Initial import: property management SaaS + security hardening + admin dashboard

Property Management Network — Next.js 16 (App Router), Better Auth,
Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend.

Includes:
- Security hardening: access-control/IDOR fixes, TLS-by-default DB layer,
  constant-time cron auth, strict security headers, atomic AI quota gating,
  HTML/email output encoding, demo-backdoor disabled in production.
- Superadmin dashboard at /admin (overview/MRR, server-paginated users with
  ban/impersonate/plan/delete, billing, platform activity + admin audit log,
  AI usage, system health) via the Better Auth admin plugin.
- Seed/migration utility scripts under scripts/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/activity.ts

@@ -0,0 +1,49 @@
+import { db } from "@/lib/db"
+import { activity_log } from "@/lib/db/schema"
+
+export type ActivityType =
+  | "rent_paid"
+  | "rent_overdue"
+  | "tenant_added"
+  | "tenant_removed"
+  | "maintenance_opened"
+  | "maintenance_resolved"
+  | "lease_created"
+  | "lease_expiring"
+  | "expense_added"
+  | "property_added"
+  | "inspection_completed"
+  | "vendor_added"
+  | "ai_action"
+
+export async function logActivity({
+  userId,
+  type,
+  title,
+  description,
+  entityType,
+  entityId,
+  metadata,
+}: {
+  userId: string
+  type: ActivityType
+  title: string
+  description?: string
+  entityType?: string
+  entityId?: string
+  metadata?: Record<string, unknown>
+}) {
+  try {
+    await db.insert(activity_log).values({
+      user_id: userId,
+      type,
+      title,
+      description: description ?? null,
+      entity_type: entityType ?? null,
+      entity_id: entityId ?? null,
+      metadata: metadata ?? {},
+    })
+  } catch {
+    // Activity logging should never break the main flow
+  }
+}