Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

components/shared/maintenance-screen.tsx

@@ -0,0 +1,20 @@
+import { Logo } from "@/components/shared/logo"
+
+/**
+ * Full-screen "we'll be right back" notice rendered in place of the app when
+ * site maintenance mode is on (for everyone except admins).
+ */
+export function MaintenanceScreen({ message }: { message?: string | null }) {
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-6 bg-[#09090b] px-6 text-center text-white">
+      <Logo size="lg" href={null} />
+      <div className="max-w-md">
+        <h1 className="text-3xl font-bold tracking-tight">We&apos;ll be right back</h1>
+        <p className="mt-3 text-white/60 leading-relaxed">
+          {message ||
+            "The site is temporarily offline for scheduled maintenance. Please check back shortly — thanks for your patience."}
+        </p>
+      </div>
+    </div>
+  )
+}