Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/handlers/collections.go

@@ -306,7 +306,7 @@ func HandleCollectionShare(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	list, e := ids(b, "userIds")
+	list, e := cappedIDs(b, "userIds", maxShareRecipients)
 	if e != nil {
 		respond(w, 0, nil, e)
 		return
@@ -431,7 +431,18 @@ func validatePropertyConfig(typ string, raw any, existing []object) (object, []s
 		}
 		return object{"mode": mode}, nil, nil
 	default:
-		if m, ok := raw.(object); ok && raw != nil && len(m) > 0 {
+		// Review M-13: these types take no configuration. Accept null or an
+		// empty object and reject every other value — silently replacing a
+		// malformed config with {} told the client it had configured
+		// something it had not.
+		if raw == nil {
+			return object{}, nil, nil
+		}
+		m, ok := raw.(object)
+		if !ok {
+			return nil, nil, bad("config must be an object")
+		}
+		if len(m) > 0 {
 			return nil, nil, bad(typ + " properties take no config")
 		}
 		return object{}, nil, nil