Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/integrations/[provider]/connect/route.ts

@@ -1,8 +1,9 @@
+import crypto from "crypto"
 import { NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/session"
 import { getAccountContext } from "@/lib/account"
 import { getProvider } from "@/lib/accounting"
-import { signState } from "@/lib/accounting/state"
+import { signState, OAUTH_NONCE_COOKIE } from "@/lib/accounting/state"
 
 // Starts the OAuth connect flow for an accounting provider (owner-only).
 export async function GET(request: Request, { params }: { params: Promise<{ provider: string }> }) {
@@ -28,6 +29,17 @@ export async function GET(request: Request, { params }: { params: Promise<{ prov
     return NextResponse.redirect(settings)
   }
 
-  const state = signState({ ownerId: ctx.ownerId, provider: pid })
-  return NextResponse.redirect(prov.getAuthUrl(state))
+  // Bind the OAuth round-trip to this browser: a random nonce goes into the
+  // signed state AND an httpOnly cookie; the callback requires them to match.
+  const nonce = crypto.randomUUID()
+  const state = signState({ ownerId: ctx.ownerId, provider: pid, nonce })
+  const res = NextResponse.redirect(prov.getAuthUrl(state))
+  res.cookies.set(OAUTH_NONCE_COOKIE, nonce, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: 600,
+  })
+  return res
 }