spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/domain/tests/api_token/api_token_test.rs

@@ -1,12 +1,17 @@
-use domain::api_token::{ApiToken, MintedApiToken, TokenDigest, TokenScope};
+use domain::api_token::{ApiToken, MintedApiToken, TokenDigest, TokenScope, TokenScopes};
 use domain::provider::ProviderName;
 use domain::user::UserId;
 
 fn a_token() -> ApiToken {
+    token_granting([TokenScope::WriteMetrics])
+}
+
+fn token_granting(scopes: impl IntoIterator<Item = TokenScope>) -> ApiToken {
     ApiToken::new(
         UserId::generate(),
         ProviderName::new("iphone-shortcuts").unwrap(),
         TokenDigest::from_persistence("digest-of-the-secret".into()),
+        TokenScopes::new(scopes).unwrap(),
     )
 }
 
@@ -15,7 +20,7 @@ fn a_fresh_token_has_never_been_used() {
     let token = a_token();
 
     assert!(token.last_used_at().is_none());
-    assert_eq!(token.scope(), TokenScope::WriteMetrics);
+    assert!(token.allows(TokenScope::WriteMetrics));
 }
 
 #[test]
@@ -36,13 +41,58 @@ fn the_name_a_token_carries_is_the_provider_its_writes_are_attributed_to() {
 
 #[test]
 fn every_scope_survives_a_round_trip_through_its_name() {
-    assert_eq!(
-        TokenScope::from_name(TokenScope::WriteMetrics.name()),
-        Some(TokenScope::WriteMetrics)
-    );
+    for scope in TokenScope::ALL {
+        assert_eq!(TokenScope::from_name(scope.name()), Some(scope));
+    }
+
     assert_eq!(TokenScope::from_name("read-everything"), None);
 }
 
+#[test]
+fn a_token_grants_only_what_it_was_minted_for() {
+    let token = token_granting([TokenScope::ReadJournal]);
+
+    assert!(token.allows(TokenScope::ReadJournal));
+    assert!(!token.allows(TokenScope::WriteJournal));
+    assert!(!token.allows(TokenScope::WriteMetrics));
+    assert!(!token.allows(TokenScope::ReadProfile));
+}
+
+#[test]
+fn a_token_that_grants_nothing_cannot_be_minted() {
+    assert!(TokenScopes::new([]).is_err());
+    assert!(TokenScopes::from_names(Vec::<&str>::new()).is_err());
+}
+
+#[test]
+fn an_unknown_scope_name_is_refused_rather_than_ignored() {
+    let refused = TokenScopes::from_names(["readJournal", "readEverything"]);
+
+    assert!(
+        refused.is_err(),
+        "a typo must not quietly mint a narrower token than asked for"
+    );
+}
+
+#[test]
+fn scopes_survive_a_round_trip_through_persistence() {
+    let held = TokenScopes::new([TokenScope::ReadJournal, TokenScope::WriteJournal]).unwrap();
+
+    assert_eq!(
+        TokenScopes::from_persistence(&held.to_persistence()),
+        Some(held)
+    );
+}
+
+#[test]
+fn a_stored_scope_this_build_cannot_read_makes_the_whole_set_unreadable() {
+    assert_eq!(
+        TokenScopes::from_persistence("readJournal writeEverything"),
+        None
+    );
+    assert_eq!(TokenScopes::from_persistence(""), None);
+}
+
 #[test]
 fn a_minted_token_keeps_the_secret_out_of_its_debug_output() {
     let minted = MintedApiToken::new(a_token(), "kmood_supersecretvalue".into());

crates/domain/tests/reminder.rs

@@ -1,2 +1,5 @@
+#[path = "reminder/due_occurrence_test.rs"]
+mod due_occurrence_test;
+
 #[path = "reminder/reminder_test.rs"]
 mod reminder_test;

