Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

components/analytics/umami.tsx

@@ -0,0 +1,29 @@
+import Script from "next/script"
+
+// Umami — privacy-friendly, cookieless web analytics.
+//
+// Loads only in production so local dev traffic isn't tracked. The script src
+// and website id are public by design (they appear in the served HTML), so the
+// defaults are hardcoded here; override them via NEXT_PUBLIC_UMAMI_SRC /
+// NEXT_PUBLIC_UMAMI_WEBSITE_ID to point at a different instance, or set the id
+// to an empty string to disable. Umami v2 auto-tracks client-side route
+// changes, so Next.js navigations are captured without extra wiring.
+const UMAMI_SRC =
+  process.env.NEXT_PUBLIC_UMAMI_SRC || "https://fickanalytics.phluit.net/script.js"
+const UMAMI_WEBSITE_ID =
+  process.env.NEXT_PUBLIC_UMAMI_WEBSITE_ID ?? "4066c359-596f-4d0e-9636-c035c2adfbe8"
+
+export function UmamiAnalytics() {
+  // Never track local development.
+  if (process.env.NODE_ENV !== "production") return null
+  if (!UMAMI_SRC || !UMAMI_WEBSITE_ID) return null
+
+  return (
+    <Script
+      src={UMAMI_SRC}
+      data-website-id={UMAMI_WEBSITE_ID}
+      strategy="afterInteractive"
+      defer
+    />
+  )
+}