spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/adapters/http-axum/src/handlers/server.rs

@@ -0,0 +1,76 @@
+use axum::Json;
+use axum::extract::State;
+
+use api_types::responses::{
+    ErrorResponse, MetricKindResponse, MoodResponse, ServerInfoResponse, ServerLimitsResponse,
+    TokenScopeResponse,
+};
+use domain::api_token::TokenScope;
+use domain::entry::Mood;
+use domain::metric::MetricKind;
+use domain::weather::Condition;
+
+use crate::state::AppState;
+
+#[utoipa::path(get, path = "/api/v1/server", tag = "server",
+    description = "What this deployment is and what it allows, for a client deciding what to \
+                   offer before anyone has signed in. Carries no secrets and needs no \
+                   authentication. The vocabularies are the ones the API validates against, so \
+                   a client can build its forms from here rather than hardcoding them.",
+    responses((status = 200, body = ServerInfoResponse),
+        (status = 400, description = "Malformed request", body = ErrorResponse),
+        (status = 422, description = "Understood but refused", body = ErrorResponse))
+)]
+pub async fn handle_info(State(state): State<AppState>) -> Json<ServerInfoResponse> {
+    Json(ServerInfoResponse {
+        version: env!("CARGO_PKG_VERSION").to_string(),
+        registration_open: state.auth_config.allow_registration,
+        push_enabled: state.push_config.enabled,
+        weather_enabled: state.weather_enabled,
+        now_playing_provider: state
+            .now_playing
+            .as_ref()
+            .map(|playing| playing.provider().to_string()),
+        access_token_ttl_seconds: state.auth_config.access_token_ttl_seconds,
+        limits: ServerLimitsResponse {
+            max_body_size: state.server_config.max_body_size,
+            max_content_length: state.entry_config.max_content_length,
+            max_photos: state.entry_config.max_photos,
+            max_voice_memos: state.entry_config.max_voice_memos,
+            max_activities_per_entry: state.entry_config.max_activities_per_entry,
+            max_entries_per_page: state.entry_config.max_entries_per_page,
+            max_import_days: state.import_config.maximum_days_per_import,
+        },
+        token_scopes: TokenScope::ALL
+            .into_iter()
+            .map(|scope| TokenScopeResponse {
+                name: scope.name().to_string(),
+                describes: scope.describes().to_string(),
+            })
+            .collect(),
+        metric_kinds: MetricKind::ALL
+            .into_iter()
+            .map(|kind| {
+                let (minimum, maximum) = kind.bounds();
+
+                MetricKindResponse {
+                    name: kind.name().to_string(),
+                    unit: kind.unit().to_string(),
+                    minimum,
+                    maximum,
+                }
+            })
+            .collect(),
+        moods: Mood::ALL
+            .into_iter()
+            .map(|mood| MoodResponse {
+                value: mood.value(),
+                label: mood.label().to_string(),
+            })
+            .collect(),
+        weather_conditions: Condition::ALL
+            .into_iter()
+            .map(|condition| condition.name().to_string())
+            .collect(),
+    })
+}