Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/upload/route.ts

@@ -1,32 +1,23 @@
 import { NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/session"
-import { saveFile } from "@/lib/storage"
+import { getAccountContext } from "@/lib/account"
+import { saveFile, isAllowedUploadExt, StorageNotConfiguredError } from "@/lib/storage"
+import { checkStorageLimit } from "@/lib/plan-limits"
 
 const ALLOWED_SCOPES = ["property-images", "maintenance", "documents", "misc"]
 
-// Allowlisted upload extensions. Deliberately excludes svg and any html/script
-// types, which can execute JavaScript when served inline from our origin.
-const ALLOWED_EXTENSIONS = [
-  "pdf",
-  "png",
-  "jpg",
-  "jpeg",
-  "gif",
-  "webp",
-  "doc",
-  "docx",
-  "xls",
-  "xlsx",
-  "csv",
-  "txt",
-]
-
-// Generic authenticated upload endpoint. Saves the file to local disk under the
-// user's namespace and returns a URL pointing at the auth-gated /api/files route.
+// Generic authenticated upload endpoint. Persists the file under the user's
+// namespace (DigitalOcean Spaces when configured, else local disk in dev) and
+// returns a URL pointing at the auth-gated /api/files route.
 export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  // Uploads belong to the effective owner's portfolio. Viewers are read-only.
+  const ctx = await getAccountContext(user.id)
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+  const ownerId = ctx.ownerId
+
   const fd = await request.formData()
   const file = fd.get("file") as File | null
   const scopeRaw = (fd.get("scope") as string) || "misc"
@@ -38,12 +29,29 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "File too large (max 20 MB)" }, { status: 400 })
   }
 
-  const ext = file.name.split(".").pop()?.toLowerCase() ?? ""
-  if (!ALLOWED_EXTENSIONS.includes(ext)) {
+  if (!isAllowedUploadExt(file.name)) {
     return NextResponse.json({ error: "File type not allowed" }, { status: 400 })
   }
 
-  const { key, size, type } = await saveFile(file, { userId: user.id, scope, fixedName })
+  // Enforce per-plan storage quota (accounts for everything already stored in
+  // the owner's portfolio namespace).
+  const storageError = await checkStorageLimit(ownerId, file.size)
+  if (storageError) return NextResponse.json({ error: storageError }, { status: 403 })
+
+  let saved
+  try {
+    saved = await saveFile(file, { userId: ownerId, scope, fixedName })
+  } catch (err) {
+    if (err instanceof StorageNotConfiguredError) {
+      console.error("[upload]", err.message)
+      return NextResponse.json(
+        { error: "File uploads are temporarily unavailable. Please try again later." },
+        { status: 503 }
+      )
+    }
+    throw err
+  }
+  const { key, size, type } = saved
 
   return NextResponse.json({
     url: `/api/files/${key}`,