Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/markdown/markdown.go

@@ -43,6 +43,21 @@ func BookmarkDocument(b db.Object) string {
 	}
 	return out + "\n" + strings.TrimSpace(text(b, "notes")) + "\n"
 }
+
+// linkDestination wraps a URL in a CommonMark angle-bracket destination
+// (review L-11). Parentheses (and the whitespace validURL accepts) no longer
+// terminate the link, and the two characters that cannot appear unescaped
+// inside <...> are percent-encoded.
+func linkDestination(raw string) string {
+	escaped := strings.NewReplacer(
+		"<", "%3C",
+		">", "%3E",
+		"\r", "%0D",
+		"\n", "%0A",
+	).Replace(raw)
+	return "<" + escaped + ">"
+}
+
 func PageDocument(p db.Object) string {
 	out := "# " + text(p, "title") + "\n\n" + strings.TrimSpace(text(p, "content")) + "\n"
 	if a, ok := p["bookmarks"].([]any); ok && len(a) > 0 {
@@ -60,7 +75,7 @@ func PageDocument(p db.Object) string {
 			if len(rs) > 160 {
 				desc = string(rs[:160])
 			}
-			out += "- [" + title + "](" + text(b, "url") + ")"
+			out += "- [" + title + "](" + linkDestination(text(b, "url")) + ")"
 			if desc != "" {
 				out += " — " + desc
 			}

internal/markdown/markdown_test.go

@@ -0,0 +1,27 @@
+package markdown
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/andrew/go-computer/internal/db"
+)
+
+// Review L-11: link destinations are wrapped and escaped so parentheses or
+// angle brackets in a bookmark URL cannot terminate or extend the link.
+func TestPageDocumentEscapesLinkDestinations(t *testing.T) {
+	out := PageDocument(db.Object{
+		"title":   "Links",
+		"content": "",
+		"bookmarks": []any{
+			map[string]any{"bookmark": map[string]any{
+				"title": "Odd",
+				"url":   "https://example.com/a(b)?x=<y>",
+			}},
+		},
+	})
+	want := "[Odd](<https://example.com/a(b)?x=%3Cy%3E>)"
+	if !strings.Contains(out, want) {
+		t.Fatalf("link destination not escaped:\n%s", out)
+	}
+}