Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/auth.ts

@@ -1,4 +1,4 @@
-import NextAuth from 'next-auth'
+import NextAuth, { CredentialsSignin } from 'next-auth'
 import CredentialsProvider from 'next-auth/providers/credentials'
 import jwt from 'jsonwebtoken'
 import { createHmac } from 'node:crypto'
@@ -63,12 +63,16 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
           body: JSON.stringify({ email: credentials.email, password: credentials.password }),
         })
         if (!response.ok) {
-          // Surface Go's 429 so callers can distinguish throttling from bad
-          // credentials (the custom login route maps everything else to 401).
+          // Review M-8: surface Go's 429 as a distinct CredentialsSignin code
+          // so the login UI can say "too many attempts" instead of "invalid
+          // credentials" or "check your connection". Auth.js carries `code`
+          // through to the client's signIn() result. The status field remains
+          // for server-side callers/tests.
           if (response.status === 429) {
-            const retry = response.headers.get('retry-after')
-            const err = new Error(response.status === 429 ? 'Throttled' : 'Unauthorized') as Error & { status?: number; retryAfter?: string }
+            const err = new CredentialsSignin() as CredentialsSignin & { status?: number; retryAfter?: string }
+            err.code = 'throttled'
             err.status = 429
+            const retry = response.headers.get('retry-after')
             if (retry) err.retryAfter = retry
             throw err
           }