Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/esign/state.ts

@@ -0,0 +1,39 @@
+import crypto from "crypto"
+
+// Signed OAuth `state` for the e-sign connect flow — carries the initiating
+// owner + provider + a random nonce (bound to a cookie by the connect route),
+// plus an issued-at so a leaked state can't be replayed. Mirrors the hardened
+// accounting OAuth state; fails closed if BETTER_AUTH_SECRET is missing.
+
+const STATE_TTL_MS = 10 * 60 * 1000 // 10 minutes
+
+export const ESIGN_NONCE_COOKIE = "esign_oauth_nonce"
+
+function secret(): string {
+  const s = process.env.BETTER_AUTH_SECRET
+  if (!s) throw new Error("BETTER_AUTH_SECRET is not set — required to sign OAuth state")
+  return s
+}
+
+export type EsignOAuthState = { ownerId: string; provider: string; nonce: string }
+
+export function signState(data: EsignOAuthState): string {
+  const payload = Buffer.from(JSON.stringify({ ...data, iat: Date.now() })).toString("base64url")
+  const sig = crypto.createHmac("sha256", secret()).update(payload).digest("base64url")
+  return `${payload}.${sig}`
+}
+
+export function verifyState(state: string): EsignOAuthState | null {
+  const [payload, sig] = state.split(".")
+  if (!payload || !sig) return null
+  const expect = crypto.createHmac("sha256", secret()).update(payload).digest("base64url")
+  if (sig.length !== expect.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expect))) return null
+  try {
+    const obj = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as EsignOAuthState & { iat?: number }
+    if (!obj.iat || Date.now() - obj.iat > STATE_TTL_MS) return null
+    if (!obj.ownerId || !obj.provider || !obj.nonce) return null
+    return { ownerId: obj.ownerId, provider: obj.provider, nonce: obj.nonce }
+  } catch {
+    return null
+  }
+}