feat: real activity streak instead of the hardcoded 12

[CMaintz]

The sidebar said "12-day streak" for everyone (count: 12 was hardcoded). Now it's a real number.

• New GET /api/v1/analytics/streak?zone=<IANA zone>: consecutive days with job-search activity, i.e. application status moves (which includes creating one), generated documents and outreach. The status ledger isn't exposed outside the per-application timeline, so the frontend couldn't work this out from what it already loads.
• Days are counted in the browser's time zone. A quiet today doesn't break a streak that ran through yesterday. Lookback is 400 days, so that's the longest streak it'll report.
• The sidebar badge hides at 0 or if the request fails. The dashboard's "Activity streak" card uses the same number, and its 7-day bars now show that same activity rather than applications sent, so the two can't disagree anymore (it used to count only application dates, and its day maths was off by one around DST changes).
• Tests: domain (gaps, ongoing-from-yesterday, local midnight, zone differences, DST day), use case with a fixed clock, a WebMvc test for the endpoint, plus specs for the frontend service and badge.

Includes #174 (a test that broke when #162 and #169 crossed on main) so CI can compile; merge #174 first and that part drops out of the diff. #175 retakes the README screenshots with this in place, so it goes after this one.