Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

db/schema.sql

@@ -183,6 +183,9 @@ CREATE TABLE "KanbanColumn" (
   "createdAt" timestamptz NOT NULL DEFAULT now()
 );
 CREATE INDEX "KanbanColumn_userId_position_idx" ON "KanbanColumn"("userId", position);
+-- Legacy status keys are unique per user (review L-12): ResolveColumnID picks
+-- the first match, so duplicates would make the legacy fallback ambiguous.
+CREATE UNIQUE INDEX "KanbanColumn_userId_key_idx" ON "KanbanColumn"("userId", "key") WHERE "key" IS NOT NULL;
 
 -- Bookmark.kanbanColumnId -> KanbanColumn (SetNull)
 ALTER TABLE "Bookmark" ADD CONSTRAINT "Bookmark_kanbanColumnId_fkey"
@@ -338,7 +341,9 @@ CREATE TABLE "SharedDate" (
 CREATE INDEX "SharedDate_recipientId_idx" ON "SharedDate"("recipientId");
 CREATE INDEX "SharedDate_creatorId_idx" ON "SharedDate"("creatorId");
 CREATE INDEX "SharedDate_date_idx" ON "SharedDate"(date);
-CREATE INDEX "SharedDate_creatorId_recipientId_date_idx" ON "SharedDate"("creatorId","recipientId",date);
+-- One row per creator/recipient/date (review L-3): re-sharing the same date
+-- updates the note instead of duplicating calendar rows and notifications.
+CREATE UNIQUE INDEX "SharedDate_creatorId_recipientId_date_idx" ON "SharedDate"("creatorId","recipientId",date);
 CREATE INDEX "Bookmark_ownerId_alertAt_unsent_idx" ON "Bookmark"("ownerId","alertAt") WHERE NOT "alertSent";
 
 -- 2.17 Collections (Notion-like upgrades phase 2; see 002_collections.sql for