Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/components/quick-find.tsx

@@ -5,7 +5,7 @@
 // (new page, add bookmark, toggle theme). Search is read-only; mutations
 // stay on their owning screens.
 
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useRef, useState } from 'react'
 import { useRouter } from 'next/navigation'
 import { useTheme } from 'next-themes'
 import { toast } from 'sonner'
@@ -86,16 +86,23 @@ export function QuickFind({ open, onOpenChange, isAdmin = false, onAddBookmark }
   }, [open])
 
   // Bookmark search hits the API (debounced) because the server matches
-  // notes and URLs too, not just titles.
+  // notes and URLs too, not just titles. Review M-11: requests can still
+  // resolve out of order after the debounce fires, so only the newest
+  // sequence may publish results.
+  const searchSeq = useRef(0)
   useEffect(() => {
     if (!open) return
     const q = query.trim()
     const t = setTimeout(async () => {
-      if (q.length < 2) { setBookmarks([]); return }
+      if (q.length < 2) { searchSeq.current++; setBookmarks([]); return }
+      const seq = ++searchSeq.current
       try {
         const params = new URLSearchParams({ search: q, limit: '6' })
         const res = await fetch(`/api/bookmarks?${params}`)
-        if (res.ok) setBookmarks(((await res.json()) as BookmarkHit[]).slice(0, 6))
+        if (!res.ok || seq !== searchSeq.current) return
+        const rows = (await res.json()) as BookmarkHit[]
+        if (seq !== searchSeq.current) return
+        setBookmarks(rows.slice(0, 6))
       } catch { /* transient; retried on next keystroke */ }
     }, q.length < 2 ? 0 : 200)
     return () => clearTimeout(t)