Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/auth/handlers.go

@@ -40,7 +40,13 @@ func failure(w http.ResponseWriter, status int, s string) {
 }
 func decode(w http.ResponseWriter, r *http.Request, v any) bool {
 	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
-	if json.NewDecoder(r.Body).Decode(v) != nil {
+	if err := json.NewDecoder(r.Body).Decode(v); err != nil {
+		// Review L-8: oversized is 413, not malformed JSON.
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			failure(w, 413, "Request body too large (limit 1 MiB)")
+			return false
+		}
 		failure(w, 400, "Invalid JSON")
 		return false
 	}
@@ -69,6 +75,9 @@ func HandleSignup(w http.ResponseWriter, r *http.Request) {
 		failure(w, 400, "Invalid email")
 		return
 	}
+	// Review L-2: a display name of only whitespace is not a name. Trim, then
+	// fall back to the email local-part when nothing remains.
+	req.Name = strings.TrimSpace(req.Name)
 	if len([]rune(req.Name)) > maxSignupNameLen {
 		failure(w, 400, "Name must be at most 120 characters")
 		return
@@ -144,6 +153,13 @@ func checkAuthRequest(w http.ResponseWriter, r *http.Request) bool {
 		failure(w, 415, "Content-Type must be application/json")
 		return false
 	}
+	return checkOrigin(w, r)
+}
+
+// checkOrigin rejects a cross-origin Origin when one is present. Extracted
+// from checkAuthRequest so the sign-out endpoint can share the same guard
+// without forcing a JSON content type on legacy cookie clients (review M-16).
+func checkOrigin(w http.ResponseWriter, r *http.Request) bool {
 	if origin := r.Header.Get("Origin"); origin != "" {
 		allowed, err := url.Parse(config.Load().NextAuthURL)
 		scheme := "http"
@@ -236,6 +252,12 @@ func HandleAuth(w http.ResponseWriter, r *http.Request) {
 			failure(w, 405, "Use POST to sign out")
 			return
 		}
+		// Review M-16: keep sign-out consistent with the rest of the auth
+		// surface. A browser cross-site POST is rejected; idempotent calls
+		// for an already-invalid session still succeed below.
+		if !checkOrigin(w, r) {
+			return
+		}
 		// Revoke every cookie JWT issued for this user, not just this
 		// browser's copy: signout means "sign out everywhere".
 		if su, e := ReadSession(r, config.Load().Secret()); e == nil {