spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/config/src/entry_config.rs

@@ -2,6 +2,7 @@ const DEFAULT_MAX_CONTENT_LENGTH: usize = 65_536;
 const DEFAULT_MAX_PHOTOS: usize = 10;
 const DEFAULT_MAX_VOICE_MEMOS: usize = 5;
 const DEFAULT_MAX_ACTIVITIES_PER_ENTRY: usize = 50;
+const DEFAULT_MAX_ENTRIES_PER_PAGE: i64 = 200;
 
 #[derive(Debug, Clone, serde::Deserialize)]
 #[serde(default)]
@@ -10,6 +11,7 @@ pub struct EntryConfig {
     pub max_photos: usize,
     pub max_voice_memos: usize,
     pub max_activities_per_entry: usize,
+    pub max_entries_per_page: i64,
 }
 
 impl Default for EntryConfig {
@@ -19,6 +21,7 @@ impl Default for EntryConfig {
             max_photos: DEFAULT_MAX_PHOTOS,
             max_voice_memos: DEFAULT_MAX_VOICE_MEMOS,
             max_activities_per_entry: DEFAULT_MAX_ACTIVITIES_PER_ENTRY,
+            max_entries_per_page: DEFAULT_MAX_ENTRIES_PER_PAGE,
         }
     }
 }

crates/config/src/lib.rs

@@ -8,6 +8,7 @@ mod loader;
 mod preset;
 mod provider_config;
 mod push_config;
+mod rate_limit_config;
 mod server_config;
 mod storage_config;
 mod worker_config;
@@ -22,6 +23,7 @@ pub use loader::load;
 pub use preset::{PresetActivity, PresetConfig};
 pub use provider_config::ProviderConfig;
 pub use push_config::PushConfig;
+pub use rate_limit_config::RateLimitConfig;
 pub use server_config::{CorsConfig, ServerConfig};
 pub use storage_config::{MediaBackend, StorageConfig};
 pub use worker_config::WorkerConfig;

crates/config/src/rate_limit_config.rs

@@ -0,0 +1,24 @@
+const DEFAULT_ENABLED: bool = true;
+const DEFAULT_REQUESTS_PER_SECOND: u64 = 20;
+const DEFAULT_BURST: u32 = 60;
+const DEFAULT_TRUST_FORWARDED_FOR: bool = false;
+
+#[derive(Debug, Clone, serde::Deserialize)]
+#[serde(default)]
+pub struct RateLimitConfig {
+    pub enabled: bool,
+    pub requests_per_second: u64,
+    pub burst: u32,
+    pub trust_forwarded_for: bool,
+}
+
+impl Default for RateLimitConfig {
+    fn default() -> Self {
+        Self {
+            enabled: DEFAULT_ENABLED,
+            requests_per_second: DEFAULT_REQUESTS_PER_SECOND,
+            burst: DEFAULT_BURST,
+            trust_forwarded_for: DEFAULT_TRUST_FORWARDED_FOR,
+        }
+    }
+}

crates/config/src/server_config.rs

@@ -1,3 +1,5 @@
+use super::rate_limit_config::RateLimitConfig;
+
 const DEFAULT_HOST: &str = "0.0.0.0";
 const DEFAULT_PORT: u16 = 3000;
 const DEFAULT_MAX_BODY_SIZE: usize = 10 * 1024 * 1024;
@@ -11,6 +13,7 @@ pub struct ServerConfig {
     pub max_body_size: usize,
     pub spa_dir: String,
     pub cors: CorsConfig,
+    pub rate_limit: RateLimitConfig,
 }
 
 impl Default for ServerConfig {
@@ -21,6 +24,7 @@ impl Default for ServerConfig {
             max_body_size: DEFAULT_MAX_BODY_SIZE,
             spa_dir: DEFAULT_SPA_DIR.into(),
             cors: CorsConfig::default(),
+            rate_limit: RateLimitConfig::default(),
         }
     }
 }

crates/config/src/worker_config.rs

@@ -2,6 +2,7 @@ const DEFAULT_POLL_SECONDS: u64 = 15;
 const DEFAULT_SWEEP_SECONDS: u64 = 900;
 const DEFAULT_SESSION_CLEANUP_SECONDS: u64 = 3600;
 const DEFAULT_REMINDER_SECONDS: u64 = 60;
+const DEFAULT_REMINDER_GRACE_MINUTES: i64 = 30;
 const DEFAULT_JOBS_PER_POLL: usize = 20;
 const DEFAULT_ENQUEUED_PER_SWEEP: usize = 200;
 const DEFAULT_MOST_ATTEMPTS: u32 = 5;
@@ -15,6 +16,7 @@ pub struct WorkerConfig {
     pub sweep_seconds: u64,
     pub session_cleanup_seconds: u64,
     pub reminder_seconds: u64,
+    pub reminder_grace_minutes: i64,
     pub jobs_per_poll: usize,
     pub enqueued_per_sweep: usize,
     pub most_attempts: u32,
@@ -29,6 +31,7 @@ impl Default for WorkerConfig {
             sweep_seconds: DEFAULT_SWEEP_SECONDS,
             session_cleanup_seconds: DEFAULT_SESSION_CLEANUP_SECONDS,
             reminder_seconds: DEFAULT_REMINDER_SECONDS,
+            reminder_grace_minutes: DEFAULT_REMINDER_GRACE_MINUTES,
             jobs_per_poll: DEFAULT_JOBS_PER_POLL,
             enqueued_per_sweep: DEFAULT_ENQUEUED_PER_SWEEP,
             most_attempts: DEFAULT_MOST_ATTEMPTS,