fix(dashboard): i18n, a11y, security, and type-safety fixes from PR review

- Use @RequiredArgsConstructor in AuditLogQueryService; remove unused import
- Add 401/403 tests for /activity endpoint
- Add getPulseStats and findContributorsPerDocument integration tests
- Use m.pulse_headline/pulse_you in FamilyPulse; composite avatar keys
- Replace hover:text-accent with hover:text-ink in ActivityFeed (WCAG AA)
- Localise "Alle →" link with feed_show_all key + aria-label
- Gate DropZone behind {#if data.canWrite}
- Export DashboardResumeDTO, DashboardPulseDTO, ActivityFeedItemDTO from api.ts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/dashboard/AuditLogQueryService.java

@@ -1,20 +1,17 @@
 package org.raddatz.familienarchiv.dashboard;
 
-import org.raddatz.familienarchiv.audit.AuditLogRepository;
+import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 
 import java.time.OffsetDateTime;
 import java.util.*;
 
 @Service
+@RequiredArgsConstructor
 public class AuditLogQueryService {
 
     private final AuditLogQueryRepository queryRepository;
 
-    public AuditLogQueryService(AuditLogQueryRepository queryRepository) {
-        this.queryRepository = queryRepository;
-    }
-
     public Optional<UUID> findMostRecentDocumentForUser(UUID userId) {
         return queryRepository.findMostRecentDocumentIdByActor(userId);
     }