Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/config/config.go

@@ -1,9 +1,11 @@
 package config
 
 import (
+	"fmt"
 	"net/url"
 	"os"
 	"strings"
+	"sync"
 )
 
 // DBURL returns the database connection string, preferring DATABASE_URL and
@@ -76,11 +78,23 @@ func (c *Config) CookieSecure() bool {
 	return err == nil && u.Scheme == "https"
 }
 
+// adminEmailsCache memoizes the parsed ADMIN_EMAILS value by its raw env
+// string (review M-12: IsAdminEmail runs on the auth hot path and re-split
+// and re-lowercased the list on every call). Keying on the raw value keeps
+// t.Setenv-based tests correct without a process-global startup snapshot.
+var adminEmailsCache struct {
+	mu  sync.Mutex
+	raw string
+	out []string
+}
+
 // AdminEmails splits env ADMIN_EMAILS on commas, trims, lowercases.
 func AdminEmails() []string {
 	s := os.Getenv("ADMIN_EMAILS")
-	if s == "" {
-		return nil
+	adminEmailsCache.mu.Lock()
+	defer adminEmailsCache.mu.Unlock()
+	if adminEmailsCache.raw == s {
+		return adminEmailsCache.out
 	}
 	var out []string
 	for _, email := range strings.Split(s, ",") {
@@ -88,6 +102,7 @@ func AdminEmails() []string {
 			out = append(out, email)
 		}
 	}
+	adminEmailsCache.raw, adminEmailsCache.out = s, out
 	return out
 }
 
@@ -111,3 +126,18 @@ func IsAdminEmail(email string) bool {
 func AllowBootstrapSignup() bool {
 	return os.Getenv("ALLOW_BOOTSTRAP_SIGNUP") != "0"
 }
+
+// Validate fails fast on configuration the app cannot use, instead of
+// discovering it on the first request (review M-12).
+func (c *Config) Validate() error {
+	if strings.TrimSpace(c.Secret()) == "" {
+		return fmt.Errorf("AUTH_SECRET (or NEXTAUTH_SECRET) must be set")
+	}
+	if c.NextAuthURL != "" {
+		u, err := url.Parse(c.NextAuthURL)
+		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+			return fmt.Errorf("NEXTAUTH_URL must be an absolute http(s) URL, got %q", c.NextAuthURL)
+		}
+	}
+	return nil
+}

internal/config/config_test.go

@@ -35,6 +35,37 @@ func TestSecretPrecedence(t *testing.T) {
 	}
 }
 
+// Review M-12: fail fast on unusable configuration at startup.
+func TestValidate(t *testing.T) {
+	if err := (&Config{}).Validate(); err == nil {
+		t.Fatal("missing secret passed validation")
+	}
+	if err := (&Config{AuthSecret: "secret", NextAuthURL: "not a url"}).Validate(); err == nil {
+		t.Fatal("relative NEXTAUTH_URL passed validation")
+	}
+	for _, u := range []string{"", "http://localhost:3000", "https://app.example.com"} {
+		if err := (&Config{AuthSecret: "secret", NextAuthURL: u}).Validate(); err != nil {
+			t.Fatalf("valid configuration %q rejected: %v", u, err)
+		}
+	}
+}
+
+// Review M-12: the parsed ADMIN_EMAILS list is memoized but still follows
+// env changes (tests and operator restarts rely on that).
+func TestAdminEmailsTracksEnv(t *testing.T) {
+	t.Setenv("ADMIN_EMAILS", " A@Example.com ,, b@example.com ")
+	if got := AdminEmails(); len(got) != 2 || got[0] != "a@example.com" || got[1] != "b@example.com" {
+		t.Fatalf("unexpected parse: %v", got)
+	}
+	t.Setenv("ADMIN_EMAILS", "")
+	if got := AdminEmails(); len(got) != 0 {
+		t.Fatalf("cache did not follow the env change: %v", got)
+	}
+	if IsAdminEmail("a@example.com") {
+		t.Fatal("stale admin email after env change")
+	}
+}
+
 // Review OPS-01: a dedicated ENCRYPTION_KEY decouples integration-credential
 // encryption from the session signing secret.
 func TestEncryptionSecretPrecedence(t *testing.T) {