spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/application/tests/user/change_password_test.rs

@@ -17,6 +17,7 @@ async fn setup() -> (Arc<InMemoryStore>, change_password::Deps, User) {
     store.save(&user).await.unwrap();
 
     let deps = change_password::Deps {
+        refresh_sessions: store.clone(),
         user_command: store.clone(),
         user_query: store.clone(),
         password_hasher: Arc::new(FakePasswordHasher),
@@ -65,3 +66,64 @@ async fn rejects_nonexistent_user() {
     let result = change_password::execute(cmd, &deps).await;
     assert!(result.is_err());
 }
+
+#[tokio::test]
+async fn changing_a_password_revokes_every_live_session() {
+    let (store, deps, user) = setup().await;
+
+    for _ in 0..3 {
+        domain::ports::RefreshSessionCommandPort::create(
+            store.as_ref(),
+            &domain::auth::RefreshSession::new(user.id().clone(), 3_600),
+        )
+        .await
+        .unwrap();
+    }
+
+    assert_eq!(store.refresh_sessions.read().unwrap().len(), 3);
+
+    change_password::execute(
+        ChangePasswordCommand {
+            user_id: user.id().clone(),
+            current_password: "secret".into(),
+            new_password: "new-secret".into(),
+        },
+        &deps,
+    )
+    .await
+    .unwrap();
+
+    assert!(
+        store.refresh_sessions.read().unwrap().is_empty(),
+        "a stolen refresh token must not survive a password change"
+    );
+}
+
+#[tokio::test]
+async fn a_refused_password_change_leaves_sessions_alone() {
+    let (store, deps, user) = setup().await;
+
+    domain::ports::RefreshSessionCommandPort::create(
+        store.as_ref(),
+        &domain::auth::RefreshSession::new(user.id().clone(), 3_600),
+    )
+    .await
+    .unwrap();
+
+    let refused = change_password::execute(
+        ChangePasswordCommand {
+            user_id: user.id().clone(),
+            current_password: "not-the-password".into(),
+            new_password: "new-secret".into(),
+        },
+        &deps,
+    )
+    .await;
+
+    assert!(refused.is_err());
+    assert_eq!(
+        store.refresh_sessions.read().unwrap().len(),
+        1,
+        "a failed attempt must not log the account out"
+    );
+}