Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/upload/route.ts

@@ -1,7 +1,13 @@
 import { NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/session"
 import { getAccountContext } from "@/lib/account"
-import { saveFile, isAllowedUploadExt, StorageNotConfiguredError } from "@/lib/storage"
+import {
+  saveFile,
+  isAllowedUploadExt,
+  StorageNotConfiguredError,
+  contentMatchesExtension,
+  extOf,
+} from "@/lib/storage"
 import { checkStorageLimit } from "@/lib/plan-limits"
 
 const ALLOWED_SCOPES = ["property-images", "maintenance", "documents", "misc"]
@@ -33,6 +39,12 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "File type not allowed" }, { status: 400 })
   }
 
+  // Reject files whose real content doesn't match the claimed extension.
+  const head = Buffer.from(await file.slice(0, 16).arrayBuffer())
+  if (!contentMatchesExtension(head, extOf(file.name))) {
+    return NextResponse.json({ error: "File content does not match its type" }, { status: 400 })
+  }
+
   // Enforce per-plan storage quota (accounts for everything already stored in
   // the owner's portfolio namespace).
   const storageError = await checkStorageLimit(ownerId, file.size)