Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/leases/[leaseId]/page.tsx

@@ -4,13 +4,16 @@ import { db } from "@/lib/db"
 import { leases as leasesTable } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { getAccountContext } from "@/lib/account"
-import { listAdapters, listRequestsForLease } from "@/lib/esign"
+import { listEsignConnections, listRequestsForLease } from "@/lib/esign"
 import Link from "next/link"
-import { FileText, ExternalLink } from "lucide-react"
+import { FileText } from "lucide-react"
 import { formatCurrency, formatDate, daysUntil } from "@/lib/utils"
 import { cn } from "@/lib/utils"
 import { LeaseActions } from "@/components/forms/lease-actions"
 import { EsignLease } from "@/components/forms/esign-lease"
+import { LeaseDocument } from "@/components/forms/lease-document"
+
+const ESIGN_LABEL: Record<string, string> = { docusign: "DocuSign", dropbox_sign: "Dropbox Sign" }
 
 export const metadata = { title: "Lease" }
 
@@ -56,8 +59,12 @@ export default async function LeaseDetailPage({ params }: { params: Promise<{ le
   if (!lease) notFound()
 
   const esignRequests = await listRequestsForLease(ownerId, leaseId)
-  const esignProviders = listAdapters()
-  const canSendEsign = ctx.canWrite && !!lease.document_url && !!lease.tenant?.email
+  const esignConnections = await listEsignConnections(ownerId)
+  const connectedProviders = esignConnections
+    .filter((c) => c.status !== "revoked")
+    .map((c) => ({ id: c.provider, label: ESIGN_LABEL[c.provider] ?? c.provider }))
+  const canSendEsign =
+    ctx.canWrite && !!lease.document_url && !!lease.tenant?.email && connectedProviders.length > 0
   const esignDisabledReason = !ctx.canWrite
     ? "You have read-only access."
     : !lease.document_url
@@ -196,24 +203,11 @@ export default async function LeaseDetailPage({ params }: { params: Promise<{ le
             </div>
           </div>
 
-          {lease.document_url && (
-            <a
-              href={lease.document_url}
-              target="_blank"
-              rel="noopener noreferrer"
-              className="flex items-center justify-between rounded-xl border border-white/[0.06] bg-[#16161f] p-5 transition hover:border-white/15"
-            >
-              <div className="flex items-center gap-2 text-sm font-medium text-white">
-                <FileText className="h-4 w-4 text-indigo-400" />
-                Lease document
-              </div>
-              <ExternalLink className="h-4 w-4 text-white/40" />
-            </a>
-          )}
+          <LeaseDocument leaseId={leaseId} documentUrl={lease.document_url} canWrite={ctx.canWrite} />
 
           <EsignLease
             leaseId={leaseId}
-            providers={esignProviders}
+            connected={connectedProviders}
             requests={esignRequests}
             canSend={canSendEsign}
             disabledReason={esignDisabledReason}