spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/application/tests/push/subscription_test.rs

@@ -0,0 +1,112 @@
+use std::sync::Arc;
+
+use domain::ports::PushSubscriptionQueryPort;
+use domain::testing::{InMemoryStore, test_user};
+
+use application::push::commands::{SubscribePushCommand, UnsubscribePushCommand};
+use application::push::use_cases::{subscribe, unsubscribe};
+
+const ENDPOINT: &str = "https://push.example.com/a-device";
+
+fn a_subscription(user_id: domain::user::UserId) -> SubscribePushCommand {
+    SubscribePushCommand {
+        user_id,
+        endpoint: ENDPOINT.into(),
+        p256dh: "a-key".into(),
+        auth: "a-secret".into(),
+    }
+}
+
+#[tokio::test]
+async fn subscribing_twice_keeps_one_subscription() {
+    let store = Arc::new(InMemoryStore::new());
+    let user = test_user("alice");
+
+    let deps = subscribe::Deps {
+        push_command: store.clone(),
+        push_query: store.clone(),
+    };
+
+    subscribe::execute(a_subscription(user.id().clone()), &deps)
+        .await
+        .unwrap();
+    let first = store.find_by_endpoint(ENDPOINT).await.unwrap().unwrap();
+
+    subscribe::execute(a_subscription(user.id().clone()), &deps)
+        .await
+        .unwrap();
+
+    let held = store.find_by_user(user.id()).await.unwrap();
+
+    assert_eq!(held.len(), 1, "one device is one subscription");
+    assert_eq!(
+        held[0].id(),
+        first.id(),
+        "re-subscribing renews the subscription rather than minting a new one"
+    );
+}
+
+#[tokio::test]
+async fn a_stranger_cannot_unsubscribe_someone_elses_device() {
+    let store = Arc::new(InMemoryStore::new());
+    let owner = test_user("alice");
+    let stranger = test_user("mallory");
+
+    let deps = subscribe::Deps {
+        push_command: store.clone(),
+        push_query: store.clone(),
+    };
+    subscribe::execute(a_subscription(owner.id().clone()), &deps)
+        .await
+        .unwrap();
+
+    let deps = unsubscribe::Deps {
+        push_command: store.clone(),
+    };
+
+    unsubscribe::execute(
+        UnsubscribePushCommand {
+            user_id: stranger.id().clone(),
+            endpoint: ENDPOINT.into(),
+        },
+        &deps,
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(
+        store.find_by_user(owner.id()).await.unwrap().len(),
+        1,
+        "the owner's device must still be subscribed"
+    );
+}
+
+#[tokio::test]
+async fn the_owner_can_unsubscribe_their_own_device() {
+    let store = Arc::new(InMemoryStore::new());
+    let owner = test_user("alice");
+
+    let deps = subscribe::Deps {
+        push_command: store.clone(),
+        push_query: store.clone(),
+    };
+    subscribe::execute(a_subscription(owner.id().clone()), &deps)
+        .await
+        .unwrap();
+
+    let deps = unsubscribe::Deps {
+        push_command: store.clone(),
+    };
+
+    unsubscribe::execute(
+        UnsubscribePushCommand {
+            user_id: owner.id().clone(),
+            endpoint: ENDPOINT.into(),
+        },
+        &deps,
+    )
+    .await
+    .unwrap();
+
+    assert!(store.find_by_user(owner.id()).await.unwrap().is_empty());
+}