Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

scripts/server-deploy.sh

@@ -166,6 +166,12 @@ AUTH_SECRET=$(openssl rand -hex 32)
 NEXTAUTH_URL=https://$DOMAIN
 COOKIE_SECURE=1
 ADMIN_EMAILS=
+# Review H-1: nginx overwrites X-Real-IP, so the trusted Next server may sign
+# and forward the browser identity for per-client rate limiting.
+TRUSTED_PROXY=1
+# Review H-3: do not let the first visitor after DNS goes live claim the
+# instance. Provision the operator with ADMIN_EMAILS + `make seed` (below).
+ALLOW_BOOTSTRAP_SIGNUP=0
 POSTGRES_VOLUME=computer_pgdata
 POSTGRES_VOLUME_EXTERNAL=false
 APP_HOST_PORT=$APP_HOST_PORT
@@ -181,6 +187,14 @@ else
   # Pin the host ports even on an .env created before port overrides existed.
   grep -q '^APP_HOST_PORT=' .env || echo "APP_HOST_PORT=$APP_HOST_PORT" >> .env
   grep -q '^WEB_HOST_PORT=' .env || echo "WEB_HOST_PORT=$WEB_HOST_PORT" >> .env
+  # Review H-1: every server deployment terminates TLS at the bundled nginx,
+  # which pins X-Real-IP. Upgrade older .env files that predate the switch so
+  # proxied users stop sharing one rate-limit bucket.
+  grep -q '^TRUSTED_PROXY=' .env || echo "TRUSTED_PROXY=1" >> .env
+  # Review H-3: also stop later deploys from re-opening public bootstrap on a
+  # .env that predates the flag. Operators who deliberately want it can set
+  # ALLOW_BOOTSTRAP_SIGNUP=1 explicitly.
+  grep -q '^ALLOW_BOOTSTRAP_SIGNUP=' .env || echo "ALLOW_BOOTSTRAP_SIGNUP=0" >> .env
   url="$(sed -n 's/^NEXTAUTH_URL=//p' .env | tail -n1)"
   secure="$(sed -n 's/^COOKIE_SECURE=//p' .env | tail -n1)"
   [ "$url" = "https://$DOMAIN" ] || log "warning: NEXTAUTH_URL is '$url', expected 'https://$DOMAIN'"
@@ -351,4 +365,14 @@ if [ -n "$REVISION" ]; then
   printf '%s\n' "$REVISION" > "$REMOTE_DIR/.deployed-revision"
   log "Recorded deployed revision $REVISION"
 fi
+# Review H-3: with bootstrap disabled, nobody is administrator until the
+# operator provisions one. Say so loudly instead of leaving a fresh instance
+# without an owner.
+if [ "$(sed -n 's/^ALLOW_BOOTSTRAP_SIGNUP=//p' .env | tail -n1)" = "0" ]; then
+  log "Administrator provisioning is operator-driven (ALLOW_BOOTSTRAP_SIGNUP=0)."
+  log "  1. Add ADMIN_EMAILS=you@example.com to $REMOTE_DIR/.env"
+  log "  2. docker compose up -d app   # reloads ADMIN_EMAILS"
+  log "  3. SEED_EMAIL=you@example.com SEED_PASSWORD='...' make seed"
+  log "Public signup cannot become administrator until an operator exists."
+fi
 log "Server-side deploy complete"