Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/layout.tsx

@@ -2,7 +2,9 @@ import { redirect } from "next/navigation"
 import { eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { profiles } from "@/lib/db/schema"
-import { getSession } from "@/lib/session"
+import { getSession, isAdminUser } from "@/lib/session"
+import { getMaintenanceMode } from "@/lib/settings"
+import { MaintenanceScreen } from "@/components/shared/maintenance-screen"
 import { Sidebar } from "@/components/dashboard/sidebar"
 import { Header } from "@/components/dashboard/header"
 import { CommandPalette } from "@/components/dashboard/command-palette"
@@ -19,6 +21,12 @@ export default async function DashboardLayout({ children }: { children: React.Re
     redirect("/login")
   }
 
+  // Site maintenance mode: everyone except admins sees the maintenance screen.
+  const maintenance = await getMaintenanceMode()
+  if (maintenance.enabled && !isAdminUser(user)) {
+    return <MaintenanceScreen message={maintenance.message} />
+  }
+
   const profile = await db.query.profiles.findFirst({
     where: eq(profiles.id, user.id),
   })
@@ -30,7 +38,7 @@ export default async function DashboardLayout({ children }: { children: React.Re
     <div className="flex h-screen flex-col bg-[#09090b] overflow-hidden">
       {impersonating && <ImpersonationBanner label={profile?.email ?? user.email} />}
       <div className="flex flex-1 overflow-hidden">
-        <Sidebar profile={profile ?? null} />
+        <Sidebar profile={profile ?? null} isAdmin={isAdminUser(user)} />
         <div className="flex flex-1 flex-col overflow-hidden">
           <Header />
           <main id="main-scroll" className="flex-1 overflow-y-auto p-4 sm:p-6">