Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/rent/send-payment-link/route.ts

@@ -3,13 +3,18 @@ import { and, eq, sql } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { rent_payments, profiles } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
-import { sendEmail, escapeHtml } from "@/lib/email/send"
+import { sendEmail, paymentLinkHtml } from "@/lib/email/send"
 import { paymentLinkSchema } from "@/lib/validations"
+import { getAccountContext } from "@/lib/account"
 
 export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const body = await request.json()
   const parsed = paymentLinkSchema.safeParse(body)
   if (!parsed.success) {
@@ -20,7 +25,7 @@ export async function POST(request: Request) {
 
   // Fetch payment with tenant details
   const payment = await db.query.rent_payments.findFirst({
-    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, user.id)),
+    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, ownerId)),
     with: {
       tenant: { columns: { first_name: true, last_name: true, email: true } },
       property: { columns: { name: true } },
@@ -31,9 +36,9 @@ export async function POST(request: Request) {
   if (!payment) return NextResponse.json({ error: "Payment not found" }, { status: 404 })
   if (!payment.tenant?.email) return NextResponse.json({ error: "Tenant has no email address" }, { status: 400 })
 
-  // Fetch landlord profile for payment instructions
+  // Fetch landlord (portfolio owner) profile for payment instructions
   const profile = await db.query.profiles.findFirst({
-    where: eq(profiles.id, user.id),
+    where: eq(profiles.id, ownerId),
     columns: { full_name: true },
   })
 
@@ -41,27 +46,17 @@ export async function POST(request: Request) {
   const amount = Number(payment.amount).toLocaleString("en-US", { style: "currency", currency: "USD" })
   const dueDate = new Date(payment.due_date).toLocaleDateString("en-US", { month: "long", day: "numeric", year: "numeric" })
 
-  const html = `
-    <div style="font-family:sans-serif;max-width:560px;margin:0 auto;background:#09090b;color:#fff;border-radius:12px;overflow:hidden;">
-      <div style="background:linear-gradient(135deg,#4f46e5,#7c3aed);padding:32px;text-align:center;">
-        <h1 style="margin:0;font-size:24px;font-weight:700;">Rent Payment Due</h1>
-        <p style="margin:8px 0 0;opacity:.8;font-size:14px;">Property Management Network</p>
-      </div>
-      <div style="padding:32px;">
-        <p style="font-size:16px;margin:0 0 8px;">Hi ${escapeHtml(tenantName)},</p>
-        <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 24px;">
-          Your rent payment of <strong style="color:#fff;">${amount}</strong> is due on <strong style="color:#fff;">${dueDate}</strong>
-          for ${escapeHtml(payment.property?.name)}${payment.unit ? ` Unit ${escapeHtml(payment.unit.unit_number)}` : ""}.
-        </p>
-        <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 16px;">
-          Please arrange payment at your earliest convenience. Contact your landlord if you have any questions.
-        </p>
-        <p style="color:rgba(255,255,255,.4);font-size:12px;margin:24px 0 0;border-top:1px solid rgba(255,255,255,.08);padding-top:16px;">
-          Sent by ${escapeHtml(profile?.full_name ?? "Your Landlord")} via Property Management Network
-        </p>
-      </div>
-    </div>
-  `
+  const propertyLabel = `${payment.property?.name ?? "your property"}${
+    payment.unit ? ` — Unit ${payment.unit.unit_number}` : ""
+  }`
+
+  const html = paymentLinkHtml({
+    tenantName,
+    amount,
+    dueDate,
+    propertyLabel,
+    senderName: profile?.full_name ?? "Your Landlord",
+  })
 
   try {
     await sendEmail({
@@ -76,7 +71,7 @@ export async function POST(request: Request) {
   // Update rent_payment to mark reminder sent
   try {
     await db.execute(
-      sql`update rent_payments set reminder_sent_at = now() where id = ${payment_id} and user_id = ${user.id}`
+      sql`update rent_payments set reminder_sent_at = now() where id = ${payment_id} and user_id = ${ownerId}`
     )
   } catch {
     // Email sent successfully, but tracking update failed — still return ok