feat(customers): customer portal (#354) on top of feature-flags reorg

Implements the recurring-customer login surface from
the-luap/picpeak#354 plugged into the maintainer's
new feature-flag infrastructure (PR #443) instead of
a parallel toggle.

* New `customerPortal` feature flag (foundation flag for the
  not-yet-built calendar/quotes/bills/messaging customer
  surfaces). Defaults FALSE on fresh installs, TRUE on existing
  installs (events > 0) via migration 095 so live customer
  accounts don't disappear mid-deployment.
* Foundation schema: customer_accounts, customer_invitations,
  event_customer_assignments, customer_password_resets, plus
  RBAC permissions customers.view / .create / .delete granted
  to super_admin + admin system roles.
* Backend: /api/admin/customers (invite, list, search, assign,
  deactivate, reset password) + /api/customer/auth/* +
  /api/customer/* (login, dashboard, accept-invite, reset).
  Customer JWT bypass minted via
  /api/customer/events/:slug/access-token so existing gallery
  middleware stays untouched.
* Frontend: /customer/* route tree gated by RequireFeature flag
  customerPortal, with login / dashboard / accept-invite /
  reset pages and a customer-side sidebar layout.
  /admin/customers and /admin/customers/:id gated identically.
* Settings → Features grows a "Customers" section with a
  Customer portal card. The maintainer's Features tab stays the
  single source of truth — no parallel Advanced features tab.
* CustomerAccountPicker on event create/edit forms hides itself
  when the flag is off; backend ignores customer_account_ids in
  that case instead of erroring the whole event save.

Translations: en + de hand-translated. nl/pt/ru fall through to
en — flagged here as needing native review.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

backend/src/database/db.js

@@ -554,11 +554,23 @@ async function ensureGlobalCategories() {
 // Helper function to log activities
 async function logActivity(activityType, metadata = {}, eventId = null, actor = null) {
   try {
+    // actor_id is integer-typed; some legacy callers pass a hex-string
+    // identifier (e.g. a 16-char guest fingerprint) which makes Postgres
+    // throw "invalid input syntax for type integer" and drop the entire
+    // log entry. Coerce anything non-integer to null and surface the
+    // string in actor_name so we don't lose the audit trail. Customer/
+    // admin actors are unaffected — their ids are already numeric.
+    const rawId = actor?.id;
+    const actorIdInt = Number.isInteger(rawId) ? rawId
+      : (typeof rawId === 'string' && /^\d+$/.test(rawId) ? Number(rawId) : null);
+    const actorName = actor?.name
+      || (actorIdInt === null && rawId !== undefined && rawId !== null ? String(rawId) : null);
+
     await db('activity_logs').insert({
       activity_type: activityType,
       actor_type: actor?.type || 'system',
-      actor_id: actor?.id || null,
-      actor_name: actor?.name || null,
+      actor_id: actorIdInt,
+      actor_name: actorName,
       metadata: JSON.stringify(metadata),
       event_id: eventId
     });