fix(frontend): allow future manual activity dates on web (#624)

[AtomicTrxn]

Description

Root cause:

• Desktop/web manual activity forms use the shared DatePicker with its default allowFutureDates={false}, which clamps activityDate to today.
• Mobile and backend already permit future-dated activities, so desktop/web edit and create flows were inconsistent and blocked valid future dates.

Fix summary:

• Opt all desktop/web manual activity forms into allowFutureDates={true} for activityDate.
• Keep the shared picker default unchanged so unrelated date inputs retain current behavior.
• Add focused frontend regression coverage for DatePicker and BuyForm.
• Add a core safety regression proving future-dated activities do not affect the latest current holdings snapshot.

Validation:

• pnpm --filter frontend test -- buy-form
• pnpm --filter frontend test -- date-picker
• cargo test -p wealthfolio-core test_get_latest_holdings_snapshot_excludes_future_dated_activity
• pnpm --filter frontend lint (passes with existing repo warning baseline)
• pnpm --filter frontend type-check is still failing on pre-existing unrelated issues in apps/frontend/src/addons/type-bridge.ts and apps/frontend/src/pages/holdings/components/alternative-holdings-table.tsx

Fixes #624

Checklist

• I have read and agree to the
  Contributor License Agreement.

By submitting this PR, I agree to the
CLA.

[afadil]

The DatePicker wrapper component is only used by activity forms — other date inputs (quote history, alternative assets, contribution limits, etc.) use DatePickerInput from @wealthfolio/ui directly.

Since every single caller of DatePicker now passes allowFutureDates={true}, the default is wrong. When 100% of callers override a default, just flip the default.

Suggested fix: Change the default in date-picker.tsx from allowFutureDates = false to true (or remove the prop entirely since DatePicker is activity-only). This turns a 13-file PR into a ~2-file change (date-picker + the Rust test).

The Rust backend test (test_get_latest_holdings_snapshot_excludes_future_dated_activity) is a good addition — keep that.