fix(#145): address PR review — full-table scan, a11y, grid, tests

- DocumentService.getRecentActivity: replace findAll(Sort)+stream().limit()
  with findAll(PageRequest) so LIMIT is pushed to the database
- +page.svelte: collapse two-column grid to single column when mentions is empty
- DashboardNeedsMetadata: raise "show all" link from text-xs (12px) to text-sm
  (14px) and add hover:underline for WCAG 1.4.1
- DashboardRecentDocuments: add comment explaining why T12:00:00 noon-anchor
  is absent (updatedAt is a full ISO datetime, not a date-only string)
- DocumentServiceTest: update getRecentActivity tests to assert PageRequest
  usage instead of findAll(Sort)
- DocumentRepositoryTest: add @DataJpaTest verifying findAll(PageRequest)
  returns only size rows, not the full table
- DocumentControllerTest: add test for default size=5 when param is omitted
- NotificationServiceTest: add test documenting that type+read=true falls
  through to the type-only query (intentional)
- page.server.spec.ts: replace stale tests with full dashboard-mode coverage
- DashboardMentions.svelte.spec.ts: add tests for REPLY type and absent documentId
- DashboardResumeStrip.svelte.spec.ts: add corrupt localStorage test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/lib/components/DashboardResumeStrip.svelte.spec.ts

@@ -40,4 +40,11 @@ describe('DashboardResumeStrip', () => {
 		const link = page.getByRole('link');
 		await expect.element(link).toHaveAttribute('href', '/documents/doc-456');
 	});
+
+	it('renders nothing when localStorage contains malformed JSON', async () => {
+		localStorage.setItem('familienarchiv.lastVisited', '{not valid json');
+		render(DashboardResumeStrip, {});
+		const strip = page.getByTestId('resume-strip');
+		await expect.element(strip).not.toBeInTheDocument();
+	});
 });