spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

crates/worker/Cargo.toml

@@ -12,5 +12,6 @@ bootstrap.workspace = true
 domain.workspace = true
 application.workspace = true
 config.workspace = true
+chrono.workspace = true
 tokio.workspace = true
 tracing.workspace = true

crates/worker/src/loops.rs

@@ -1,17 +1,19 @@
 use std::sync::Arc;
-use std::time::Duration;
+use std::time::Duration as StdDuration;
+
+use chrono::Duration;
 
 use application::job::use_cases::{run_due_jobs, sweep_recording_backlog, sweep_weather_backlog};
 use application::reminder::use_cases::process_due_reminders;
 use config::WorkerConfig;
 use domain::ports::{
     EntryDimensionPort, JobQueueCommandPort, RecordingBackfillQueryPort, RecordingLookupPort,
-    RefreshSessionCommandPort, ReminderQueryPort, ReminderSenderPort, UserQueryPort,
-    WeatherBacklogQueryPort, WeatherLookupPort,
+    RefreshSessionCommandPort, ReminderCommandPort, ReminderQueryPort, ReminderSenderPort,
+    UserQueryPort, WeatherBacklogQueryPort, WeatherLookupPort,
 };
 
 pub fn every(seconds: u64) -> tokio::time::Interval {
-    let mut interval = tokio::time::interval(Duration::from_secs(seconds.max(1)));
+    let mut interval = tokio::time::interval(StdDuration::from_secs(seconds.max(1)));
     interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
 
     interval
@@ -106,14 +108,17 @@ pub async fn sweep_for_work(
 
 pub async fn send_due_reminders(
     reminder_query: Arc<dyn ReminderQueryPort>,
+    reminder_command: Arc<dyn ReminderCommandPort>,
     user_query: Arc<dyn UserQueryPort>,
     sender: Arc<dyn ReminderSenderPort>,
     worker: WorkerConfig,
 ) {
     let deps = process_due_reminders::Deps {
         reminder_query,
+        reminder_command,
         user_query,
         sender,
+        grace: Duration::minutes(worker.reminder_grace_minutes),
     };
 
     let mut ticks = every(worker.reminder_seconds);

crates/worker/src/main.rs

@@ -54,6 +54,7 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let reminders = context.reminder_sender.clone().map(|sender| {
         tokio::spawn(loops::send_due_reminders(
             context.state.reminder_query.clone(),
+            context.state.reminder_command.clone(),
             context.state.user_query.clone(),
             sender,
             worker,