fix: expose PR activity timing

[whoisasx]

Summary

• Persist and expose backend-selected stateChangedAt for PR summaries, including migration/sqlc/OpenAPI/frontend schema updates.
• Make right-sidebar Activity PR milestones clickable links using backend PR URLs and show state timing for draft/open/current-state rows.
• Fix the shared Badge sizing bug found in the PR-card RCA so draft/state labels size to content in the Summary rail and PR list.

RCA

The malformed draft chip came from the shared Badge base class using size-icon-xl, which fixed both width and height to the icon token. PR state badges overrode height with h-5 but still inherited the fixed 18px width, so the text overflowed outside the painted badge. The affected surfaces were the Summary rail PR card and the PR list page. Activity timeline rows, review labels, dashboard/session cards, and sidebar rows do not use that same fixed-width badge treatment.

Verification

• npm run sqlc
• npm run api
• cd backend && go test ./internal/httpd/... ./internal/service/session ./internal/storage/sqlite/store
• npm --prefix frontend run test -- SessionInspector.test.tsx badge.test.tsx
• npm --prefix frontend run typecheck
• git diff --check
• cd backend && test -z "$(gofmt -l internal/domain/pr.go internal/httpd/controllers/dto.go internal/httpd/controllers/sessions_test.go internal/service/session/pr_summary.go internal/service/session/service_test.go internal/storage/sqlite/store/pr_facts_test.go internal/storage/sqlite/store/pr_store.go internal/storage/sqlite/store/store_test.go)"
• Visual check via npm --prefix frontend run dev:web -- --host 127.0.0.1, ao preview http://127.0.0.1:5173/, and Playwright DOM measurements for Summary rail Activity links and Badge widths.

Omitted

• npm --prefix frontend run build is not available in frontend/package.json (Missing script: "build").

Closes #2835

[whoisasx]

Visual evidence for the right-sidebar PR activity changes, captured with Playwright from the mock demo-review-stack session at a 1440x1000 viewport.

Summary rail Pull Requests card: verifies the PR state chips size to their content; the draft chip wraps the full label instead of clipping to icon width.

Activity timeline: verifies PR activity entries render as clickable links with visible state timestamps. The hovered Draft PR #321 entry links to https://github.com/acme-inc/ao-demo/pull/321; opened PR entries also render as PR links with timestamps.

[illegalcall]

Timestamp correctness still has three gaps; inline comments identify the exact paths. The Badge note is non-blocking scope feedback.