WordPress binding: replay the outbox event log into an Activities view

## Goal

Thin WordPress binding (`src/app`) that uses the Automattic/wordpress-activitypub#3427 client core to render a live **Activities** view of the logged-in actor's outbox — by replaying the outbox event log, not by caching rows.

## Scope

1. `src/app/c2s/transport.ts` — `Transport` via `@wordpress/api-fetch`; `StreamFactory` via native `EventSource`.
2. `src/app/c2s/auth.ts` — `AuthProvider` injecting the OAuth token (header for reads, `?access_token=` for the stream).
3. `src/app/hooks/use-c2s-collection.ts` — `useC2SCollection(urls)` → `useSyncExternalStore` over the controller's store; returns `{ records, status }` in the shape `routes/feed/stage.tsx` + DataViews expect.
4. `includes/wp-admin/class-app.php` — mint a token for the logged-in admin via the existing `includes/oauth/` server and pass it (plus the outbox collection + `eventStream` URLs) through `initialize()`. **Reuses the existing** `/outbox` **endpoint — no new endpoint.**
5. New `src/app/routes/activities/` (stage/route/content) consuming the hook.

## Sequence

* **2 — read-model binding (paged replay → view):** read the outbox log via the token, replay into the store, render. A fully working materialized view, no SSE.
* **3 — optional live tail:** add the `EventSource` stream feeding the same reducer (best-effort resume). Pure enhancement.

## Acceptance

* The Activities screen lists the actor's published activities derived by replaying the outbox; with the live tail on, a new post appears / an edit updates in place / a trash removes it. `ap_post`/`ap_actor` core-data reads stay untouched.

## Tests

* `use-c2s-collection` with mocked transport/stream; manual wp-env (WP 7.0) check.

## Risk

* **Admin OAuth token (main one):** the protected outbox read (and the optional stream's `PUSH` scope) need a token; mint it for the logged-in admin via the existing OAuth server. This is the gate for step 2.

Depends on Automattic/wordpress-activitypub#3427.