Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/components/app-shell.tsx

@@ -7,6 +7,7 @@ import { Sidebar } from '@/components/sidebar'
 import { TopBar } from '@/components/top-bar'
 import { AddBookmarkDialog } from '@/components/add-bookmark-dialog'
 import { QuickFind } from '@/components/quick-find'
+import { resetReferenceCache } from '@/lib/reference-data'
 
 export type Bookmark = {
   id: string
@@ -74,6 +75,8 @@ export function AppShell({ children }: { children: React.ReactNode }) {
     try {
       await fetch('/api/admin/view-as', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ userId: null }) })
     } catch { /* navigating to /admin surfaces any persistent failure */ }
+    // Review L-6: leaving view-as restores the admin identity.
+    resetReferenceCache()
     window.location.href = '/admin'
   }, [])
 
@@ -104,12 +107,8 @@ export function AppShell({ children }: { children: React.ReactNode }) {
     return () => clearInterval(interval)
   }, [session?.user])
 
-  // Request notification permission
-  useEffect(() => {
-    if (typeof Notification !== 'undefined' && Notification.permission === 'default') {
-      Notification.requestPermission()
-    }
-  }, [])
+  // Review L-5: notification permission is requested from the alert bell on
+  // an explicit user action (top-bar.tsx), not on every app mount.
 
   const refreshPage = useCallback(() => {
     window.dispatchEvent(new Event('computer:bookmarks-changed'))