Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

db/migrations/010_share_uniqueness.sql

@@ -0,0 +1,32 @@
+-- Review L-3/L-12: enforce the uniqueness constraints the handlers rely on.
+-- Both dedupe existing rows first so the migration succeeds on an installed
+-- database that already contains duplicates.
+
+-- One calendar share per (creator, recipient, date). Keep the newest row and
+-- collapse the rest; re-sharing now updates the surviving row's note.
+DELETE FROM "SharedDate" older
+USING "SharedDate" newer
+WHERE older."creatorId" = newer."creatorId"
+  AND older."recipientId" = newer."recipientId"
+  AND older.date = newer.date
+  AND (older."createdAt", older.id) < (newer."createdAt", newer.id);
+
+DROP INDEX IF EXISTS "SharedDate_creatorId_recipientId_date_idx";
+CREATE UNIQUE INDEX "SharedDate_creatorId_recipientId_date_idx"
+  ON "SharedDate"("creatorId","recipientId",date);
+
+-- Legacy kanban status keys are unique per user. Keep the key on the
+-- earliest column and clear it from duplicates; those columns remain normal
+-- (explicitly placed) columns, only the ambiguous legacy mapping goes away.
+UPDATE "KanbanColumn" dup
+SET "key" = NULL
+WHERE dup."key" IS NOT NULL
+  AND EXISTS (
+    SELECT 1 FROM "KanbanColumn" keep
+    WHERE keep."userId" = dup."userId"
+      AND keep."key" = dup."key"
+      AND (keep.position, keep.id) < (dup.position, dup.id)
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS "KanbanColumn_userId_key_idx"
+  ON "KanbanColumn"("userId","key") WHERE "key" IS NOT NULL;