refactor(server): split admin moderation, bot-activity and activity into capability routers

PR 2 of the domain split (docs/website/API_V2_PLAN.md § Phase 2). Carves 18 more
routes out of admin.routes.js into one router file per business capability,
in place, with every URL unchanged:

  moderation.router.js   (15)  /admin/moderation    modAccess at router level
  botActivity.router.js   (2)  /admin/bot-activity  adminOnly per route
  activity.router.js      (1)  /admin/activity      staff-wide, no extra gate

The residual admin.routes.js drops from 82 routes to 64.

Moderation was already gated by a prefix mount (adminRouter.use('/moderation',
modAccess)), so moderationRouter.use(modAccess) is the exact equivalent now that
the router is mounted at a prefix. Bot-activity's adminOnly was per-route and is
deliberately kept per-route: that is what holds the per-route handler count in
routes.guards.json, the only signal that would catch a dropped gate, since
requireRole(...) returns an anonymous arrow and never appears by name.

/activity gets its own file rather than waiting for dashboard.router.js in PR 4
— it is the staff audit log, a different capability from the dashboard's stats
overview and from the botScore middleware's in-memory ban state.

Acceptance:
  - routes.manifest.json  zero-diff (200 public + 2 internal)
  - routes.guards.json    zero-diff
  - swagger-output.json   zero-diff (198 operations)
  - api-route-inventory.json already in sync
  - 434 server tests green
  - role gates verified identical to main by reading the requireRole role sets
    off the live Express stack for every moved route plus untouched controls

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/admin/index.js

@@ -17,6 +17,9 @@ const accountRouter = require('./account.router')
 const usersRouter = require('./users.router')
 const invitesRouter = require('./invites.router')
 const authProvidersRouter = require('./authProviders.router')
+const moderationRouter = require('./moderation.router')
+const botActivityRouter = require('./botActivity.router')
+const activityRouter = require('./activity.router')
 const residualRouter = require('./admin.routes')
 
 const adminRouter = express.Router()
@@ -38,6 +41,11 @@ adminRouter.use('/invites', invitesRouter)
 // Mounted at /auth, not /auth/providers: /admin/auth is the capability, and the
 // routes inside read as /providers[/:id].
 adminRouter.use('/auth', authProvidersRouter)
+// /moderation carries its own moderator gate; /bot-activity is admin-only per
+// route. /activity is staff-wide — the audit log, not the bot-scoring state.
+adminRouter.use('/moderation', moderationRouter)
+adminRouter.use('/bot-activity', botActivityRouter)
+adminRouter.use('/activity', activityRouter)
 
 // Everything not yet extracted, at the group root. Mounted last, but none of the
 // prefixes above appear in it, so nothing here depends on the ordering.