Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/instrumentation.ts

@@ -0,0 +1,27 @@
+// Review H-1: the proxy-attested client IP is what gives every browser its
+// own login/signup/public-endpoint rate-limit bucket. It only works when the
+// Next server trusts the proxy that pins X-Real-IP. A TLS deployment without
+// that switch silently puts every client in the web container's bucket, so
+// warn loudly at startup instead of waiting for an outage caused by one
+// caller exhausting the instance limit.
+export async function register() {
+  // Runs for both the Node and Edge runtimes; env diagnostics only apply to
+  // the server process.
+  if (process.env.NEXT_RUNTIME !== 'nodejs') return
+  const url = process.env.NEXTAUTH_URL || ''
+  const trusted = process.env.TRUSTED_PROXY === '1'
+  if (url.startsWith('https://') && !trusted) {
+    console.warn(
+      '[config] NEXTAUTH_URL is HTTPS but TRUSTED_PROXY is not 1. All clients ' +
+        'share the web container rate-limit bucket; set TRUSTED_PROXY=1 when a ' +
+        'proxy in front of web overwrites X-Real-IP (see RUNNING.md).',
+    )
+  }
+  if (trusted && !url.startsWith('https://')) {
+    console.warn(
+      '[config] TRUSTED_PROXY=1 is set for a non-HTTPS NEXTAUTH_URL. Only do ' +
+        'this when the proxy is the sole route to this server; otherwise ' +
+        'clients can spoof X-Real-IP and choose their rate-limit identity.',
+    )
+  }
+}