Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/actions/admin.ts

@@ -7,6 +7,7 @@ import { eq } from "drizzle-orm"
 import { z } from "zod"
 import { getAdminSession } from "@/lib/session"
 import { logAdminAction } from "@/lib/admin/audit"
+import { setMaintenanceMode } from "@/lib/settings"
 import { auth } from "@/lib/auth"
 import { db } from "@/lib/db"
 import { profiles, user as userTable } from "@/lib/db/schema"
@@ -137,3 +138,23 @@ export async function markEmailVerified(userId: string) {
   revalidatePath(`/admin/users/${userId}`)
   return { ok: true }
 }
+
+// ── site maintenance mode ─────────────────────────────────────────────────────
+// Toggles the site-wide maintenance flag (persisted in app_settings). When on,
+// the marketing site and dashboard show a maintenance page to everyone except
+// admins. Revalidates the whole app so the change takes effect immediately.
+export async function setSiteMaintenance(enabled: boolean, message?: string) {
+  const a = await guard()
+  const trimmed = message?.trim() || null
+
+  await setMaintenanceMode({ enabled: Boolean(enabled), message: trimmed })
+
+  await logAdminAction({
+    adminId: a.user.id,
+    action: "maintenance_mode",
+    metadata: { enabled: Boolean(enabled), message: trimmed },
+  })
+
+  revalidatePath("/", "layout")
+  return { ok: true }
+}