Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/app/share/bookmark/[id]/page.tsx

@@ -1,11 +1,19 @@
-import { apiBase } from '@/lib/api'
+import { apiBase, forwardedClientHeaders } from '@/lib/api'
+import { headers } from 'next/headers'
 import { notFound } from 'next/navigation'
 import { PublicBookmarkView } from './client'
 
 export default async function PublicSharePage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
 
-  const response = await fetch(`${apiBase()}/api/public/bookmarks/${encodeURIComponent(id)}`, { cache: 'no-store' })
+  // Review H-2: pass the attested browser identity through to Go. Without it
+  // every server-rendered share view shares the web container's public
+  // rate-limit bucket, so one hot link (or one client) could exhaust it.
+  const response = await fetch(`${apiBase()}/api/public/bookmarks/${encodeURIComponent(id)}`, {
+    cache: 'no-store',
+    headers: forwardedClientHeaders(await headers()),
+    signal: AbortSignal.timeout(10_000),
+  })
   if (!response.ok) notFound()
   const bookmark = await response.json()