Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/esign/registry.ts

@@ -0,0 +1,21 @@
+import { docusign } from "./docusign"
+import { dropboxSign } from "./dropbox-sign"
+import type { ESignAdapter, ESignProvider } from "./types"
+
+// Adapter registry — dependency-free (no db) so it can be imported anywhere,
+// including the credential resolver, without creating import cycles.
+const ADAPTERS: Record<ESignProvider, ESignAdapter> = { docusign, dropbox_sign: dropboxSign }
+
+export function getAdapter(id: string): ESignAdapter | null {
+  return id === "docusign" || id === "dropbox_sign" ? ADAPTERS[id] : null
+}
+
+/** Providers the platform can offer, with their connect style + availability. */
+export function listEsignAdapters() {
+  return (Object.keys(ADAPTERS) as ESignProvider[]).map((id) => ({
+    id,
+    label: ADAPTERS[id].label,
+    kind: ADAPTERS[id].kind,
+    available: ADAPTERS[id].available(),
+  }))
+}