Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(auth)/forgot-password/page.tsx

@@ -1,5 +1,6 @@
 import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
+import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { resetPassword } from "@/app/actions/auth"
 
 export default async function ForgotPasswordPage({
@@ -49,6 +50,8 @@ export default async function ForgotPasswordPage({
             />
           </div>
 
+          <TurnstileWidget />
+
           <button
             type="submit"
             className="w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"

app/(auth)/login/page.tsx

@@ -1,15 +1,17 @@
 import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
+import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signIn, signInWithGoogle } from "@/app/actions/auth"
 
 export default async function LoginPage({
   searchParams,
 }: {
-  searchParams: Promise<{ error?: string; success?: string }>
+  searchParams: Promise<{ error?: string; success?: string; next?: string }>
 }) {
   const params = await searchParams
   const error = params.error
   const success = params.success
+  const next = typeof params.next === "string" && params.next.startsWith("/") ? params.next : ""
 
   return (
     <div className="w-full">
@@ -54,6 +56,7 @@ export default async function LoginPage({
 
         {/* Email + Password form */}
         <form action={signIn} className="space-y-4">
+          {next && <input type="hidden" name="next" value={next} />}
           <div>
             <label htmlFor="email" className="mb-1.5 block text-sm font-medium text-white/70">
               Email
@@ -89,6 +92,8 @@ export default async function LoginPage({
             />
           </div>
 
+          <TurnstileWidget />
+
           <button
             type="submit"
             className="mt-2 w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"

app/(auth)/signup/page.tsx

@@ -1,15 +1,17 @@
 import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
+import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signUp, signInWithGoogle } from "@/app/actions/auth"
 
 export default async function SignupPage({
   searchParams,
 }: {
-  searchParams: Promise<{ error?: string; success?: string }>
+  searchParams: Promise<{ error?: string; success?: string; next?: string }>
 }) {
   const params = await searchParams
   const error = params.error
   const success = params.success
+  const next = typeof params.next === "string" && params.next.startsWith("/") ? params.next : ""
 
   if (success === "check-email") {
     return (
@@ -72,6 +74,7 @@ export default async function SignupPage({
         )}
 
         <form action={signUp} className="space-y-4">
+          {next && <input type="hidden" name="next" value={next} />}
           <div>
             <label htmlFor="full_name" className="mb-1.5 block text-sm font-medium text-white/70">
               Full name
@@ -118,6 +121,8 @@ export default async function SignupPage({
             />
           </div>
 
+          <TurnstileWidget />
+
           <button
             type="submit"
             className="mt-2 w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"