Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/handlers/signals.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"github.com/andrew/go-computer/internal/db"
+	"github.com/andrew/go-computer/internal/outbound"
 	"github.com/andrew/go-computer/internal/signals"
 	"net/http"
 	"strings"
@@ -42,6 +43,15 @@ func HandleSignalsCreate(w http.ResponseWriter, r *http.Request) {
 		// on different connections and leak the lock) — and answer 409 while
 		// it is held. The 45-second cap keeps the pass inside the server's
 		// WriteTimeout so it cannot be cut off mid-mutation.
+		// Review M-2: a manual check is a 45-second outbound pass; it draws
+		// from the same budget as previews/IMAP/CardDAV so repeated clicks
+		// cannot multiply concurrent mailbox connections.
+		release, retry, ok := outbound.Reserve("signals:"+user(r), 10, time.Minute)
+		if !ok {
+			outboundBusy(w, retry)
+			return
+		}
+		defer release()
 		ctx := r.Context()
 		leaseKey := "signal-poll:" + user(r)
 		conn, e := database(r).Conn(ctx)