Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/app/api/[...path]/route.ts

@@ -96,6 +96,11 @@ async function proxy(request: NextRequest) {
     }
     const response = await backendFetch(request.nextUrl.pathname + request.nextUrl.search, {
       method: request.method, headers, body,
+      // Go's slowest handlers (IMAP/signal checks) legitimately run ~45s;
+      // keep the proxy budget inside Go's 60s WriteTimeout while still
+      // bounding a blackholed connection. fast server-component calls keep
+      // backendFetch's 10s default.
+      signal: AbortSignal.timeout(55_000),
     })
     const outgoing = new Headers()
     for (const name of ['content-type', 'content-disposition', 'set-cookie', 'x-next-cursor']) {
@@ -105,8 +110,14 @@ async function proxy(request: NextRequest) {
     outgoing.set('Cache-Control', 'no-store')
     return new Response(response.body, { status: response.status, headers: outgoing })
   } catch (error) {
+    // Review M-7: a timed-out backend is a 504 so callers can distinguish it
+    // from an unreachable one (502).
+    const timedOut = (error as { status?: unknown })?.status === 504
     console.error('Go API unavailable', error)
-    return Response.json({ error: 'API unavailable' }, { status: 502 })
+    return Response.json(
+      { error: timedOut ? 'API timed out' : 'API unavailable' },
+      { status: timedOut ? 504 : 502 },
+    )
   }
 }
 export { proxy as GET, proxy as HEAD, proxy as POST, proxy as PUT, proxy as PATCH, proxy as DELETE }

web/app/api/auth/login/route.ts

@@ -1,24 +0,0 @@
-export const dynamic = 'force-dynamic'
-import { NextResponse } from 'next/server'
-import { signIn } from '@/auth'
-
-export async function POST(req: Request) {
-  const expectedOrigin = new URL(process.env.NEXTAUTH_URL || req.url).origin
-  if (req.headers.get('origin') !== expectedOrigin) {
-    return NextResponse.json({ error: 'Invalid request origin' }, { status: 403 })
-  }
-  if (req.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json') {
-    return NextResponse.json({ error: 'Content-Type must be application/json' }, { status: 415 })
-  }
-  try {
-    const body = await req.json()
-    const result = await signIn('credentials', {
-      email: body.email,
-      password: body.password,
-      redirect: false,
-    })
-    return NextResponse.json({ ok: true, url: result })
-  } catch {
-    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
-  }
-}