feat(web): fold Events/Agent/Audit into EntityDetail; tag agent_activity with entity_id

Events, Agent, and Audit were standalone read-only pages that never
cross-referenced the entity they related to. Fold them into EntityDetail
as entity-scoped cards (Agent activity, Audit trail) alongside the
existing Signals/Executions/Knowledge cards, and give the Signals card
real Ack/Mute/Resolve actions. Signals stays a standalone page since
it's the only one with cross-entity triage value (badge count, actions).

Also fixes the underlying reason those new cards would've stayed empty:
agent_activity rows were never tagged with entity_id at insert time
(cmd/nomos/store.go, internal/mcp/server.go), even though the column
and the API filter both support it. Added a best-effort resolver that
checks common tool-arg keys (target, entity_slug, slug, ...) against
the entities table.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cmd/nomos/store.go

@@ -1027,18 +1027,59 @@ func (s *store) executionTarget(ctx context.Context, execID uuid.UUID) string {
 	return slug
 }
 
+// entityArgKeys lists tool-argument keys, in priority order, that commonly
+// carry the target entity's slug or UUID. Tool input schemas aren't
+// consistent about naming this (target, entity_slug, slug, service_slug,
+// lxc_slug, entity_id all appear across the MCP tool registrations in
+// internal/mcp/server.go), so this is a best-effort lookup used to tag
+// agent_activity rows with the entity a tool call acted on.
+var entityArgKeys = []string{
+	"target", "entity_slug", "slug", "slug_or_id",
+	"service_slug", "lxc_slug", "entity_id", "about",
+}
+
+// resolveArgEntityID best-effort resolves the entity a tool call acted on
+// from its arguments, trying entityArgKeys in order. Returns uuid.Nil if no
+// key is present or none resolves to a known entity.
+func (s *store) resolveArgEntityID(ctx context.Context, args map[string]any) uuid.UUID {
+	if s == nil {
+		return uuid.Nil
+	}
+	for _, key := range entityArgKeys {
+		v, _ := args[key].(string)
+		if v == "" {
+			continue
+		}
+		if u, err := uuid.Parse(v); err == nil {
+			return u
+		}
+		var id uuid.UUID
+		if err := s.pool.QueryRow(ctx, "SELECT id FROM entities WHERE slug = $1", v).Scan(&id); err == nil {
+			return id
+		}
+	}
+	return uuid.Nil
+}
+
 // logActivity records a tool call. agent_id is the agent entity UUID and is
 // NOT NULL in the schema, so we skip logging when it can't be resolved.
-// The (nullable) session_id column carries the conversation id.
-func (s *store) logActivity(ctx context.Context, agentID uuid.UUID, sessionID, toolName, inputSummary, outputSummary string, durationMs int, success bool, correlationID string) {
+// The (nullable) session_id column carries the conversation id. args is the
+// tool call's own arguments, used to best-effort tag the row with the
+// entity it acted on (see resolveArgEntityID).
+func (s *store) logActivity(ctx context.Context, agentID uuid.UUID, sessionID, toolName string, args map[string]any, inputSummary, outputSummary string, durationMs int, success bool, correlationID string) {
 	if s == nil || agentID == uuid.Nil {
 		return
 	}
+	entityID := s.resolveArgEntityID(ctx, args)
+	var entityIDArg any
+	if entityID != uuid.Nil {
+		entityIDArg = entityID
+	}
 	s.pool.Exec(ctx, `
 		INSERT INTO agent_activity
-		    (agent_id, session_id, activity_type, tool_name, input_summary, output_summary,
+		    (agent_id, session_id, activity_type, tool_name, entity_id, input_summary, output_summary,
 		     duration_ms, success, correlation_id)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
-		agentID, sessionID, "tool_call", toolName, inputSummary, outputSummary,
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+		agentID, sessionID, "tool_call", toolName, entityIDArg, inputSummary, outputSummary,
 		durationMs, success, correlationID)
 }