Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/actions/admin.ts

@@ -8,6 +8,7 @@ import { z } from "zod"
 import { getAdminSession } from "@/lib/session"
 import { logAdminAction } from "@/lib/admin/audit"
 import { setMaintenanceMode } from "@/lib/settings"
+import { setAiProvider, type AiProvider } from "@/lib/ai/provider"
 import { auth } from "@/lib/auth"
 import { db } from "@/lib/db"
 import { profiles, user as userTable } from "@/lib/db/schema"
@@ -158,3 +159,22 @@ export async function setSiteMaintenance(enabled: boolean, message?: string) {
   revalidatePath("/", "layout")
   return { ok: true }
 }
+
+// ── AI provider ───────────────────────────────────────────────────────────────
+// Chooses which LLM provider powers all AI features (OpenAI or Anthropic/Claude),
+// persisted in app_settings. Applies immediately to every AI route.
+export async function setAiProviderAction(provider: string) {
+  const a = await guard()
+  if (provider !== "openai" && provider !== "anthropic") throw new Error("Invalid AI provider")
+
+  await setAiProvider(provider as AiProvider)
+
+  await logAdminAction({
+    adminId: a.user.id,
+    action: "ai_provider",
+    metadata: { provider },
+  })
+
+  revalidatePath("/admin/system")
+  return { ok: true }
+}