spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/application/tests/media/custody_test.rs

@@ -0,0 +1,138 @@
+use std::sync::Arc;
+
+use domain::attachment::{ContentType, MediaUpload};
+use domain::errors::DomainError;
+use domain::ports::MediaStoragePort;
+use domain::testing::{FakeMediaStorage, InMemoryStore, test_user};
+
+use application::errors::ApplicationError;
+use application::media::use_cases::{delete_photo, delete_voice_memo, upload_photo};
+
+fn an_upload() -> MediaUpload {
+    MediaUpload::new(vec![1, 2, 3], ContentType::new("image/png").unwrap()).unwrap()
+}
+
+fn upload_deps(storage: Arc<FakeMediaStorage>, store: Arc<InMemoryStore>) -> upload_photo::Deps {
+    upload_photo::Deps {
+        storage,
+        ownership: store,
+    }
+}
+
+#[tokio::test]
+async fn uploading_claims_the_photo_for_the_uploader() {
+    let storage = Arc::new(FakeMediaStorage::holding_nothing());
+    let store = Arc::new(InMemoryStore::new());
+    let owner = test_user("alice");
+
+    let photo_id = upload_photo::execute(
+        owner.id().clone(),
+        an_upload(),
+        &upload_deps(storage.clone(), store.clone()),
+    )
+    .await
+    .unwrap();
+
+    let deps = delete_photo::Deps {
+        storage: storage.clone(),
+        ownership: store.clone(),
+    };
+
+    delete_photo::execute(photo_id.clone(), owner.id().clone(), &deps)
+        .await
+        .expect("the owner may delete their own photo");
+
+    assert!(!storage.holds_photo(&photo_id));
+}
+
+#[tokio::test]
+async fn a_stranger_cannot_delete_someone_elses_photo() {
+    let storage = Arc::new(FakeMediaStorage::holding_nothing());
+    let store = Arc::new(InMemoryStore::new());
+    let owner = test_user("alice");
+    let stranger = test_user("mallory");
+
+    let photo_id = upload_photo::execute(
+        owner.id().clone(),
+        an_upload(),
+        &upload_deps(storage.clone(), store.clone()),
+    )
+    .await
+    .unwrap();
+
+    let deps = delete_photo::Deps {
+        storage: storage.clone(),
+        ownership: store.clone(),
+    };
+
+    let refused = delete_photo::execute(photo_id.clone(), stranger.id().clone(), &deps).await;
+
+    assert!(
+        matches!(
+            refused,
+            Err(ApplicationError::Domain(DomainError::Forbidden(_)))
+        ),
+        "a stranger must be refused, got {refused:?}"
+    );
+    assert!(
+        storage.holds_photo(&photo_id),
+        "the blob must survive a refused delete"
+    );
+}
+
+#[tokio::test]
+async fn media_nobody_claimed_cannot_be_deleted_by_anyone() {
+    let storage = Arc::new(FakeMediaStorage::holding_nothing());
+    let store = Arc::new(InMemoryStore::new());
+    let caller = test_user("alice");
+
+    let orphan = storage.store_photo(an_upload()).await.unwrap();
+
+    let deps = delete_photo::Deps {
+        storage: storage.clone(),
+        ownership: store.clone(),
+    };
+
+    let refused = delete_photo::execute(orphan.clone(), caller.id().clone(), &deps).await;
+
+    assert!(
+        matches!(
+            refused,
+            Err(ApplicationError::Domain(DomainError::NotFound(_)))
+        ),
+        "an unclaimed blob has no owner to check against, got {refused:?}"
+    );
+    assert!(storage.holds_photo(&orphan));
+}
+
+#[tokio::test]
+async fn a_voice_memo_id_is_not_a_photo_id() {
+    let storage = Arc::new(FakeMediaStorage::holding_nothing());
+    let store = Arc::new(InMemoryStore::new());
+    let owner = test_user("alice");
+
+    let photo_id = upload_photo::execute(
+        owner.id().clone(),
+        an_upload(),
+        &upload_deps(storage.clone(), store.clone()),
+    )
+    .await
+    .unwrap();
+
+    let memo_id = domain::attachment::VoiceMemoId::from_uuid(photo_id.value());
+
+    let deps = delete_voice_memo::Deps {
+        storage: storage.clone(),
+        ownership: store.clone(),
+    };
+
+    let refused = delete_voice_memo::execute(memo_id, owner.id().clone(), &deps).await;
+
+    assert!(
+        matches!(
+            refused,
+            Err(ApplicationError::Domain(DomainError::NotFound(_)))
+        ),
+        "claiming a photo must not claim a voice memo that shares its uuid, got {refused:?}"
+    );
+}