Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/http/server.go

@@ -142,16 +142,25 @@ func NewServer(cfg *config.Config, database *db.DB) *http.Server {
 	mux.HandleFunc("DELETE /api/collections/{id}/views/{viewId}", authed(handlers.HandleCollectionViewsDelete))
 
 	// 4.10 Public page (no login)
-	// Review SEC-10: public endpoints get per-IP rate limiting (no auth
-	// context, so no per-user limit). 30 req/min for public bookmark lookup,
-	// 20 req/min for preview (heavier outbound work).
+	// Review SEC-10/H-2: public endpoints get two rate-limit layers keyed on
+	// the EFFECTIVE client identity (signed forwarded browser IP, else the
+	// direct peer), never the shared Next container address:
+	//   - per client: 30 public lookups/min, 20 previews/min;
+	//   - per public bookmark id: 120/min, so one hot shared link cannot
+	//     exhaust the instance-wide budget.
+	// Preview is rate limited AFTER auth: unauthenticated requests must not
+	// consume the bucket and deny previews to signed-in users.
 	publicBookmarkLimiter := auth.NewLimiterStore()
+	publicBookmarkIDLimiter := auth.NewLimiterStore()
 	previewLimiter := auth.NewLimiterStore()
 	publicLimit := auth.Limiter(publicBookmarkLimiter, 30, time.Minute)
+	publicIDLimit := auth.LimiterKeyed(publicBookmarkIDLimiter, 120, time.Minute, func(r *http.Request) string {
+		return "bookmark:" + r.PathValue("id")
+	})
 	previewLimit := auth.Limiter(previewLimiter, 20, time.Minute)
-	mux.HandleFunc("GET /share/bookmark/{id}", publicLimit(handlers.HandlePublicBookmark))
-	mux.HandleFunc("GET /api/public/bookmarks/{id}", publicLimit(handlers.HandlePublicBookmark))
-	mux.HandleFunc("GET /api/preview", previewLimit(authed(handlers.HandlePreview)))
+	mux.HandleFunc("GET /share/bookmark/{id}", publicLimit(publicIDLimit(handlers.HandlePublicBookmark)))
+	mux.HandleFunc("GET /api/public/bookmarks/{id}", publicLimit(publicIDLimit(handlers.HandlePublicBookmark)))
+	mux.HandleFunc("GET /api/preview", authed(previewLimit(handlers.HandlePreview)))
 
 	return &http.Server{
 		Handler:      withDB(database, mux),