Deploy on DigitalOcean App Platform (GitHub-source build) + consolidate audit-fixes

Deploy config:
- .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead
  of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the
  propertymanagement.network domain so they bake into the client bundle; add
  custom domains block (apex + www); wire Sentry DSN (server + browser).

Included pending work from the audit-fixes branch:
- AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default)
- Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010
- Outbound webhooks / Zapier integration
- PayPal removal (Stripe-only billing)
- Storage hardening (fail-loud when Spaces unconfigured), security fixes

Verified: full production Docker build (same build-args as DO) passes clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sentry.server.config.ts

@@ -0,0 +1,16 @@
+// Sentry initialization for the Node.js server runtime.
+// Loaded by instrumentation.ts when NEXT_RUNTIME === "nodejs".
+import * as Sentry from "@sentry/nextjs"
+
+const dsn = process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN
+
+Sentry.init({
+  dsn,
+  // Inert until a DSN is configured — safe to ship before Sentry is set up.
+  enabled: !!dsn,
+  environment: process.env.SENTRY_ENVIRONMENT || process.env.NODE_ENV,
+  // Performance tracing — sample less in production to control volume/cost.
+  tracesSampleRate: process.env.NODE_ENV === "production" ? 0.2 : 1.0,
+  // Don't attach PII (IP, cookies, request bodies) by default.
+  sendDefaultPii: false,
+})