Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(marketing)/layout.tsx

@@ -1,9 +1,23 @@
 import { Navbar } from "@/components/marketing/navbar"
 import { Footer } from "@/components/marketing/footer"
+import { StructuredData } from "@/components/marketing/structured-data"
+import { getSession, isAdminUser } from "@/lib/session"
+import { getMaintenanceMode } from "@/lib/settings"
+import { MaintenanceScreen } from "@/components/shared/maintenance-screen"
+
+export default async function MarketingLayout({ children }: { children: React.ReactNode }) {
+  // Site maintenance mode: show the maintenance screen to everyone except admins.
+  const maintenance = await getMaintenanceMode()
+  if (maintenance.enabled) {
+    const session = await getSession()
+    if (!isAdminUser(session?.user)) {
+      return <MaintenanceScreen message={maintenance.message} />
+    }
+  }
 
-export default function MarketingLayout({ children }: { children: React.ReactNode }) {
   return (
     <div className="min-h-screen bg-[#09090b] text-white">
+      <StructuredData />
       <Navbar />
       {children}
       <Footer />