spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/application/tests/entry/create_entry_test.rs

@@ -16,6 +16,7 @@ fn deps() -> (Arc<InMemoryStore>, create_entry::Deps) {
         Arc::new(InMemoryDimensionStore::new(DimensionKind::Activities));
 
     let deps = create_entry::Deps {
+        activities: store.clone(),
         entries: store.clone(),
         dimensions: vec![content, activities],
         events: store.clone(),
@@ -47,6 +48,9 @@ async fn creates_entry_with_optional_dimensions() {
     let (store, deps) = deps();
     let user = test_user("bob");
     let activity = domain::testing::test_activity(user.id().clone(), "gaming");
+    domain::ports::ActivityCommandPort::save(store.as_ref(), &activity)
+        .await
+        .unwrap();
 
     let cmd = CreateEntryCommand {
         user_id: user.id().clone(),
@@ -63,3 +67,190 @@ async fn creates_entry_with_optional_dimensions() {
     assert_eq!(entry.mood(), Mood::Rad);
     assert_eq!(store.entry_count(), 1);
 }
+
+#[tokio::test]
+async fn an_entry_cannot_wear_another_accounts_activity() {
+    let (store, deps) = deps();
+    let user = test_user("alice");
+    let stranger = test_user("mallory");
+
+    let theirs = domain::testing::test_activity(stranger.id().clone(), "fencing");
+    domain::ports::ActivityCommandPort::save(store.as_ref(), &theirs)
+        .await
+        .unwrap();
+
+    let cmd = CreateEntryCommand {
+        user_id: user.id().clone(),
+        mood: Mood::Good,
+        logged_at: test_logged_at(),
+        dimensions: vec![DimensionValue::activities(vec![theirs.id().clone()])],
+    };
+
+    let refused = create_entry::execute(cmd, &deps).await;
+
+    assert!(
+        matches!(
+            refused,
+            Err(application::errors::ApplicationError::Domain(
+                domain::errors::DomainError::Forbidden(_)
+            ))
+        ),
+        "tagging a stranger's activity must be refused, got {refused:?}"
+    );
+    assert_eq!(store.entry_count(), 0, "nothing should have been written");
+}
+
+#[tokio::test]
+async fn an_entry_cannot_wear_an_activity_that_does_not_exist() {
+    let (store, deps) = deps();
+    let user = test_user("alice");
+
+    let cmd = CreateEntryCommand {
+        user_id: user.id().clone(),
+        mood: Mood::Good,
+        logged_at: test_logged_at(),
+        dimensions: vec![DimensionValue::activities(vec![
+            domain::activity::ActivityId::generate(),
+        ])],
+    };
+
+    assert!(create_entry::execute(cmd, &deps).await.is_err());
+    assert_eq!(store.entry_count(), 0);
+}
+
+#[tokio::test]
+async fn an_archived_activity_cannot_be_tagged_onto_a_new_entry() {
+    let (store, deps) = deps();
+    let user = test_user("alice");
+
+    let mut retired = domain::testing::test_activity(user.id().clone(), "fencing");
+    retired.archive().unwrap();
+    domain::ports::ActivityCommandPort::save(store.as_ref(), &retired)
+        .await
+        .unwrap();
+
+    let cmd = CreateEntryCommand {
+        user_id: user.id().clone(),
+        mood: Mood::Good,
+        logged_at: test_logged_at(),
+        dimensions: vec![DimensionValue::activities(vec![retired.id().clone()])],
+    };
+
+    let refused = create_entry::execute(cmd, &deps).await;
+
+    assert!(
+        matches!(
+            refused,
+            Err(application::errors::ApplicationError::Validation(_))
+        ),
+        "an archived activity is retired, not forbidden, got {refused:?}"
+    );
+    assert_eq!(store.entry_count(), 0);
+}
+
+#[tokio::test]
+async fn unarchiving_makes_an_activity_taggable_again() {
+    let (store, deps) = deps();
+    let user = test_user("alice");
+
+    let mut activity = domain::testing::test_activity(user.id().clone(), "fencing");
+    activity.archive().unwrap();
+    activity.unarchive().unwrap();
+    domain::ports::ActivityCommandPort::save(store.as_ref(), &activity)
+        .await
+        .unwrap();
+
+    let cmd = CreateEntryCommand {
+        user_id: user.id().clone(),
+        mood: Mood::Good,
+        logged_at: test_logged_at(),
+        dimensions: vec![DimensionValue::activities(vec![activity.id().clone()])],
+    };
+
+    create_entry::execute(cmd, &deps).await.unwrap();
+
+    assert_eq!(store.entry_count(), 1);
+}
+
+#[tokio::test]
+async fn many_entries_land_in_one_request() {
+    let store = Arc::new(InMemoryStore::new());
+    let content: Arc<dyn EntryDimensionPort> =
+        Arc::new(InMemoryDimensionStore::new(DimensionKind::Content));
+    let user = test_user("alice");
+
+    let deps = application::entry::use_cases::create_entries::Deps {
+        entries: store.clone(),
+        dimensions: vec![content],
+        activities: store.clone(),
+        events: store.clone(),
+    };
+
+    let wanted: Vec<CreateEntryCommand> = [Mood::Good, Mood::Bad, Mood::Rad]
+        .into_iter()
+        .map(|mood| CreateEntryCommand {
+            user_id: user.id().clone(),
+            mood,
+            logged_at: test_logged_at(),
+            dimensions: vec![],
+        })
+        .collect();
+
+    let created =
+        application::entry::use_cases::create_entries::execute(user.id().clone(), wanted, &deps)
+            .await
+            .unwrap();
+
+    assert_eq!(created.len(), 3);
+    assert_eq!(store.entry_count(), 3);
+    assert_eq!(
+        store.published_events().len(),
+        3,
+        "each entry is its own event"
+    );
+}
+
+#[tokio::test]
+async fn one_bad_activity_refuses_the_whole_batch() {
+    let store = Arc::new(InMemoryStore::new());
+    let user = test_user("alice");
+    let stranger = test_user("mallory");
+
+    let theirs = domain::testing::test_activity(stranger.id().clone(), "fencing");
+    domain::ports::ActivityCommandPort::save(store.as_ref(), &theirs)
+        .await
+        .unwrap();
+
+    let deps = application::entry::use_cases::create_entries::Deps {
+        entries: store.clone(),
+        dimensions: vec![],
+        activities: store.clone(),
+        events: store.clone(),
+    };
+
+    let wanted = vec![
+        CreateEntryCommand {
+            user_id: user.id().clone(),
+            mood: Mood::Good,
+            logged_at: test_logged_at(),
+            dimensions: vec![],
+        },
+        CreateEntryCommand {
+            user_id: user.id().clone(),
+            mood: Mood::Bad,
+            logged_at: test_logged_at(),
+            dimensions: vec![DimensionValue::activities(vec![theirs.id().clone()])],
+        },
+    ];
+
+    let refused =
+        application::entry::use_cases::create_entries::execute(user.id().clone(), wanted, &deps)
+            .await;
+
+    assert!(refused.is_err());
+    assert_eq!(
+        store.entry_count(),
+        0,
+        "the first entry must not survive a batch that was refused"
+    );
+}