spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/adapters/http-axum/src/handlers/correlations.rs

@@ -1,13 +1,13 @@
 use axum::Json;
-use axum::extract::{Query, State};
+use axum::extract::State;
 
-use api_types::requests::DateSpanParams;
-use api_types::responses::CorrelationRowResponse;
+use api_types::params::DateSpanParams;
+use api_types::responses::{CorrelationRowResponse, ErrorResponse};
 use application::correlation::queries::CorrelationQuery;
 use application::correlation::use_cases::get_correlations;
 
 use crate::errors::ApiError;
-use crate::extractors::AuthenticatedUser;
+use crate::extractors::{JournalReader, Params};
 use crate::state::AppState;
 
 #[utoipa::path(get, path = "/api/v1/correlations", tag = "correlations", security(("bearer" = [])),
@@ -18,12 +18,16 @@ use crate::state::AppState;
                    never ranked by strength. Below the configured minimum sample size a row \
                    carries its day count and no coefficient.",
     params(DateSpanParams),
-    responses((status = 200, body = Vec<CorrelationRowResponse>))
+    responses((status = 200, body = Vec<CorrelationRowResponse>),
+        (status = 401, description = "No credential, or one this endpoint does not accept", body = ErrorResponse),
+        (status = 403, description = "A token that does not grant what this endpoint needs", body = ErrorResponse),
+        (status = 400, description = "Malformed request", body = ErrorResponse),
+        (status = 422, description = "Understood but refused", body = ErrorResponse))
 )]
 pub async fn handle_list(
     State(state): State<AppState>,
-    AuthenticatedUser(user_id): AuthenticatedUser,
-    Query(params): Query<DateSpanParams>,
+    JournalReader(user_id): JournalReader,
+    Params(params): Params<DateSpanParams>,
 ) -> Result<Json<Vec<CorrelationRowResponse>>, ApiError> {
     let span = params.into_span()?;
 
@@ -33,6 +37,7 @@ pub async fn handle_list(
         activities: state.activity_query,
         cycles: state.cycle_query,
         weather_store: state.weather_store,
+        activity_store: state.activity_store,
         preferences: state.preferences_query,
         users: state.user_query,
     };