Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

.env.example

@@ -9,6 +9,22 @@ NEXTAUTH_URL=http://localhost:3000
 # COOKIE_SECURE=1
 # Reserved administrator emails; provision them using the operator seed in README.md.
 ADMIN_EMAILS=
+# First-run administrator claim. The default (unset) lets the first signup
+# become administrator, which is convenient locally and DANGEROUS on a public
+# server: whoever registers first after DNS is live owns the instance.
+# On an exposed deployment set ALLOW_BOOTSTRAP_SIGNUP=0, list the operator in
+# ADMIN_EMAILS, and provision that account with `make seed` (scripts/
+# server-deploy.sh does this automatically for new installs).
+#ALLOW_BOOTSTRAP_SIGNUP=0
+# Master switch for self-service registration (default enabled). Set to 0 on
+# private instances where accounts are provisioned only by an operator.
+#SIGNUP_ENABLED=0
+# Trust the X-Real-IP header for rate-limit identity. Set to 1 ONLY when a
+# proxy in front of the web container overwrites X-Real-IP with the real peer
+# address (the bundled nginx template does; scripts/server-deploy.sh writes
+# this for server deployments). Never set it when port 3000 is reachable
+# directly — clients could then choose their own rate-limit bucket.
+#TRUSTED_PROXY=1
 # Keep these defaults on a new install; change only to reuse an existing volume.
 POSTGRES_VOLUME=computer_pgdata
 POSTGRES_VOLUME_EXTERNAL=false