Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.production.example

@@ -68,21 +68,6 @@ NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxx
 # first checkout, so going live is ONLY the three values above (live keys + live
 # webhook secret). Optionally pre-create the catalog: node scripts/stripe-setup.mjs
 
-# === PAYPAL (optional — alternative subscription checkout) ===
-# Landlords can pay for their plan with PayPal alongside Stripe. Leave blank to
-# hide the PayPal buttons. Create a REST app at https://developer.paypal.com and
-# set PAYPAL_ENVIRONMENT=live for production. Create a webhook there pointing to
-# <APP_URL>/api/paypal/webhook and put its id in PAYPAL_WEBHOOK_ID. Generate the
-# plan IDs with `node scripts/paypal-setup-plans.mjs`.
-PAYPAL_CLIENT_ID=
-PAYPAL_SECRET=
-PAYPAL_ENVIRONMENT=live
-PAYPAL_WEBHOOK_ID=
-PAYPAL_PRO_MONTHLY_PLAN_ID=
-PAYPAL_PRO_YEARLY_PLAN_ID=
-PAYPAL_LANDLORD_MONTHLY_PLAN_ID=
-PAYPAL_LANDLORD_YEARLY_PLAN_ID=
-
 # === AI (OpenAI) ===
 OPENAI_API_KEY=sk-xxx
 
@@ -103,17 +88,17 @@ QBO_ENVIRONMENT=production
 XERO_CLIENT_ID=
 XERO_CLIENT_SECRET=
 
-# === E-SIGNATURE (optional — DocuSign / Dropbox Sign) ===
-# Leave blank to hide/disable a provider on the lease page. Configure the
-# provider callbacks to point at this app:
-#   Dropbox Sign callback → <APP_URL>/api/esign/dropbox_sign/webhook
-#   DocuSign Connect       → <APP_URL>/api/esign/docusign/webhook
-# In production set DROPBOX_SIGN_TEST_MODE=false to send legally-binding docs.
-DROPBOX_SIGN_API_KEY=
+# === E-SIGNATURE (optional — per-landlord: each connects their OWN account) ===
+# DocuSign: register ONE DocuSign app; landlords connect their own account via
+# OAuth from Settings → Integrations. Register this redirect URI in the app:
+#   <APP_URL>/api/esign/docusign/callback
+# Use account.docusign.com in production (account-d.docusign.com for demo).
+DOCUSIGN_CLIENT_ID=
+DOCUSIGN_CLIENT_SECRET=
+DOCUSIGN_OAUTH_BASE=account.docusign.com
+# Dropbox Sign: no server credentials — landlords paste their own API key and set
+# their account callback URL to <APP_URL>/api/esign/dropbox_sign/webhook.
 DROPBOX_SIGN_TEST_MODE=false
-DOCUSIGN_ACCESS_TOKEN=
-DOCUSIGN_ACCOUNT_ID=
-DOCUSIGN_BASE_URI=https://www.docusign.net
 
 # === APP (NEXT_PUBLIC_* — also set as Build Variables) ===
 NEXT_PUBLIC_APP_URL=https://propertymanagement.network
@@ -128,6 +113,14 @@ GOOGLE_SITE_VERIFICATION=
 NEXT_PUBLIC_UMAMI_SRC=https://fickanalytics.phluit.net/script.js
 NEXT_PUBLIC_UMAMI_WEBSITE_ID=4066c359-596f-4d0e-9636-c035c2adfbe8
 
+# === ERROR MONITORING (Sentry) ===
+# DSN from your Sentry project (public — inlined in the browser bundle, so set
+# it as a Build Variable too). Error monitoring is disabled until this is set.
+NEXT_PUBLIC_SENTRY_DSN=
+# Build-time secret: uploads source maps so prod stack traces are un-minified.
+# Sentry → Settings → Auth Tokens. Set as a Build Variable; leave blank to skip.
+SENTRY_AUTH_TOKEN=
+
 # === MAPS / GEOCODING (OpenStreetMap — free, no key) ===
 # Addresses are geocoded via OpenStreetMap Nominatim; the map uses Leaflet + OSM
 # tiles. No API key or billing. Nominatim REQUIRES an identifying User-Agent —