Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/components/add-bookmark-dialog.tsx

@@ -6,7 +6,7 @@ import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Textarea } from '@/components/ui/textarea'
 import { Badge } from '@/components/ui/badge'
-import { Link2, Loader2, Plus, X } from 'lucide-react'
+import { Link2, Plus, X } from 'lucide-react'
 import { toast } from 'sonner'
 import { invalidateReference } from '@/lib/reference-data'
 
@@ -24,7 +24,6 @@ export function AddBookmarkDialog({ open, onClose, onCreated }: Props) {
   const [dueDate, setDueDate] = useState('')
   const [kanban, setKanban] = useState('INBOX')
   const [loading, setLoading] = useState(false)
-  const [fetching, setFetching] = useState(false)
   const [tags, setTags] = useState<{ id: string; name: string; color: string }[]>([])
   const [allTags, setAllTags] = useState<any[]>([])
   const [newTagName, setNewTagName] = useState('')
@@ -37,20 +36,9 @@ export function AddBookmarkDialog({ open, onClose, onCreated }: Props) {
     }
   }, [open])
 
-  const fetchPreview = useCallback(async () => {
-    if (!url) return
-    setFetching(true)
-    try {
-      const res = await fetch(`/api/preview?url=${encodeURIComponent(url)}`)
-      if (res.ok) {
-        const data = await res.json()
-        if (data?.ogTitle && !title) setTitle(data.ogTitle)
-        if (data?.ogDescription && !description) setDescription(data.ogDescription)
-      }
-    } catch { /* ignore */ }
-    setFetching(false)
-  }, [url, title, description])
-
+  // Review M-10: no client-side preview fetch. The server fetches preview
+  // metadata once during create (and fills title/description defaults), so a
+  // blur followed by Save no longer spends the preview budget twice.
   const handleSubmit = useCallback(async () => {
     if (!url) { toast.error('URL is required'); return }
     setLoading(true)
@@ -111,9 +99,7 @@ export function AddBookmarkDialog({ open, onClose, onCreated }: Props) {
                 placeholder="https://..."
                 value={url}
                 onChange={(e: React.ChangeEvent<HTMLInputElement>) => setUrl(e.target.value)}
-                onBlur={fetchPreview}
               />
-              {fetching && <Loader2 className="absolute right-3 top-1/2 -translate-y-1/2 h-4 w-4 animate-spin text-muted-foreground" />}
             </div>
           </div>
           <div>