chore: 2 big design passes to harmonize and fix stuff

docs/design/source/activity-spec.js

@@ -1,7 +1,14 @@
 export const copy = [
 	['Page title', 'Activity. Regular users: My activity.'],
 	['Subtitle', 'Who did what, and when, across your site. Regular users: Everything you\'ve done on this site.'],
-	['Header action', 'Export CSV (owner and admin only). Preparing: Preparing file… Success toast: Export started. Your file will download shortly. Error toast: Couldn\'t export activity. Try again.'],
+	['Header action', 'Export menu button (owner and admin only). Items: Export current view; Export all activity…'],
+	['Export current view', 'CSV · 214 events matching your filters and sort, across all pages. Disabled: Nothing to export. No events match these filters.'],
+	['Export all activity', 'CSV · every event, ignoring filters. Owners and admins only. Disabled: Only owners and admins can export all activity.'],
+	['Export dialog', 'Title Export all activity. Fields: Format (CSV only; CSV and JSON as a segmented control when JSON ships, proposed), Date range (default All time). Buttons: Cancel, Export CSV. Synchronous: one streamed download, no job.'],
+	['Export preparing', 'Preparing download… (indeterminate bar, no percentage). The file starts downloading as soon as it is ready. Keep this window open. Buttons: Cancel, Preparing… (disabled).'],
+	['Export result', 'Download started · activity-all-2026-10-06.csv is downloading. Check your browser\'s downloads if nothing appears. Button: Close. Failed: Couldn\'t prepare the download. Nothing was downloaded. Try again in a moment. Buttons: Cancel, Retry. Nothing to export: There is no activity in this date range. Choose a wider range. 403: You can\'t export all activity. Only owners and admins can export all activity. Ask an owner if you need a copy.'],
+	['Export toasts', 'Download started · activity-2026-10-06.csv is downloading. / activity-all-2026-10-06.csv is downloading.'],
+	['Card toggles', 'Failed actions and Security events cards are buttons with aria-pressed. Hint lines: Click to filter the list · Filtering. Click to clear · Click to clear this filter. Chips: Outcome: Failed · Type: Security events.'],
 	['Summary labels', 'Total actions · Active people · Failed actions · Security events'],
 	['Summary sub-lines', '12% vs previous 7 days · 7 people, 2 API keys · 0.5% of all actions · 5 failed logins'],
 	['Summary zero', 'Failed: Nothing failed. Security: Nothing to flag. No data at all: No data yet.'],
@@ -28,8 +35,10 @@ export const copy = [
 	['Retention status', 'Last cleanup 6 Oct 2026, 03:00 · 142 events removed · Next cleanup 7 Oct 2026, 03:00 · Never / Not scheduled for Forever. Save: Saved · Error: Couldn\'t save the retention period. Your previous setting is still in place.']
 ]
 export const comps = [
-	['Page shell, sidebar entry', 'Existing dashboard shell. "Activity" (icon history) between Users and Settings, all verified users.'],
-	['Page header', 'Plain heading + UButton (outline, icon download) for Export CSV.'],
+	['Page shell, sidebar entry', 'Existing dashboard shell. "Activity" (icon history) between Users and Integration (same order as the sidebar in AppFrame), all verified users.'],
+	['Page header', 'Plain heading + ExportMenu (UDropdownMenu on desktop, bottom sheet on mobile) with a UButton (outline, icon download, trailing chevron).'],
+	['FilterCardToggle', 'Summary card as role=button, aria-pressed. Active: --rc-sand with --rc-on-sand.'],
+	['ExportDialog', 'UModal, sm:max-w-md, bottom sheet on mobile. Read-only format row (segmented control when JSON ships), USelect for date range, indeterminate UProgress while the request is in flight.'],
 	['Summary strip', 'Four UCard, each with a UButton-style click target (as="button"). Sparkline: seven div bars in the card (no chart library). Semantic emphasis via error and warning soft tokens.'],
 	['Search', 'UInput, icon search, clearable.'],
 	['Person and Category', 'USelectMenu. Person lists users, API keys and "System" in groups.'],
@@ -47,6 +56,7 @@ export const comps = [
 	['Retention', 'UCard in Settings with USelectMenu and read-only text lines.']
 ]
 export const api = [
+	['GET /v1/activity/export', 'Implemented. Owner and admin only, otherwise 403. Returns CSV only, synchronous, one streamed download, no job and no progress. Accepts the list filters: q, actor, category, outcome, security, range, from, to. JSON (format=json) is proposed.'],
 	['GET /v1/activity', 'Query: q, actor (user:ID, key:ID, system), category (articles, media, users, api_keys, auth, system), outcome (all, success, failed), range (today, 7d, 30d, custom), from, to (ISO dates), page, size (25, 50, 100). Sorted newest first. Returns items (id, created_at, actor {type, id, name}, category, sentence parts, target {type, id, name, exists}, outcome, failure_reason, security, source, ip, user_agent, changes [{field, before, after, kind}]), total, page, size. Users who are not owner or admin are scoped to their own events by the server; requesting another actor returns 403. Body edits return a single change with kind "body" and a character delta, never the text. The same call powers the Home card (size=5) and the slide-over (items carry the detail fields).'],
 	['GET /v1/activity/summary', 'Query: the same range, from, to. Owner and admin only (403 otherwise). Returns total, previous_total, active_people {users, api_keys}, failed, security, and a 7-day series for each. Clicking a card applies outcome=failed or category in (auth, users role changes, api_keys) to the table, or clears filters for Total.'],
 	['GET /v1/activity/export', 'Query: the same filters, no page or size. Owner and admin only. Streams text/csv with columns when, actor, action, target, outcome, source, ip. No changes or secrets.'],