Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

functions/project.yml

@@ -0,0 +1,56 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# DigitalOcean Functions — scheduled cron for Property Management Network.
+#
+# App Platform has no native cron, so the two daily jobs are driven by DO
+# Functions scheduler triggers that call the app's CRON_SECRET-protected
+# endpoints. Deploy separately from the App Platform app:
+#
+#   doctl serverless deploy functions --env functions/.env
+#
+# Create functions/.env (gitignored) with:
+#   APP_BASE_URL=https://<your-app-url>      # no trailing slash
+#   CRON_SECRET=<same value as the app's CRON_SECRET>
+# ─────────────────────────────────────────────────────────────────────────────
+parameters: {}
+packages:
+  - name: cron
+    functions:
+      - name: run
+        runtime: 'nodejs:18'
+        web: false
+        environment:
+          APP_BASE_URL: ${APP_BASE_URL}
+          CRON_SECRET: ${CRON_SECRET}
+triggers:
+  # Rent reminders, overdue marking, 60/30/7-day lease-expiry emails — 09:00 UTC.
+  - name: daily
+    sourceType: scheduler
+    sourceDetails:
+      cron: '0 9 * * *'
+      withBody:
+        job: daily
+    function: cron/run
+  # Late fees (5% after the grace period) — 08:00 UTC.
+  - name: late-fees
+    sourceType: scheduler
+    sourceDetails:
+      cron: '0 8 * * *'
+      withBody:
+        job: late-fees
+    function: cron/run
+  # Automated follow-ups for all users with active rules — 10:00 UTC.
+  - name: follow-ups
+    sourceType: scheduler
+    sourceDetails:
+      cron: '0 10 * * *'
+      withBody:
+        job: follow-ups
+    function: cron/run
+  # Outbound webhook delivery retries — every 5 minutes.
+  - name: webhooks
+    sourceType: scheduler
+    sourceDetails:
+      cron: '*/5 * * * *'
+      withBody:
+        job: webhooks
+    function: cron/run