Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/components/sidebar.tsx

@@ -230,8 +230,10 @@ function SidebarNav({ open, pathname, isAdmin = false }: { open: boolean; pathna
     }
   }
 
-  const dropPage = (target: PageSummary, after: boolean) => {
-    const source = draggedPageRef.current
+  // The source id is passed in from the drop handler (reading the ref inside
+  // an event handler) so the compiler does not treat this helper as reading a
+  // ref during render.
+  const dropPage = (source: string | null, target: PageSummary, after: boolean) => {
     draggedPageRef.current = null
     setPageDrop(null)
     if (!source) return
@@ -310,6 +312,8 @@ function SidebarNav({ open, pathname, isAdmin = false }: { open: boolean; pathna
             key={p.id}
             data-page-id={p.id}
             onDragOver={(e) => {
+              // Event handler, not render: reading the drag source is safe.
+              // eslint-disable-next-line react-hooks/refs
               if (!draggedPageRef.current || draggedPageRef.current === p.id) return
               e.preventDefault()
               e.dataTransfer.dropEffect = 'move'
@@ -322,7 +326,9 @@ function SidebarNav({ open, pathname, isAdmin = false }: { open: boolean; pathna
             onDrop={(e) => {
               e.preventDefault()
               const rect = e.currentTarget.getBoundingClientRect()
-              dropPage(p, e.clientY > rect.top + rect.height / 2)
+              // Event handler, not render: reading the drag source is safe.
+              // eslint-disable-next-line react-hooks/refs
+              dropPage(draggedPageRef.current, p, e.clientY > rect.top + rect.height / 2)
             }}
             style={{ paddingLeft: depth * 12 }}
             className={cn(