feat: full background activity tasks

[kmendell]

Checklist

• This PR is not opened from my fork’s main branch

What This PR Implements

Fixes: #2415

Changes Made

Testing Done

• Development environment started: ./scripts/development/dev.sh start
• Frontend verified at http://localhost:3000
• Backend verified at http://localhost:3552
• Manual testing completed (describe):
• No linting errors (e.g., just lint all)
• Backend tests pass: just test backend

AI Tool Used (if applicable)

AI Tool:
Assistance Level:
What AI helped with:
I reviewed and edited all AI-generated output:
I ran all required tests and manually verified changes:

Additional Context

Disclaimer Greptiles Reviews use AI, make sure to check over its work.

To better help train Greptile on our codebase, if the comment is useful and valid Like the comment, if its not helpful or invalid Dislike

To have Greptile Re-Review the changes, mention greptileai.

Greptile Summary

This PR introduces a full "background activity" system for Arcane — a new activities + activity_messages table pair, an ActivityService with SSE fan-out for real-time updates, and a frontend activity-center UI. Activity tracking is wired into image-update checks, system prune, vulnerability scans, auto-update, project operations, and container bulk actions, with history pruned by the existing event-cleanup scheduler job.

• Backend: New ActivityService with subscriber channels, snapshot/heartbeat SSE streaming, and per-environment history pruning integrated into the event cleanup job. All existing services now accept an *ActivityService dependency and emit start/append/complete lifecycle events.
• Frontend: New activity-center component with real-time SSE consumption, activity list/detail views, and a settings page for retention configuration.
• Database: Migration 050 adds the two tables with appropriate indexes for the primary query patterns (environment + status, resource, user).

Confidence Score: 4/5

Safe to merge with the concurrent-prune issue addressed; all other changes are additive and well-guarded.

StartPruneAll launches an unguarded background goroutine on every HTTP call. Back-to-back requests from the frontend will start multiple simultaneous Docker prune goroutines and create duplicate in-progress activity records. Everything else — the SSE streaming, activity CRUD, history pruning, and migration — looks correct and well-tested.

backend/internal/services/system_service.go — the StartPruneAll method needs a concurrency guard before merging.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
backend/internal/services/system_service.go:94-108
**Concurrent prune goroutines not guarded**

`StartPruneAll` spawns an unguarded background goroutine on every call. If the endpoint is hit twice in quick succession, two goroutines will run simultaneously against the same Docker daemon, each creating its own activity record and competing for the same Docker resources (containers, images, volumes). The old synchronous `PruneAll` path naturally serialised these operations through the HTTP request lifecycle. The new background path has no such protection, so a rapid double-click from the frontend is enough to trigger two concurrent prune operations and confuse the activity feed with duplicate in-progress records.

_{Reviews (4): Last reviewed commit: "feat: full background activity tasks" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[kmendell]

• feat: full background activity tasks #2434 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[getarcaneappbot]

Container images for this PR have been built successfully!

• Manager: ghcr.io/getarcaneapp/arcane:pr-2434
• Agent: ghcr.io/getarcaneapp/arcane-headless:pr-2434

Built from commit 6a43d22

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.

[greptile-apps]

Concurrent prune goroutines not guarded

StartPruneAll spawns an unguarded background goroutine on every call. If the endpoint is hit twice in quick succession, two goroutines will run simultaneously against the same Docker daemon, each creating its own activity record and competing for the same Docker resources (containers, images, volumes). The old synchronous PruneAll path naturally serialised these operations through the HTTP request lifecycle. The new background path has no such protection, so a rapid double-click from the frontend is enough to trigger two concurrent prune operations and confuse the activity feed with duplicate in-progress records.

Prompt To Fix With AI

This is a comment left during a code review.
Path: backend/internal/services/system_service.go
Line: 94-108

Comment:
**Concurrent prune goroutines not guarded**

`StartPruneAll` spawns an unguarded background goroutine on every call. If the endpoint is hit twice in quick succession, two goroutines will run simultaneously against the same Docker daemon, each creating its own activity record and competing for the same Docker resources (containers, images, volumes). The old synchronous `PruneAll` path naturally serialised these operations through the HTTP request lifecycle. The new background path has no such protection, so a rapid double-click from the frontend is enough to trigger two concurrent prune operations and confuse the activity feed with duplicate in-progress records.

How can I resolve this? If you propose a fix, please make it concise.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.