Implement ACTIVITY-WP-0024 operator automation console

Add /ops REST inventory, status, runs, and fail-closed operator-token
mutations (trigger, enable/disable, pause/unpause) with audit trail.
Ship thin HTML UI at /ops/ui, runbook/k8s access docs, and contract tests.

src/activity_core/api.py

@@ -1,6 +1,7 @@
 """FastAPI REST API for activity-core.
 
 T30: CRUD for ActivityDefinition + manual one-shot trigger.
+ACTIVITY-WP-0024: operator automation console under /ops.
 
 Endpoints:
   GET    /activity-definitions/          — list all
@@ -9,6 +10,7 @@ Endpoints:
   PUT    /activity-definitions/{id}      — update
   DELETE /activity-definitions/{id}      — delete
   POST   /activity-definitions/{id}/trigger — manual one-shot run
+  GET/POST /ops/...                      — operator console (inventory, status, control)
 
 Schedule lifecycle:
   - POST/PUT with trigger_type='cron' upserts a Temporal Schedule.
@@ -38,6 +40,7 @@ from temporalio.api.workflowservice.v1 import GetSystemInfoRequest
 from temporalio.client import Client
 
 from activity_core.models import ActivityDefinition, CronTriggerConfig
+from activity_core.ops_api import bind_ops_deps, router as ops_router
 from activity_core.orm import ActivityDefinition as ActivityDefinitionRow, EventType as EventTypeRow
 from activity_core.schedule_manager import delete_schedule, upsert_schedule
 from activity_core.sync_service import run_sync
@@ -69,6 +72,7 @@ async def lifespan(app: FastAPI):  # type: ignore[type-arg]
     engine = create_async_engine(db_url)
     _session_factory = async_sessionmaker(engine, expire_on_commit=False)
     _temporal_client = await Client.connect(TEMPORAL_HOST, namespace=TEMPORAL_NAMESPACE)
+    bind_ops_deps(_get_db, _get_temporal)
 
     yield
 
@@ -77,6 +81,7 @@ async def lifespan(app: FastAPI):  # type: ignore[type-arg]
 
 app = FastAPI(title="activity-core API", lifespan=lifespan)
 app.include_router(webhook_router)
+app.include_router(ops_router)
 
 
 def _get_db() -> async_sessionmaker[AsyncSession]: