See also: https://www.sogo.nu
Don't re-download the file for virustotal + opening attachment. Browser caching would probably work. Mega.nz-style 'download to browser storage, then download from localhost' would probably always work, yet it might need additional browser permissions, and is overall unclean.
How is the (layman) user need to know where folders disappeared? Show a 'More…' or something at the bottom of the folder list?
when displaying time, also display tz, (23:59 UTC+1 (in gray?)), so user can be affirmed.
Additional configuration option to automatically use instances from /api/instances.
Prioritize the user-configured list, deduplicate the /api/instances one (to avoid trying one instance twice, listed in both user-configured and discovery list).
Sort by 'is listed in docs', then by a value of non-blocked 'uptime' (optionally the value is increased by added length of operation (preferring 99% 2y instance to 100% 2d)).
If favour-old-instance is not adopted, ban all instances newer than 30d (the ones not in docs listing). This is to avoid a new instance getting a friendly ddos on first launch, giving the hoster the impression that Bibliogram is useless.
This would also need a configuration option of advertising assistant availability for both cached and new requests.