ActivityLogService.log() blocks OWNER and VET from creating medical records

[annikaholmqvist94]

Body:

Problem

ActivityLogService.log() calls activityLogPolicy.canCreate(user) before saving
the log entry. Since canCreate() only allows ADMIN, any action triggered by an
OWNER or VET that results in automatic logging (create, update, assignVet,
updateStatus, close) throws ForbiddenException and rolls back the entire
transaction.

Affected flow

POST /api/medical-records → MedicalRecordService.create()
→ activityLogService.log() → activityLogPolicy.canCreate(OWNER) → 403
→ @transactional rolls back → record is never saved

Root cause

ActivityLogService.log() is an internal system method, always called by the
system automatically — never directly by a user via API. It should never enforce
user-level permissions.

Fix

Remove the activityLogPolicy.canCreate(user) call from ActivityLogService.log()
on line 36.

[coderabbitai]

🔗 Related PRs

#63 - Add ActivityLogPolicy with role-based access control and immutable rules [merged]
#64 - Changes ActivityLogService with validation and null-safety [merged]
#70 - Changes ActivityLogService after ActivityLogController implements [merged]
#71 - Add MedicalRecordController for managing medical record operations [merged]
#75 - Changes ActivityLogPolicy [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!