feat(activities): let creators lock edit and delete to themselves

Add editPolicy (default creator-only), enforce it in the API, surface clear permission messages, and drop the redundant edit menu now that detail is editable.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/views/ActivityFormView.vue

@@ -130,6 +130,7 @@ const leadId = ref('');
 const dealId = ref('');
 const assigneeIds = ref<string[]>([]);
 const completionMode = ref<'any' | 'all'>('any');
+const editPolicy = ref<'creator' | 'assignees'>('creator');
 const isDone = ref(false);
 const needsNote = ref(false);
 const reminderAt = ref('');
@@ -442,6 +443,7 @@ function resetForm() {
   dealId.value = '';
   assigneeIds.value = auth.user?.id ? [auth.user.id] : [];
   completionMode.value = 'any';
+  editPolicy.value = 'creator';
   pickedRoleIds.value = [];
   pickedTeamIds.value = [];
   isDone.value = false;
@@ -531,6 +533,7 @@ async function load() {
             ? [auth.user.id]
             : [];
       completionMode.value = data.completionMode === 'all' ? 'all' : 'any';
+      editPolicy.value = data.editPolicy === 'assignees' ? 'assignees' : 'creator';
       refreshPickedGroups();
       isDone.value = data.status === 'done';
       await loadSavedPhotos(data);
@@ -619,6 +622,7 @@ function payload(): CreateActivityRequest {
     assigneeIds: [...assigneeIds.value],
     assigneeId: assigneeIds.value[0] || null,
     completionMode: assigneeIds.value.length > 1 ? completionMode.value : 'any',
+    editPolicy: editPolicy.value,
   };
 }
 
@@ -1332,6 +1336,29 @@ watch([id, isNew], () => void load(), { immediate: true });
             </div>
           </div>
 
+          <div class="card">
+            <div class="field">
+              <label>ویرایش و حذف</label>
+              <div class="completion-mode">
+                <label>
+                  <input v-model="editPolicy" type="radio" value="creator" />
+                  فقط خودم (ایجادکننده)
+                </label>
+                <label>
+                  <input v-model="editPolicy" type="radio" value="assignees" />
+                  همهٔ مسئولان
+                </label>
+              </div>
+              <small class="hint">
+                {{
+                  editPolicy === 'assignees'
+                    ? 'مسئولان هم می‌توانند این فعالیت را ویرایش یا حذف کنند.'
+                    : 'فقط ایجادکننده می‌تواند این فعالیت را ویرایش یا حذف کند.'
+                }}
+              </small>
+            </div>
+          </div>
+
           <div class="card">
             <div class="field">
               <div class="label-row">