Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

instrumentation.ts

@@ -0,0 +1,36 @@
+// Next.js instrumentation hook — runs once when the server process starts.
+// Surfaces "silently disabled" integrations at boot so a misconfigured deploy is
+// obvious in the logs instead of failing quietly at runtime.
+export function register() {
+  // Only run in the Node.js server runtime (not edge/middleware) and only in prod.
+  if (process.env.NEXT_RUNTIME !== "nodejs") return
+  if (process.env.NODE_ENV !== "production") return
+
+  const warn = (msg: string) => console.warn(`[startup] ⚠ ${msg}`)
+
+  const spacesConfigured =
+    process.env.SPACES_KEY && process.env.SPACES_SECRET && process.env.SPACES_BUCKET
+  if (!spacesConfigured) {
+    warn(
+      "Object storage (SPACES_*) is NOT configured — uploads fall back to local disk, " +
+        "which is EPHEMERAL on App Platform. Uploaded files are lost on every deploy/restart. " +
+        "Configure DigitalOcean Spaces."
+    )
+  }
+
+  const smtpConfigured = process.env.SMTP_HOST && process.env.SMTP_USER && process.env.SMTP_PASS
+  if (!smtpConfigured) {
+    warn(
+      "SMTP (SMTP_HOST / SMTP_USER / SMTP_PASS) is NOT configured — all outbound email " +
+        "(rent reminders, overdue/lease alerts, team invites, password resets) will silently fail."
+    )
+  }
+
+  if (!process.env.STRIPE_SECRET_KEY) {
+    warn("STRIPE_SECRET_KEY is NOT set — checkout/billing and rent payment links are disabled.")
+  }
+
+  if (!process.env.OPENAI_API_KEY) {
+    warn("OPENAI_API_KEY is NOT set — AI features will error when called.")
+  }
+}