Security: Derived activity fields bypass path-based exclusions in Site.js

## Issue Description

A security vulnerability was identified in `src/device-registry/models/Site.js` where derived activity fields are added after MongoDB projection operations, potentially bypassing path-based exclusions designed to hide sensitive activity data from public/summary API responses.

## Problem Details

**Affected Fields:**
- `activities_by_type`
- `latest_activities_by_type`
- `device_activity_summary`
- `latest_deployment_activity`
- `latest_maintenance_activity`
- `latest_recall_activity`
- `site_creation_activity`
- `total_activities`

**Root Cause:**
The enrichment logic that creates these derived fields occurs in JavaScript after the MongoDB aggregation pipeline has already applied inclusion/exclusion projections. This means that even when the database-level projections exclude activity-related data for public/summary paths, the post-processing can reintroduce this sensitive information.

**Location:**
Lines 833-906 in `src/device-registry/models/Site.js` (list method)

## Potential Solutions

1. **Runtime Guard Approach**: Add checks for the original path parameter and conditionally delete derived fields for public/summary responses
2. **Pre-projection Enrichment**: Move the enrichment logic into the MongoDB aggregation pipeline before the final projection stages

## Context

- **PR**: #5170 - enhance the response details of devices and sites
- **PR URL**: https://github.com/airqo-platform/AirQo-api/pull/5170
- **Comment**: https://github.com/airqo-platform/AirQo-api/pull/5170#discussion_r2326476039
- **Reported by**: @Baalmart

## Impact

This could potentially expose sensitive activity data (user IDs, host IDs, network information, etc.) in API responses that should be filtered according to path-based access controls.

## Priority

Medium-High - Security vulnerability that could lead to data exposure