build up basic validations

General data integrity stuff.

* user_id must be present
* action_type must be present
* happened_at must be present (default to `Time.now` if not provided)
* metadata must be present (default to `{}` if not provided)

TODO (before closing this PR)
-------

- [x] If no happened_at provided, set to current timestamp before saving
- [x] If no metadata provided, set to `{}` before saving.
- [x] add some indexes
- [x] add some database-level constraints