crates/domain/tests/reminder/due_occurrence_test.rs

@@ -0,0 +1,169 @@
+use chrono::{DateTime, Duration, NaiveTime, TimeZone, Utc, Weekday};
+
+use domain::reminder::{DaySchedule, Reminder};
+use domain::user::{Timezone, UserId};
+
+const GRACE: Duration = Duration::minutes(30);
+
+fn warsaw() -> Timezone {
+    Timezone::new("Europe/Warsaw").unwrap()
+}
+
+fn at(time: &str) -> NaiveTime {
+    NaiveTime::parse_from_str(time, "%H:%M").unwrap()
+}
+
+fn instant(text: &str) -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339(text)
+        .unwrap()
+        .with_timezone(&Utc)
+}
+
+fn every_day_at(time: &str) -> Reminder {
+    Reminder::new(UserId::generate(), DaySchedule::every_day_at(at(time)))
+}
+
+#[test]
+fn a_reminder_is_due_once_its_local_time_has_arrived() {
+    let reminder = every_day_at("20:00");
+    let just_after_eight_in_warsaw = instant("2026-08-27T18:01:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(just_after_eight_in_warsaw, &warsaw(), GRACE)
+            .is_some()
+    );
+}
+
+#[test]
+fn a_reminder_is_not_due_before_its_local_time() {
+    let reminder = every_day_at("20:00");
+    let half_past_seven_in_warsaw = instant("2026-08-27T17:30:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(half_past_seven_in_warsaw, &warsaw(), GRACE)
+            .is_none()
+    );
+}
+
+#[test]
+fn the_same_occurrence_is_never_due_twice() {
+    let mut reminder = every_day_at("20:00");
+    let first_sweep = instant("2026-08-27T18:01:00Z");
+
+    let occurrence = reminder
+        .occurrence_reached(first_sweep, &warsaw(), GRACE)
+        .expect("the reminder should be due on the first sweep");
+
+    reminder.mark_sent(occurrence);
+
+    for minute in 2..=25 {
+        let later = instant(&format!("2026-08-27T18:{minute:02}:00Z"));
+
+        assert!(
+            reminder
+                .occurrence_reached(later, &warsaw(), GRACE)
+                .is_none(),
+            "a reminder already sent must not be sent again at 18:{minute:02}"
+        );
+    }
+}
+
+#[test]
+fn the_next_days_occurrence_is_due_again() {
+    let mut reminder = every_day_at("20:00");
+    let today = instant("2026-08-27T18:01:00Z");
+
+    let occurrence = reminder
+        .occurrence_reached(today, &warsaw(), GRACE)
+        .unwrap();
+    reminder.mark_sent(occurrence);
+
+    let tomorrow = instant("2026-08-28T18:01:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(tomorrow, &warsaw(), GRACE)
+            .is_some(),
+        "a new day is a new occurrence"
+    );
+}
+
+#[test]
+fn an_occurrence_late_yesterday_is_still_reachable_after_local_midnight() {
+    let schedule = {
+        let mut schedule = DaySchedule::new();
+        schedule.set_time(Weekday::Thu, Some(at("23:50")));
+        schedule
+    };
+    let reminder = Reminder::new(UserId::generate(), schedule);
+
+    let ten_past_midnight_on_friday = instant("2026-08-27T22:10:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(ten_past_midnight_on_friday, &warsaw(), GRACE)
+            .is_some(),
+        "a reminder scheduled just before midnight must survive the day boundary"
+    );
+}
+
+#[test]
+fn an_occurrence_older_than_the_grace_window_is_not_resurrected() {
+    let reminder = every_day_at("08:00");
+    let late_that_evening = instant("2026-08-27T19:00:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(late_that_evening, &warsaw(), GRACE)
+            .is_none(),
+        "a worker starting late must not fire this morning's reminder"
+    );
+}
+
+#[test]
+fn a_disabled_reminder_is_never_due() {
+    let mut reminder = every_day_at("20:00");
+    reminder.disable();
+
+    assert!(
+        reminder
+            .occurrence_reached(instant("2026-08-27T18:01:00Z"), &warsaw(), GRACE)
+            .is_none()
+    );
+}
+
+#[test]
+fn a_day_with_no_time_set_is_never_due() {
+    let schedule = {
+        let mut schedule = DaySchedule::new();
+        schedule.set_time(Weekday::Mon, Some(at("20:00")));
+        schedule
+    };
+    let reminder = Reminder::new(UserId::generate(), schedule);
+
+    let a_thursday = instant("2026-08-27T18:01:00Z");
+
+    assert!(
+        reminder
+            .occurrence_reached(a_thursday, &warsaw(), GRACE)
+            .is_none()
+    );
+}
+
+#[test]
+fn the_scheduled_instant_is_resolved_in_the_users_own_zone() {
+    let reminder = every_day_at("20:00");
+    let warsaw_evening = instant("2026-08-27T18:01:00Z");
+
+    let occurrence = reminder
+        .occurrence_reached(warsaw_evening, &warsaw(), GRACE)
+        .unwrap();
+
+    assert_eq!(
+        occurrence.scheduled_for(),
+        Utc.with_ymd_and_hms(2026, 8, 27, 18, 0, 0).unwrap(),
+        "8 PM in Warsaw in August is 18:00Z"
+    );
+}