[management] Move the activity policy out of the gRPC service

Recording proxy usage is business logic, and it had ended up in the RPC
handler: the throttle interval, the service-user skip, the exclusion rule
for embedded and browser peers, and a store handle to write through.

It moves to a reverseproxy module manager, matching how accesslogs, domain,
service and proxy are already structured, and the RPC keeps only what is
its own: calling the manager and deciding the request must not fail when
the write does. The proxy service goes back to holding ProxyTokenChecker
rather than a widened store interface.

The policy tests move with the policy. The handler tests now assert only
that a granted request reaches the manager, which is all the transport
decides.

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -217,10 +218,11 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 		usersManager,
 		nil,
 		nil,
-		testStore,
+		nil,
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
+	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)