Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/settings/billing/page.tsx

@@ -5,7 +5,9 @@ import { profiles, properties, tenants } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { CheckoutButton } from "@/components/forms/checkout-button"
 import { PortalButton } from "@/components/forms/portal-button"
-import { getPlanLabel, PLAN_LIMITS } from "@/lib/stripe/plans"
+import { PaypalCancelButton } from "@/components/forms/paypal-cancel-button"
+import { getPlanLabel, PLAN_LIMITS, annualEnabled } from "@/lib/stripe/plans"
+import { paypalConfigured } from "@/lib/paypal/client"
 import { Check } from "lucide-react"
 import type { Plan } from "@/types"
 
@@ -57,7 +59,7 @@ const PLANS = [
 export default async function BillingPage({
   searchParams,
 }: {
-  searchParams: Promise<{ success?: string; canceled?: string }>
+  searchParams: Promise<{ success?: string; canceled?: string; error?: string }>
 }) {
   const user = await getSessionUser()
   if (!user) redirect("/login")
@@ -70,13 +72,18 @@ export default async function BillingPage({
       plan_expires_at: true,
       stripe_customer_id: true,
       stripe_subscription_id: true,
+      paypal_subscription_id: true,
+      billing_provider: true,
     },
   })
 
   const params = await searchParams
   const currentPlan = (profile?.plan ?? "starter") as Plan
   const hasStripeAccount = !!profile?.stripe_customer_id
+  const isPaypal = profile?.billing_provider === "paypal" || !!profile?.paypal_subscription_id
+  const paypalEnabled = paypalConfigured()
   const limits = PLAN_LIMITS[currentPlan]
+  const canBillAnnually = annualEnabled()
 
   const [[{ count: propertiesUsed }], [{ count: tenantsUsed }]] = await Promise.all([
     db
@@ -106,6 +113,11 @@ export default async function BillingPage({
           Checkout canceled — no charge was made.
         </div>
       )}
+      {params.error === "paypal" && (
+        <div className="rounded-xl border border-red-500/20 bg-red-500/10 px-5 py-4 text-sm text-red-400">
+          We couldn&apos;t complete your PayPal payment. No charge was made — please try again.
+        </div>
+      )}
 
       {/* Current plan */}
       <div className="rounded-xl border border-white/[0.06] bg-[#16161f] p-5">
@@ -117,9 +129,12 @@ export default async function BillingPage({
               <p className="mt-0.5 text-xs text-white/40 capitalize">Status: {profile.subscription_status}</p>
             )}
           </div>
-          {hasStripeAccount && currentPlan !== "starter" && currentPlan !== "lifetime" && (
-            <PortalButton />
-          )}
+          {currentPlan !== "starter" && currentPlan !== "lifetime" &&
+            (isPaypal ? (
+              <PaypalCancelButton />
+            ) : hasStripeAccount ? (
+              <PortalButton />
+            ) : null)}
         </div>
       </div>
 
@@ -177,7 +192,13 @@ export default async function BillingPage({
                     {plan.key === "starter" ? "Free" : "Downgrade via portal"}
                   </div>
                 ) : (
-                  <CheckoutButton plan={plan.key} label={plan.cta} highlight={plan.highlight} />
+                  <CheckoutButton
+                    plan={plan.key}
+                    label={plan.cta}
+                    highlight={plan.highlight}
+                    annualAvailable={canBillAnnually && plan.key !== "lifetime"}
+                    paypalEnabled={paypalEnabled}
+                  />
                 )}
               </div>
             </div>