Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/account.ts

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { account_members } from "@/lib/db/schema"
+
+export type AccountRole = "owner" | "member" | "viewer"
+
+export type AccountContext = {
+  /** The logged-in user. */
+  userId: string
+  /** Whose portfolio the user operates on — themselves if they're an owner. */
+  ownerId: string
+  role: AccountRole
+  isOwner: boolean
+  /** Owners and members can write; viewers are read-only. */
+  canWrite: boolean
+}
+
+/**
+ * Resolve the account a user operates under (TEAM ACCESS).
+ *
+ * If the user is an ACTIVE member of another owner's account, they act on that
+ * owner's data; otherwise they own their own account. A user can be an active
+ * member of at most one account. This is the single source of truth for team
+ * scoping — data queries must scope by `ownerId`, not the raw session user id.
+ *
+ * Fails safe: on any error it returns the user as their own owner (they only
+ * ever see their own data), never someone else's.
+ */
+export async function getAccountContext(userId: string): Promise<AccountContext> {
+  try {
+    const membership = await db.query.account_members.findFirst({
+      where: and(eq(account_members.member_id, userId), eq(account_members.status, "active")),
+    })
+    if (membership) {
+      const role: AccountRole = membership.role === "viewer" ? "viewer" : "member"
+      return {
+        userId,
+        ownerId: membership.owner_id,
+        role,
+        isOwner: false,
+        canWrite: role !== "viewer",
+      }
+    }
+  } catch {
+    // fall through to self-owned context
+  }
+  return { userId, ownerId: userId, role: "owner", isOwner: true, canWrite: true }
+}
+
+/** The user_id that data queries/ownership checks should be scoped by. */
+export async function getEffectiveOwnerId(userId: string): Promise<string> {
+  return (await getAccountContext(userId)).ownerId
+}