Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/components/top-bar.tsx

@@ -18,6 +18,7 @@ import {
 import { useTheme } from 'next-themes'
 import { useMounted } from '@/components/client-only'
 import { ACTIVE_PAGE_CHANGED } from '@/lib/pages'
+import { resetReferenceCache } from '@/lib/reference-data'
 
 // Notion keeps the top bar minimal: a breadcrumb path on the left, a subtle
 // Quick Find pill, and ghost icon buttons on the right.
@@ -47,6 +48,25 @@ export function TopBar({ user, alerts, onDismissAlert, onAddBookmark, onToggleSi
   const mounted = useMounted()
   const { theme, setTheme } = useTheme()
   const [activePageTitle, setActivePageTitle] = useState<string | null>(null)
+  // Review L-5: never prompt for notification permission on mount. Browsers
+  // increasingly ignore prompts without a user gesture, and the prompt was
+  // intrusive on every first load. The alert bell exposes an explicit action;
+  // permission is read when that panel opens (null until then, so the action
+  // never renders on the server or before the user interacts).
+  const [notificationPermission, setNotificationPermission] = useState<NotificationPermission | 'unsupported' | null>(null)
+
+  const toggleAlerts = () => {
+    setShowAlerts(!showAlerts)
+    setNotificationPermission(typeof Notification === 'undefined' ? 'unsupported' : Notification.permission)
+  }
+
+  const enableNotifications = async () => {
+    if (typeof Notification === 'undefined') return
+    const permission = await Notification.requestPermission()
+    setNotificationPermission(permission)
+    if (permission === 'granted') toast.success('Desktop alerts enabled')
+    else if (permission === 'denied') toast.error('Desktop alerts are blocked in your browser settings')
+  }
 
   // The pages workspace announces the open page so breadcrumbs can show it.
   // The title only renders on /pages, so route changes need no reset effect.
@@ -88,6 +108,7 @@ export function TopBar({ user, alerts, onDismissAlert, onAddBookmark, onToggleSi
     if (!revoked) {
       toast.error('Signed out on this device, but global revocation failed — other sessions may remain signed in until the backend recovers.')
     }
+    resetReferenceCache()
     void signOut({ redirectTo: '/login' })
   }
 
@@ -142,7 +163,7 @@ export function TopBar({ user, alerts, onDismissAlert, onAddBookmark, onToggleSi
       </Button>
 
       <div className="relative shrink-0" id="topbar-alerts">
-        <Button variant="ghost" size="icon-sm" onClick={() => setShowAlerts(!showAlerts)}>
+        <Button variant="ghost" size="icon-sm" onClick={toggleAlerts}>
           <Bell className="h-4 w-4" />
           {(alerts?.length ?? 0) > 0 && (
             <span className="absolute -top-0.5 -right-0.5 flex h-4 w-4 items-center justify-center rounded-full bg-destructive text-[10px] text-destructive-foreground">
@@ -153,6 +174,11 @@ export function TopBar({ user, alerts, onDismissAlert, onAddBookmark, onToggleSi
         {showAlerts && (
           <div className="absolute right-0 top-full mt-2 w-80 rounded-lg border bg-card p-2 shadow-lg z-50">
             <p className="px-2 py-1 text-xs font-medium text-muted-foreground">Alerts</p>
+            {notificationPermission === 'default' && (
+              <Button variant="outline" size="sm" className="mx-2 mb-1 w-[calc(100%-1rem)]" onClick={enableNotifications}>
+                Enable desktop alerts
+              </Button>
+            )}
             {(alerts?.length ?? 0) === 0 && (
               <p className="px-2 py-4 text-sm text-center text-muted-foreground">No pending alerts</p>
             )}