Persist inbound activities from the inbox listener

[2chanhaeng]

• Fedify already verifies signatures and signer/actor match. Also require the object to be attributed to the actor and of a supported type.
• Ensure remote instances/actors rows, promote the object to resources, store Create in activities.
• GraphQL API for activity log #12's log table must not reuse the activities name.
• Test with a signed Create.

Tracks the FIXME in the inbox listener in packages/graphql/src/federation.ts.

AI disclosure

The user asked Claude Code (claude-fable-5-1) to survey every FIXME comment in the codebase and draft an issue for each. The user read and edited the drafts, then directed Claude Code to file them through the GitHub CLI.