spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/adapters/sqlite/src/db.rs

@@ -48,6 +48,22 @@ const MIGRATIONS: &[(&str, &str)] = &[
         "012_entry_weather",
         include_str!("migrations/012_entry_weather.sql"),
     ),
+    (
+        "013_reminder_last_sent",
+        include_str!("migrations/013_reminder_last_sent.sql"),
+    ),
+    (
+        "014_media_ownership",
+        include_str!("migrations/014_media_ownership.sql"),
+    ),
+    (
+        "015_logged_at_in_utc",
+        include_str!("migrations/015_logged_at_in_utc.sql"),
+    ),
+    (
+        "016_api_token_scopes",
+        include_str!("migrations/016_api_token_scopes.sql"),
+    ),
 ];
 
 const TAKE_THE_WRITE_LOCK_UP_FRONT: &str = "BEGIN IMMEDIATE";
@@ -57,6 +73,13 @@ const SCHEMA_MIGRATIONS_TABLE: &str = "CREATE TABLE IF NOT EXISTS schema_migrati
     applied_at TEXT NOT NULL
 )";
 
+pub fn migrations_before(name: &str) -> impl Iterator<Item = (&'static str, &'static str)> {
+    MIGRATIONS
+        .iter()
+        .take_while(move |(applied, _)| *applied != name)
+        .copied()
+}
+
 pub async fn create_pool(database_url: &str) -> Result<SqlitePool, sqlx::Error> {
     let options: SqliteConnectOptions = database_url
         .parse::<SqliteConnectOptions>()?