A repository's activity feed names its Server-Timing phases and answers a feed reader 304 when nothing changed #3753

GET /:owner/:name/activity.atom (activityAtom in src/web/feeds.ts) is polled by feed readers. Its Server-Timing carries only the route total, and every poll gets the full 200 back.

Done:

• [ ] Its Server-Timing names session, events (the listEvents read and the audience filter), people (the actor and issue reads) and render, using notePhase and timePhase from src/core/route_timing.ts.
• [ ] The answer carries a weak ETag derived from the newest included event's id and the reader's audience (so a writer and a stranger never share one). A matching If-None-Match answers 304 with no body, after the canRead check.
• [ ] test/feeds.test.ts covers four cases: the phase names, a 304 on a repeat request, a 200 after a new event, and a 404 for someone who cannot read a private repository even with a matching If-None-Match. Each case fails without the change.

Files: src/web/feeds.ts, test/feeds.test.ts. Risk: a 304 must never answer before the read check, and the ETag must differ between audiences.