Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/properties/[propertyId]/page.tsx

@@ -3,6 +3,7 @@ import { and, eq, gte } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { properties as propertiesTable, rent_payments, expenses as expensesTable } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import Link from "next/link"
 import { MapPin, Plus, BedDouble, Bath, Edit } from "lucide-react"
 import { formatCurrency, getOccupancyRate } from "@/lib/utils"
@@ -10,11 +11,15 @@ import { DeletePropertyButton } from "@/components/forms/delete-property-button"
 import { AiMaintenanceSummary } from "@/components/forms/ai-maintenance-summary"
 import { PropertyRevenueChart } from "@/components/dashboard/property-revenue-chart"
 import { PropertyPhotoUpload } from "@/components/forms/property-photo-upload"
+import { UnitActions } from "@/components/forms/unit-actions"
+import { PropertyMap } from "@/components/maps/property-map"
 
 export default async function PropertyDetailPage({ params }: { params: Promise<{ propertyId: string }> }) {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { propertyId } = await params
 
   const sixMonthsAgo = new Date()
@@ -24,7 +29,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
 
   const [property, payments, expenses] = await Promise.all([
     db.query.properties.findFirst({
-      where: and(eq(propertiesTable.id, propertyId), eq(propertiesTable.user_id, user.id)),
+      where: and(eq(propertiesTable.id, propertyId), eq(propertiesTable.user_id, ownerId)),
       with: {
         units: {
           with: {
@@ -38,7 +43,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
       .from(rent_payments)
       .where(
         and(
-          eq(rent_payments.user_id, user.id),
+          eq(rent_payments.user_id, ownerId),
           eq(rent_payments.property_id, propertyId),
           gte(rent_payments.due_date, rangeStart)
         )
@@ -48,7 +53,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
       .from(expensesTable)
       .where(
         and(
-          eq(expensesTable.user_id, user.id),
+          eq(expensesTable.user_id, ownerId),
           eq(expensesTable.property_id, propertyId),
           gte(expensesTable.expense_date, rangeStart)
         )
@@ -167,8 +172,11 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
                     )}
                   </div>
                 </div>
-                <div className="text-right">
-                  <p className="text-sm font-semibold text-white">{formatCurrency(unit.rent_amount)}<span className="text-xs text-white/40">/mo</span></p>
+                <div className="flex items-center gap-4">
+                  <div className="text-right">
+                    <p className="text-sm font-semibold text-white">{formatCurrency(unit.rent_amount)}<span className="text-xs text-white/40">/mo</span></p>
+                  </div>
+                  <UnitActions propertyId={propertyId} unitId={unit.id} unitNumber={unit.unit_number} />
                 </div>
               </div>
             ))}
@@ -176,6 +184,28 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
         )}
       </div>
 
+      {/* Location */}
+      {property.latitude != null && property.longitude != null && (
+        <div className="rounded-xl border border-white/[0.06] bg-[#16161f] overflow-hidden">
+          <div className="flex items-center gap-2 border-b border-white/[0.06] px-5 py-4">
+            <MapPin className="h-4 w-4 text-indigo-400" />
+            <h3 className="text-sm font-semibold text-white">Location</h3>
+          </div>
+          <PropertyMap
+            className="h-72 w-full"
+            markers={[
+              {
+                id: property.id,
+                name: property.name,
+                lat: property.latitude,
+                lng: property.longitude,
+                subtitle: `${property.address_line1}, ${property.city}${property.state ? `, ${property.state}` : ""}`,
+              },
+            ]}
+          />
+        </div>
+      )}
+
       {/* Revenue chart */}
       <PropertyRevenueChart data={chartData} />