#820 SECURITY: /api/v1/activities listed all tenants' activities (no tenant filter)

GET /api/v1/activities built its SQL with WHERE 1=1 and never filtered by tenant: any tenant's API key listed every tenant's activities (function names, workflow names, errors, worker ids — response rows even carried tenant_id). Found during the #819 UX-review Wave A while implementing the workflow_name filter: demo tenant's real activity count is 172, but the dashboard showed 'All 1281' — the excess was other tenants' data, so the leak was user-visible in production. Fix (commit a043585): both the page query and the count query now share one filter fragment including wr.tenant_id = g.tenant_id (count query gained the workflow_run JOIN). Orphan activities with no workflow_run row are excluded — rows that cannot be attributed to a tenant must not be shown to one. Verified live: demo-scoped total=172, workflow_name filter returns demo-only rows. LESSON: list endpoints must be tenant-filtered at the SQL layer, not assumed safe via RBAC decorators — @require_permission checks the caller has 'view_workflows', not WHOSE rows they may view. Audit other list endpoints for the same pattern.