: Trades / Flows / Attestations / System (cycles, gate events, halts). Date scoping reuses the existing ?scope= normalisation.
2. Each row keeps its source attribution — engine log vs venue-reported vs human-attested never blur into one undifferentiated feed.
3. CSV export (audit-grade): every row carries its provenance columns, and where a record has one, its hash:
   • trials-ledger rows carry row_hash + chain-verification status (keel/research/ledger.py verify_chain — SHA-256 over canonical JSON with prev_hash linkage)
   • attestation rows carry their attestation source (human-typed ceremony vs imported)
     This makes the export usable as a tax, audit, and purification record — tamper-evident by construction, not by claim.

Refusals

• No engagement-bait feeds (market movers, watchlists) anywhere near this timeline.

Acceptance

• The four sources merge without losing source attribution; filtering is server-side.
• CSV round-trips through a spreadsheet with hashes intact (no formatting-mangled fields).
• Read-only: no POST surface.

Depends on #700/#701/#702 patterns (Sprint 2, first).