Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/app/(app)/calendar/client.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useState, useEffect, useCallback, useMemo } from 'react'
+import { useState, useEffect, useCallback, useMemo, useRef } from 'react'
 import { Button } from '@/components/ui/button'
 import { BookmarkCard } from '@/components/bookmark-card'
 import { BookmarkDetailSheet } from '@/components/bookmark-detail-sheet'
@@ -11,11 +11,16 @@ import { Input } from '@/components/ui/input'
 import { toast } from 'sonner'
 import { fetchBookmarks } from '@/lib/bookmarks'
 
-const INITIAL_DATE = new Date(2026, 9, 1)
+// Review L-4: a fixed, obviously-not-current placeholder. The real month and
+// today are set after mount (to avoid an SSR/client hydration mismatch), and
+// the calendar renders a skeleton until then instead of briefly presenting
+// this epoch as the current month.
+const INITIAL_DATE = new Date(2000, 0, 1)
 
 export function CalendarClient() {
   const [currentMonth, setCurrentMonth] = useState<Date>(INITIAL_DATE)
   const [today, setToday] = useState<Date>(INITIAL_DATE)
+  const [ready, setReady] = useState(false)
   const [bookmarks, setBookmarks] = useState<Bookmark[]>([])
   const [selectedDay, setSelectedDay] = useState<Date | null>(null)
   const [selectedBookmark, setSelectedBookmark] = useState<Bookmark | null>(null)
@@ -38,18 +43,25 @@ export function CalendarClient() {
   }, [shareQuery])
 
   useEffect(() => {
-    const timer = setTimeout(() => { const now = new Date(); setCurrentMonth(now); setToday(now) }, 0)
+    const timer = setTimeout(() => { const now = new Date(); setCurrentMonth(now); setToday(now); setReady(true) }, 0)
     return () => clearTimeout(timer)
   }, [])
 
+  // Review M-11: bookmark-change events and slow initial loads can overlap;
+  // only the newest pass may publish its data.
+  const loadSeq = useRef(0)
   const load = useCallback(async () => {
+    const seq = ++loadSeq.current
     setLoading(true)
     try {
       const [mine, shared, dates] = await Promise.all([fetchBookmarks(), fetchBookmarks(new URLSearchParams({ shared: 'true' })), fetch('/api/shared-dates')])
+      if (seq !== loadSeq.current) return
+      const sharedDatesJson = dates.ok ? await dates.json() : null
+      if (seq !== loadSeq.current) return
       setBookmarks([...mine, ...shared])
-      if (dates.ok) setSharedDates(await dates.json())
-    } catch { toast.error('Could not load calendar') }
-    finally { setLoading(false) }
+      if (sharedDatesJson) setSharedDates(sharedDatesJson)
+    } catch { if (seq === loadSeq.current) toast.error('Could not load calendar') }
+    finally { if (seq === loadSeq.current) setLoading(false) }
   }, [])
 
   useEffect(() => { const timer = setTimeout(load, 0); window.addEventListener('computer:bookmarks-changed', load); return () => { clearTimeout(timer); window.removeEventListener('computer:bookmarks-changed', load) } }, [load])
@@ -80,6 +92,18 @@ export function CalendarClient() {
     return bookmarksByDay[key] ?? []
   }, [selectedDay, bookmarksByDay])
 
+  if (!ready) {
+    return (
+      <div className="space-y-6">
+        <div>
+          <h1 className="font-display text-2xl font-bold tracking-tight">Calendar</h1>
+          <p className="text-sm text-muted-foreground mt-1">Bookmarks organized by due date</p>
+        </div>
+        <div className="h-[60vh] animate-pulse rounded-lg border border-border/60 bg-muted/30" aria-label="Loading calendar" />
+      </div>
+    )
+  }
+
   return (
     <div className="space-y-6">
       <div className="flex items-center justify-between">
@@ -151,6 +175,8 @@ export function CalendarClient() {
             <h2 className="font-medium">{format(selectedDay, 'EEEE, MMMM d, yyyy')}</h2>
             <div className="flex gap-2"><Input placeholder="Share date with user…" value={shareQuery} onChange={e => setShareQuery(e.target.value)} /></div>
           </div>
+          {/* Review L-9: sharing a date is broader than the old label said. */}
+          <p className="text-xs text-muted-foreground">Recipients will see your bookmarks due that day, including their notes.</p>
           {shareUsers.map(u => <Button key={u.id} size="sm" variant="outline" onClick={async () => { const res = await fetch('/api/shared-dates', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ date: format(selectedDay, 'yyyy-MM-dd'), recipientIds: [u.id] }) }); if (!res.ok) { toast.error('Could not share date'); return } toast.success('Date shared'); setShareQuery(''); setShareUsers([]); load() }}>Share with {u.name || u.email}</Button>)}
           {sharedDates.filter(s => s.date.slice(0, 10) === format(selectedDay, 'yyyy-MM-dd')).map(s => <div key={s.id} className="flex items-center gap-2 text-xs text-muted-foreground"><span>{s.creator.name || s.creator.email} shared with {s.recipient.name || s.recipient.email}</span><Button size="xs" variant="ghost" onClick={async () => { const res = await fetch(`/api/shared-dates/${s.id}`, { method: 'DELETE' }); if (!res.ok) { toast.error('Only the owner can stop sharing'); return } load() }}>Stop sharing</Button></div>)}
           {selectedBookmarks.length === 0 ? (