fix(journal): extract loaders/actions for the remaining 21 mixed routes

Completes the .server.ts split started in #418. Every route that mixes
a default-export component with a server-only loader/action now has a
sibling <route>.server.ts holding the data-fetching helpers; the route
.tsx is a thin delegator.

Routes converted (21):
  activities._index, activities.$id, activities.new, auth.accept-terms,
  auth.verify, explore, feed, notifications, routes._index, routes.$id,
  routes.$id.edit, routes.new, settings, settings.account,
  settings.connections.komoot, settings.profile, settings.security,
  sync.import.$provider, sync.import.komoot, users.$username.followers,
  users.$username.following

Pattern (same as home.tsx / users.$username.tsx / settings.connections.tsx):
- loader → `return data(await loadX(request, params?))`
- action → `return await xAction(request, params?)`
- All `getDb` / Drizzle schema / `~/lib/*.server` imports move to the
  .server.ts sibling.
- `throw redirect(...)` and `throw data(...)` propagate through the
  delegator unchanged.

No behavior changes — pure module-graph cleanup. Component modules no
longer transitively import the DB client; Vite's tree-shake of
server-only code is now backed by an explicit, file-local contract.

Verified:
- pnpm typecheck — green
- pnpm lint — green
- pnpm test — 181 passed, 31 integration-gated skipped
- pnpm --filter @trails-cool/journal build — succeeds

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/routes/settings.security.server.ts

@@ -0,0 +1,33 @@
+// Server-only loader for /settings/security. See `home.server.ts`.
+
+import { redirect } from "react-router";
+import { eq } from "drizzle-orm";
+import { getSessionUser } from "~/lib/auth/session.server";
+import { getDb } from "~/lib/db";
+import { credentials } from "@trails-cool/db/schema/journal";
+
+export async function loadSecuritySettings(request: Request) {
+  const user = await getSessionUser(request);
+  if (!user) throw redirect("/auth/login");
+
+  const db = getDb();
+  const passkeys = await db
+    .select({
+      id: credentials.id,
+      deviceType: credentials.deviceType,
+      transports: credentials.transports,
+      createdAt: credentials.createdAt,
+    })
+    .from(credentials)
+    .where(eq(credentials.userId, user.id));
+
+  return {
+    userId: user.id,
+    passkeys: passkeys.map((p) => ({
+      id: p.id,
+      deviceType: p.deviceType,
+      transports: p.transports as string[] | null,
+      createdAt: p.createdAt.toISOString(),
+    })),
+  };
+}