Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

internal/oidc/provider.go

@@ -22,7 +22,11 @@ import (
 // Settings page and the login page read to decide whether to show the
 // "Sign in with Authelia" button.
 //
-//	GET /api/auth/oidc/status  ->  {enabled, issuerSet, clientIdSet, clientSecretSet, issuer}
+//	GET /api/auth/oidc/status  ->  {enabled, issuerSet, clientIdSet, clientSecretSet}
+//
+// Review L-7: the issuer URL is deliberately NOT public. It is usually a
+// public hostname, but an internal one would become an information leak; the
+// authenticated settings surface can expose it when one exists.
 func HandleStatus(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-store")
 	if r.Method != http.MethodGet {
@@ -38,7 +42,6 @@ func HandleStatus(w http.ResponseWriter, r *http.Request) {
 		"issuerSet":       s.IssuerSet,
 		"clientIdSet":     s.ClientIDSet,
 		"clientSecretSet": s.ClientSecretSet,
-		"issuer":          s.Issuer,
 	})
 }