spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/application/tests/deletion/best_effort_test.rs

@@ -44,6 +44,7 @@ async fn a_blob_that_refuses_to_go_does_not_stop_the_entry_being_edited() {
         .unwrap();
 
     let deps = update_entry::Deps {
+        activities: store.clone(),
         command: store.clone(),
         dimensions: vec![photos.clone() as Arc<dyn EntryDimensionPort>],
         query: store.clone(),
@@ -54,11 +55,11 @@ async fn a_blob_that_refuses_to_go_does_not_stop_the_entry_being_edited() {
     let edited = update_entry::execute(
         UpdateEntryCommand {
             entry_id: entry.id().clone(),
-            mood: Mood::Rad,
+            mood: Some(Mood::Rad),
             logged_at: Some(
                 chrono::DateTime::parse_from_rfc3339("2026-08-20T12:00:00+02:00").unwrap(),
             ),
-            dimensions: Vec::new(),
+            dimensions: Some(Vec::new()),
         },
         owner,
         &deps,
@@ -134,6 +135,7 @@ async fn a_token_store_that_cannot_record_a_use_still_authenticates() {
         UserId::generate(),
         ProviderName::new("iphone-shortcuts").unwrap(),
         secrets.digest(&secret),
+        domain::api_token::TokenScopes::new([domain::api_token::TokenScope::WriteMetrics]).unwrap(),
     );
 
     let deps = authenticate_api_token::Deps {
@@ -142,7 +144,12 @@ async fn a_token_store_that_cannot_record_a_use_still_authenticates() {
         secrets,
     };
 
-    let authenticated = authenticate_api_token::execute(&secret, &deps).await;
+    let authenticated = authenticate_api_token::execute(
+        &secret,
+        domain::api_token::TokenScope::WriteMetrics,
+        &deps,
+    )
+    .await;
 
     assert!(
         authenticated.is_ok(),
@@ -160,6 +167,7 @@ async fn a_digest_that_matches_nothing_is_still_refused() {
         UserId::generate(),
         ProviderName::new("iphone-shortcuts").unwrap(),
         TokenDigest::from_persistence("some other digest".into()),
+        domain::api_token::TokenScopes::new([domain::api_token::TokenScope::WriteMetrics]).unwrap(),
     );
 
     let deps = authenticate_api_token::Deps {
@@ -169,7 +177,9 @@ async fn a_digest_that_matches_nothing_is_still_refused() {
     };
 
     assert!(
-        authenticate_api_token::execute(&real, &deps).await.is_err(),
+        authenticate_api_token::execute(&real, domain::api_token::TokenScope::WriteMetrics, &deps)
+            .await
+            .is_err(),
         "degrading on a write failure must not degrade into accepting anything"
     );
 }

crates/application/tests/deletion/ordering_test.rs

@@ -4,8 +4,8 @@ use domain::attachment::{PhotoId, VoiceMemoId};
 use domain::dimension::{DimensionKind, DimensionValue};
 use domain::entry::{DateRange, Mood, MoodEntry};
 use domain::ports::{
-    ActivityQueryPort, CascadeDeletePort, EntryDimensionPort, MoodEntryCommandPort,
-    ReminderQueryPort, UserCommandPort,
+    ActivityQueryPort, CascadeDeletePort, EntryDimensionPort, MediaOwnershipPort,
+    MoodEntryCommandPort, ReminderQueryPort, UserCommandPort,
 };
 use domain::testing::{FakeMediaStorage, InMemoryDimensionStore, InMemoryStore, test_user};
 use domain::user::{Timezone, User};
@@ -48,6 +48,13 @@ async fn an_entry_with_media(media: &Arc<FakeMediaStorage>) -> Doomed {
     media.put_photo(&photo_id, b"a photograph");
     media.put_voice_memo(&memo_id, b"a recording");
 
+    MediaOwnershipPort::remember(store.as_ref(), user.id(), (&photo_id).into())
+        .await
+        .unwrap();
+    MediaOwnershipPort::remember(store.as_ref(), user.id(), (&memo_id).into())
+        .await
+        .unwrap();
+
     photos
         .save(
             entry.id(),
@@ -150,10 +157,9 @@ async fn clearing_a_users_data_takes_the_blobs_with_it() {
     let doomed = an_entry_with_media(&media).await;
 
     let deps = clear_data::Deps {
-        entry_query: doomed.store.clone(),
-        dimensions: doomed.dimensions(),
         cascade: doomed.store.clone(),
         media_storage: media.clone(),
+        media_ownership: doomed.store.clone(),
     };
 
     clear_data::execute(doomed.user.id().clone(), &deps)
@@ -173,10 +179,9 @@ async fn deleting_an_account_takes_the_blobs_with_it() {
     let doomed = an_entry_with_media(&media).await;
 
     let deps = delete_user::Deps {
-        entry_query: doomed.store.clone(),
-        dimensions: doomed.dimensions(),
         cascade: doomed.store.clone(),
         media_storage: media.clone(),
+        media_ownership: doomed.store.clone(),
         user_query: doomed.store.clone(),
         events: doomed.store.clone(),
     };