spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/adapters/importer/src/backup_reader.rs

@@ -1,10 +1,16 @@
 use api_types::dimension::DimensionPayload;
 use domain::dimension::DimensionValue;
 use domain::errors::DomainError;
+use std::collections::HashMap;
+
+use domain::attachment::ContentType;
 use domain::ports::{
-    RestorableActivity, RestorableContents, RestorableEntry, RestorableMetric, RestorableReminder,
+    RestorableActivity, RestorableContents, RestorableEntry, RestorableMedia, RestorableMetric,
+    RestorableReminder,
 };
 
+use exporter::{BackedUpMedia, PHOTO_KIND, VOICE_MEMO_KIND};
+
 use super::kmood_backup::KmoodBackupReader;
 
 pub struct KmoodBackupAdapter;
@@ -14,6 +20,7 @@ impl domain::ports::BackupReaderPort for KmoodBackupAdapter {
     async fn read(&self, data: &[u8]) -> Result<RestorableContents, DomainError> {
         let read = KmoodBackupReader::read(data)?;
         let manifest = read.manifest;
+        let types = declared_types(&manifest.media);
 
         Ok(RestorableContents {
             entries: manifest
@@ -63,8 +70,8 @@ impl domain::ports::BackupReaderPort for KmoodBackupAdapter {
                 })
                 .collect(),
             tracks_cycle: manifest.tracks_cycle,
-            photos: read.photos.into_iter().collect(),
-            voice_memos: read.voice_memos.into_iter().collect(),
+            photos: restorable(read.photos, &types, PHOTO_KIND),
+            voice_memos: restorable(read.voice_memos, &types, VOICE_MEMO_KIND),
         })
     }
 }
@@ -81,3 +88,30 @@ fn readable_dimensions(payloads: Vec<DimensionPayload>) -> Vec<DimensionValue> {
         })
         .collect()
 }
+
+fn declared_types(media: &[BackedUpMedia]) -> HashMap<(String, String), ContentType> {
+    media
+        .iter()
+        .map(|held| {
+            (
+                (held.kind.clone(), held.id.clone()),
+                ContentType::from_persistence(held.content_type.clone()),
+            )
+        })
+        .collect()
+}
+
+fn restorable(
+    blobs: HashMap<String, Vec<u8>>,
+    types: &HashMap<(String, String), ContentType>,
+    kind: &str,
+) -> Vec<RestorableMedia> {
+    blobs
+        .into_iter()
+        .map(|(id, data)| RestorableMedia {
+            content_type: types.get(&(kind.to_string(), id.clone())).cloned(),
+            id,
+            data,
+        })
+        .collect()
+}