Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DIGITALOCEAN.md

@@ -94,11 +94,19 @@ docker build \
   --build-arg NEXT_PUBLIC_APP_URL=https://<your-domain> \
   --build-arg NEXT_PUBLIC_APP_NAME="Property Management Network" \
   --build-arg NEXT_PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAADuDQverznfv1a60 \
+  --build-arg NEXT_PUBLIC_SENTRY_DSN=<your-sentry-dsn> \
+  --build-arg SENTRY_AUTH_TOKEN=<optional-for-source-maps> \
   -t $REG/property-management-network:latest .
 
 docker push $REG/property-management-network:latest
 ```
 
+> **Sentry:** the browser DSN is baked at build time, so it must be a `--build-arg`
+> (setting `NEXT_PUBLIC_SENTRY_DSN` only in the dashboard won't reach the client). The
+> server/edge runtimes read `SENTRY_DSN` at runtime (set in the dashboard). Both stay inert
+> until a DSN is provided, so it's safe to omit until you're ready. `SENTRY_AUTH_TOKEN` is
+> optional and only uploads source maps for readable stack traces.
+
 > First deploy chicken-and-egg: if you don't have a domain yet, deploy once to get the
 > `*.ondigitalocean.app` URL, then rebuild/push with that URL as `NEXT_PUBLIC_APP_URL`.
 
@@ -114,7 +122,10 @@ Then set every `type: SECRET` value (App → Settings → Environment Variables)
 `.do/app.yaml` before applying. Secrets to fill: `DATABASE_URL`, `DATABASE_CA`,
 `BETTER_AUTH_SECRET`, `GOOGLE_CLIENT_ID/SECRET`, `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`,
 `OPENAI_API_KEY`, `SMTP_USER`, `SMTP_PASS`, `TURNSTILE_SECRET_KEY`, `SPACES_KEY`,
-`SPACES_SECRET`, `CRON_SECRET` (plus the Stripe price IDs). Email sends via **SMTP
+`SPACES_SECRET`, `CRON_SECRET`. Optional integrations (leave blank to keep hidden):
+`QBO_CLIENT_ID/SECRET` + `XERO_CLIENT_ID/SECRET` (accounting), `DOCUSIGN_CLIENT_ID/SECRET`
+(e-signature — not yet in the spec; add if used), and `SENTRY_DSN` (error monitoring —
+plus the `NEXT_PUBLIC_SENTRY_DSN` build-arg above). Email sends via **SMTP
 (SMTP2GO)** — `SMTP_HOST`/`SMTP_PORT`/`EMAIL_FROM` ship as non-secret defaults; without
 `SMTP_USER` + `SMTP_PASS` all outbound email is silently skipped. `${APP_URL}` auto-resolves
 for `BETTER_AUTH_URL` / `NEXT_PUBLIC_APP_URL` at runtime.