Security hardening from 2026-07-01 audit

- Exclude supabase/ from Docker build context (leaked service_role key file)
- /api/files: exact per-user namespace match + reject path traversal;
  storage resolveKey rejects ".."/"." segments (fixes cross-user file read)
- Add ownsProperty/Unit/Tenant checks to tenants, maintenance (landlord path),
  and documents (JSON branch, now field-whitelisted) create handlers
- Escape user data in follow-up + payment-link emails (reuse escapeHtml)
- Neutralize CSV formula injection in toCsv + export routes
- Tighter sign-in rate limit (10/min); env-gated email verification + sender
- Per-request nonce CSP; drop script-src 'unsafe-inline' (styles unchanged)
- Add input length bounds; validate follow-ups POST body

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/rent/send-payment-link/route.ts

@@ -3,7 +3,7 @@ import { and, eq, sql } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { rent_payments, profiles } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
-import { sendEmail } from "@/lib/email/send"
+import { sendEmail, escapeHtml } from "@/lib/email/send"
 import { paymentLinkSchema } from "@/lib/validations"
 
 export async function POST(request: Request) {
@@ -48,16 +48,16 @@ export async function POST(request: Request) {
         <p style="margin:8px 0 0;opacity:.8;font-size:14px;">Property Management Network</p>
       </div>
       <div style="padding:32px;">
-        <p style="font-size:16px;margin:0 0 8px;">Hi ${tenantName},</p>
+        <p style="font-size:16px;margin:0 0 8px;">Hi ${escapeHtml(tenantName)},</p>
         <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 24px;">
           Your rent payment of <strong style="color:#fff;">${amount}</strong> is due on <strong style="color:#fff;">${dueDate}</strong>
-          for ${payment.property?.name}${payment.unit ? ` Unit ${payment.unit.unit_number}` : ""}.
+          for ${escapeHtml(payment.property?.name)}${payment.unit ? ` Unit ${escapeHtml(payment.unit.unit_number)}` : ""}.
         </p>
         <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 16px;">
           Please arrange payment at your earliest convenience. Contact your landlord if you have any questions.
         </p>
         <p style="color:rgba(255,255,255,.4);font-size:12px;margin:24px 0 0;border-top:1px solid rgba(255,255,255,.08);padding-top:16px;">
-          Sent by ${profile?.full_name ?? "Your Landlord"} via Property Management Network
+          Sent by ${escapeHtml(profile?.full_name ?? "Your Landlord")} via Property Management Network
         </p>
       </div>
     </div>