Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

components/forms/paypal-cancel-button.tsx

@@ -0,0 +1,32 @@
+"use client"
+
+import { useState } from "react"
+
+export function PaypalCancelButton() {
+  const [loading, setLoading] = useState(false)
+
+  async function handleClick() {
+    if (!confirm("Cancel your PayPal subscription? You'll keep access until the end of the current billing period.")) {
+      return
+    }
+    setLoading(true)
+    const res = await fetch("/api/paypal/cancel", { method: "POST" })
+    const data = await res.json().catch(() => ({}))
+    if (res.ok) {
+      window.location.href = "/settings/billing?canceled=true"
+    } else {
+      setLoading(false)
+      alert(data.error || "Could not cancel the subscription.")
+    }
+  }
+
+  return (
+    <button
+      onClick={handleClick}
+      disabled={loading}
+      className="rounded-lg border border-white/10 px-4 py-2 text-sm text-white/60 hover:border-white/20 hover:text-white transition disabled:opacity-50"
+    >
+      {loading ? "Canceling..." : "Cancel Subscription"}
+    </button>
+  )
+}