spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/adapters/sqlite/tests/api_token_test.rs

@@ -1,6 +1,6 @@
 use sqlx::sqlite::SqlitePoolOptions;
 
-use domain::api_token::{ApiToken, TokenDigest};
+use domain::api_token::{ApiToken, TokenDigest, TokenScope, TokenScopes};
 use domain::ports::{ApiTokenCommandPort, ApiTokenQueryPort, CascadeDeletePort, UserCommandPort};
 use domain::provider::ProviderName;
 use domain::testing::test_user;
@@ -33,6 +33,7 @@ fn a_token(owner: &UserId, name: &str, digest: &str) -> ApiToken {
         owner.clone(),
         ProviderName::new(name).unwrap(),
         TokenDigest::from_persistence(digest.into()),
+        TokenScopes::new([TokenScope::WriteMetrics]).unwrap(),
     )
 }
 
@@ -152,7 +153,7 @@ async fn a_row_with_a_scope_this_build_does_not_know_authenticates_nothing() {
     let (pool, user) = a_pool_with_a_user().await;
 
     sqlx::query(
-        "INSERT INTO api_tokens (id, user_id, name, digest, scope, created_at, last_used_at)
+        "INSERT INTO api_tokens (id, user_id, name, digest, scopes, created_at, last_used_at)
          VALUES (?, ?, ?, ?, ?, ?, NULL)",
     )
     .bind(uuid::Uuid::new_v4().to_string())