Address code review findings across API, web and deployment

High severity:
- wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup
- bucket public rate limits on effective client IP, add per-bookmark budget,
  and forward the signed browser identity from the share page
- disable first-run bootstrap in server deployments and document seeding
- serialize last-admin demotion in one advisory-locked transaction

Medium/low:
- cap and batch share recipient inserts
- add a shared outbound budget for preview/CardDAV/IMAP/signal work
- pin CardDAV dials to 443 and bound IMAP logout
- fix rightward kanban column drags and normalize cards on column delete
- classify backend outages in auth guards, add request timeouts and an
  error boundary, remove the dead login route, surface throttling
- enforce pinned/unpinned page reorder grouping server-side
- avoid preview work for stale bookmark versions; drop duplicate dialog fetch
- sequence-guard collection/tag/calendar/quick-find loads
- validate property config and fix MULTI_SELECT/DATE filter inputs
- document index maintenance; apply same-origin check to sign-out
- trim signup names, unique shared dates and kanban keys (migration 010),
  reset reference cache on identity changes, hide OIDC issuer, return 413
  for oversized direct bodies, escape Markdown link destinations
- remove dead template files and duplicate test helper

Verified with go build/vet, full PostgreSQL race suite, db convergence,
tsc, both ESLint configs and a Next production build.

web/lib/api.ts

@@ -24,6 +24,21 @@ export const signClientIP = (ip: string): { ts: string; sig: string } => {
   return { ts, sig: createHmac('sha256', secret).update(`${ip}|${ts}`).digest('hex') }
 }
 
+// Review H-2: server-rendered pages that call Go directly (the public share
+// page) must forward the same attested identity as the data proxy, otherwise
+// every rendered share view lands in the web container's bucket. Returns an
+// empty object when there is no trusted proxy or no usable header.
+export const forwardedClientHeaders = (source: Headers): Record<string, string> => {
+  const ip = observedClientIP(source)
+  if (!ip) return {}
+  const { ts, sig } = signClientIP(ip)
+  return {
+    'x-computer-client-ip': ip,
+    'x-computer-client-ts': ts,
+    'x-computer-client-sig': sig,
+  }
+}
+
 // Only this trusted Next server signs assertions. The browser never chooses a
 // user ID, and Go still re-reads roles/ownership on every request. The typ
 // claim binds the token to the Bearer channel; Go rejects it as a cookie and
@@ -55,5 +70,18 @@ export async function backendFetch(path: string, init: RequestInit = {}) {
   }
   const viewAs = (await cookies()).get('computer_view_as')?.value
   if (viewAs) headers.set('Cookie', `computer_view_as=${encodeURIComponent(viewAs)}`)
-  return fetch(`${apiBase()}${path}`, { ...init, headers, cache: 'no-store' })
+  // Review M-7: bound server-side calls so a hung or blackholed backend
+  // cannot stall a route/server component until the platform timeout.
+  // Callers may provide their own signal to override this default.
+  const signal = init.signal ?? AbortSignal.timeout(10_000)
+  try {
+    return await fetch(`${apiBase()}${path}`, { ...init, headers, cache: 'no-store', signal })
+  } catch (error) {
+    if (error instanceof Error && error.name === 'TimeoutError') {
+      const timeout = new Error('Backend request timed out') as Error & { status?: number }
+      timeout.status = 504
+      throw timeout
+    }
+    throw error
+  }
 }

web/lib/auth-guard.ts

@@ -1,6 +1,33 @@
 import { backendFetch } from '@/lib/api'
+
 export const VIEW_AS_COOKIE = 'computer_view_as'
 export type AuthUser = { id: string; name?: string | null; email?: string | null; image?: string | null; role: 'USER' | 'ADMIN'; actingAdminId?: string }
-async function account() { const res = await backendFetch('/api/me'); return res.ok ? res.json() : null }
+
+// Review M-6: Go distinguishes "no session" (401) from backend degradation
+// (503). Collapsing both to null sent an authenticated admin to /login during
+// a database outage, as if their credentials had failed. Only 401 means
+// signed out; anything else is an outage the UI must show as such.
+export class BackendUnavailableError extends Error {
+  status: number
+  constructor(status: number) {
+    super('Backend unavailable')
+    this.name = 'BackendUnavailableError'
+    this.status = status
+  }
+}
+
+async function account() {
+  let res: Response
+  try {
+    res = await backendFetch('/api/me')
+  } catch (error) {
+    const status = (error as { status?: unknown })?.status
+    throw new BackendUnavailableError(typeof status === 'number' ? status : 502)
+  }
+  if (res.status === 401) return null
+  if (!res.ok) throw new BackendUnavailableError(res.status)
+  return res.json()
+}
+
 export async function getRealUser(): Promise<AuthUser | null> { return (await account())?.user ?? null }
 export async function getAuthUser(): Promise<AuthUser | null> { const me = await account(); return me ? { ...me.effectiveUser, ...(me.viewingAs ? { actingAdminId: me.user.id } : {}) } : null }

web/lib/reference-data.ts

@@ -19,6 +19,13 @@ export function invalidateReference(kind: ReferenceKind) {
   cache.delete(kind)
 }
 
+// Review L-6: the cache is module-global, not scoped to the authenticated
+// identity. An in-tab identity change (sign-out, view-as enter/exit) must not
+// serve the previous user's me/tags/contacts for up to 30 seconds.
+export function resetReferenceCache() {
+  cache.clear()
+}
+
 // Resolves to null on any failure; failures are not kept cached.
 export function fetchReference<T = unknown>(kind: ReferenceKind): Promise<T | null> {
   const hit = cache.get(kind)

web/lib/types.ts

@@ -1,28 +0,0 @@
-export type Expense = {
-  id: string
-  amount: number
-  category: string
-  description: string
-  date: Date
-}
-
-export type ExpenseFormData = Omit<Expense, 'id' | 'date'> & {
-  date: string
-}
-
-export const EXPENSE_CATEGORIES = [
-  'Food',
-  'Transportation',
-  'Housing',
-  'Utilities',
-  'Entertainment',
-  'Healthcare',
-  'Shopping',
-  'Education',
-  'Other'
-] as const
-
-export type DateRange = {
-  from: Date | undefined
-  to: Date | undefined
-}

web/lib/utils.ts

@@ -4,11 +4,3 @@ import { twMerge } from "tailwind-merge"
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs))
 }
-
-export function formatDuration(seconds: number): string {
-  const hours = Math.floor(seconds / 3600)
-  const minutes = Math.floor((seconds % 3600) / 60)
-  const remainingSeconds = seconds % 60
-
-  return `${hours.toString().padStart(2, '0')}:${minutes.toString().padStart(2, '0')}:${remainingSeconds.toString().padStart(2, '0')}`
-}