spa hardening, offline logging, rate limit fixes

server:
- backup exporter, auth extractors, error shapes, CONTEXT (prior work)
- spa assets served outside the rate limit via route_layer
- requests_per_second went to per_second(), which takes an interval not a
  rate: 50 meant one request per 50s once burst was spent. now converted
  properly. 15/s, burst 60

spa fixes:
- account delete cleared snake_case token keys that were never written
- refresh interceptor could retry forever
- date ranges used local day boundaries stamped +00:00
- "all" period trend plotted one page; calendar days fabricated mood 3
- chart grid invisible: hsl(var(--border)) against rgba tokens
- blob url leak, orphaned media on failed save, devtools in prod bundle
- pt-safe/safe-area-pb classes never existed

spa features:
- offline outbox: entries queue to IndexedDB, replay with backoff, only
  server refusals count against an entry
- drafts persist, quick-log sheet, diary infinite scroll + filters
- route error boundary, stale-chunk recovery, no service worker in dev

a11y + perf:
- mood picker is a radiogroup, activity picker keyboard-operable,
  text alternatives for colour/emoji, locale week start
- dark glass over the bright photo: worst case 1.4:1 -> 4.9-9.6:1
- initial payload 1095->769kB raw, 306->230kB gzip; 38 unused components
  and 5 deps dropped; fonts 218->133kB

53 tests added (43 spa, 10 server)

spa/public/sw.js

@@ -1,6 +1,17 @@
-const CACHE_NAME = "k-mood-v1"
+/*
+ * The app shell cache and push handling.
+ *
+ * A new worker deliberately does NOT take over on its own: assets are served
+ * cache-first, so swapping them under a running page can hand it chunks from
+ * two different builds. It waits until the page asks, which it does after
+ * telling the reader a new version is ready.
+ */
+
+const CACHE_NAME = "k-mood-v2"
+const APP_SHELL = "/"
+
 const STATIC_ASSETS = [
-  "/",
+  APP_SHELL,
   "/manifest.json",
   "/logo192.png",
   "/logo512.png",
@@ -11,7 +22,6 @@ self.addEventListener("install", (event) => {
   event.waitUntil(
     caches.open(CACHE_NAME).then((cache) => cache.addAll(STATIC_ASSETS))
   )
-  self.skipWaiting()
 })
 
 self.addEventListener("activate", (event) => {
@@ -20,66 +30,85 @@ self.addEventListener("activate", (event) => {
       .keys()
       .then((keys) =>
         Promise.all(
-          keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k))
+          keys.filter((key) => key !== CACHE_NAME).map((key) => caches.delete(key))
         )
       )
+      .then(() => self.clients.claim())
   )
-  self.clients.claim()
 })
 
+self.addEventListener("message", (event) => {
+  if (event.data?.type === "SKIP_WAITING") self.skipWaiting()
+})
+
+function cache(request, response) {
+  if (!response.ok) return response
+
+  const copy = response.clone()
+  caches
+    .open(CACHE_NAME)
+    .then((store) => store.put(request, copy))
+    .catch(() => {})
+
+  return response
+}
+
 self.addEventListener("fetch", (event) => {
-  const url = new URL(event.request.url)
+  const { request } = event
+  const url = new URL(request.url)
 
+  // The journal is never cached, wherever the server lives.
   if (url.pathname.startsWith("/api/")) return
+  if (request.method !== "GET") return
+  if (url.origin !== self.location.origin) return
 
-  if (event.request.mode === "navigate") {
+  if (request.mode === "navigate") {
     event.respondWith(
-      fetch(event.request)
-        .then((response) => {
-          const clone = response.clone()
-          caches
-            .open(CACHE_NAME)
-            .then((cache) => cache.put(event.request, clone))
-          return response
-        })
-        .catch(() => caches.match("/"))
+      fetch(request)
+        .then((response) => cache(request, response))
+        .catch(() => caches.match(APP_SHELL))
     )
     return
   }
 
   event.respondWith(
-    caches.match(event.request).then((cached) => {
-      const fetched = fetch(event.request).then((response) => {
-        const clone = response.clone()
-        caches.open(CACHE_NAME).then((cache) => cache.put(event.request, clone))
-        return response
-      })
-      return cached || fetched
+    caches.match(request).then((cached) => {
+      const fresh = fetch(request)
+        .then((response) => cache(request, response))
+        .catch(() => cached)
+
+      return cached ?? fresh
     })
   )
 })
 
 self.addEventListener("push", (event) => {
   const data = event.data?.json() ?? {}
-  const title = data.title || "K-Mood"
-  const options = {
-    body: data.body || "How are you feeling?",
-    icon: "/logo192.png",
-    badge: "/logo192.png",
-    data: { url: data.url || "/" },
-  }
-  event.waitUntil(self.registration.showNotification(title, options))
+
+  event.waitUntil(
+    self.registration.showNotification(data.title || "K-Mood", {
+      body: data.body || "How are you feeling?",
+      icon: "/logo192.png",
+      badge: "/logo192.png",
+      data: { url: data.url || APP_SHELL },
+    })
+  )
 })
 
 self.addEventListener("notificationclick", (event) => {
   event.notification.close()
-  const url = event.notification.data?.url || "/"
+  const target = event.notification.data?.url || APP_SHELL
+
   event.waitUntil(
-    clients.matchAll({ type: "window" }).then((windowClients) => {
-      for (const client of windowClients) {
-        if (client.url.includes(url) && "focus" in client) return client.focus()
-      }
-      return clients.openWindow(url)
-    })
+    self.clients
+      .matchAll({ type: "window", includeUncontrolled: true })
+      .then((windows) => {
+        for (const client of windows) {
+          if (client.url.includes(target) && "focus" in client) {
+            return client.focus()
+          }
+        }
+        return self.clients.openWindow(target)
+      })
   )
 })