Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/authguard/handlers.go

@@ -1,7 +1,9 @@
 package authguard
 
 import (
+	"database/sql"
 	"encoding/json"
+	"errors"
 	"github.com/andrew/go-computer/internal/auth"
 	"github.com/andrew/go-computer/internal/config"
 	"github.com/andrew/go-computer/internal/db"
@@ -11,6 +13,11 @@ import (
 	"time"
 )
 
+// errLastAdmin is the transactional refusal to remove the final
+// administrator (review H-4). It is raised inside the locked transaction so
+// the count and the update cannot be interleaved by a concurrent demotion.
+var errLastAdmin = errors.New("at least one administrator must remain")
+
 func HandleAdminListUsers(w http.ResponseWriter, r *http.Request) {
 	// COALESCE(email,'') (review COR-8): NOT LIKE evaluates to NULL for the
 	// NULL emails OIDC-sourced accounts can carry, which hid them from the
@@ -43,21 +50,46 @@ func HandleAdminPatchUser(w http.ResponseWriter, r *http.Request) {
 		handlers.WriteJSON(w, 404, handlers.Error{Error: "Not found"})
 		return
 	}
-	// Review SEC-11: an installation must keep at least one administrator.
+	// Review SEC-11/H-4: an installation must keep at least one administrator.
 	// Self-demotion is already refused; this closes the "demote the last
-	// other admin" path.
+	// other admin" path. The role re-read, count and update all run in ONE
+	// transaction serialized by an advisory lock, so two admins demoting
+	// each other concurrently can no longer both observe admins == 2 and
+	// leave zero. The pre-transaction role read above only picks the audit
+	// message; the decision uses the locked value.
 	if b.Role == "USER" && target.Role == "ADMIN" {
-		var admins int
-		if e := d.QueryRowContext(r.Context(), `SELECT count(*) FROM "User" WHERE role='ADMIN' AND COALESCE(email,'') NOT LIKE '%@example.com'`).Scan(&admins); e != nil {
-			handlers.WriteJSON(w, 500, handlers.Error{Error: "Unable to change role"})
-			return
-		}
-		if admins <= 1 {
-			handlers.WriteJSON(w, 400, handlers.Error{Error: "At least one administrator must remain"})
-			return
-		}
+		e = db.Transaction(r.Context(), d, func(tx *sql.Tx) error {
+			if _, e := tx.ExecContext(r.Context(), `SELECT pg_advisory_xact_lock(927439)`); e != nil {
+				return e
+			}
+			var current string
+			if e := tx.QueryRowContext(r.Context(), `SELECT role FROM "User" WHERE id=$1`, b.UserID).Scan(&current); e != nil {
+				return e
+			}
+			if current == "ADMIN" {
+				var admins int
+				if e := tx.QueryRowContext(r.Context(), `SELECT count(*) FROM "User" WHERE role='ADMIN' AND COALESCE(email,'') NOT LIKE '%@example.com'`).Scan(&admins); e != nil {
+					return e
+				}
+				if admins <= 1 {
+					return errLastAdmin
+				}
+			}
+			_, e := tx.ExecContext(r.Context(), `UPDATE "User" SET role=$1,"updatedAt"=now() WHERE id=$2`, b.Role, b.UserID)
+			return e
+		})
+	} else {
+		e = repo.SetRole(r.Context(), b.UserID, b.Role)
 	}
-	if e := repo.SetRole(r.Context(), b.UserID, b.Role); e != nil {
+	if errors.Is(e, sql.ErrNoRows) {
+		handlers.WriteJSON(w, 404, handlers.Error{Error: "Not found"})
+		return
+	}
+	if errors.Is(e, errLastAdmin) {
+		handlers.WriteJSON(w, 400, handlers.Error{Error: "At least one administrator must remain"})
+		return
+	}
+	if e != nil {
 		handlers.WriteJSON(w, 500, handlers.Error{Error: "Unable to change role"})
 		return
 	}