Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/app/(app)/bookmarks/client.tsx

@@ -18,17 +18,16 @@ export function BookmarksClient({ initialSearch = null, initialOpen = null }: {
   const [selected, setSelected] = useState<Bookmark | null>(null)
   // Review CR-04: the sheet must receive the CURRENT row after mutations —
   // its conflict banner ("Load latest version") and successful saves need
-  // the fresh version, or the next save would send a stale base.
-  const selectedRef = useRef<Bookmark | null>(null)
-  selectedRef.current = selected
+  // the fresh version, or the next save would send a stale base. Depend on
+  // `selected` instead of writing a ref during render.
   const refreshSelected = useCallback(async () => {
-    const id = selectedRef.current?.id
+    const id = selected?.id
     if (!id) return
     try {
       const res = await fetch(`/api/bookmarks/${encodeURIComponent(id)}`, { cache: 'no-store' })
       if (res.ok) setSelected(await res.json())
     } catch { /* the list load surfaces errors */ }
-  }, [])
+  }, [selected])
   const [tab, setTab] = useState<'mine' | 'shared'>('mine')
   const [sortField, setSortField] = useState<'title' | 'updatedAt' | 'kanbanStatus'>('updatedAt')
   const [sortDir, setSortDir] = useState<'asc' | 'desc'>('desc')