Record RSVP, waiting-list, and check-in activity

[mroderick]

Summary

Third of the activity-log stack (base: #2851). Records member attendance signalling: event and meeting RSVPs (event_invitation.*, meeting_invitation.*), token-based workshop RSVPs (workshop_invitation.*), waiting-list join/leave, and self-service check-in (member.checked_in).

Key changes

• Token-authenticated paths (workshop RSVP, waiting list, meeting cancel) record @invitation.member — no session exists; session paths record current_user.
• Waiting-list join is recorded unconditionally ("the attempt is signal") — documented in the plan.
• Check-in records the invited member, correct for both self-service and admin paths.

Review notes

Validated in review: event attend/reject originally recorded current_user, producing nil-owner rows for token clicks — fixed here to @invitation.member. Recording placement respects early-return guards (already-RSVP'd, deadline-passed, validation failures record nothing).

Stack: PR 4 adds admin actions.

---

Context and motivation: #2857