Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/accounting/state.ts

@@ -0,0 +1,23 @@
+import crypto from "crypto"
+
+// Signed OAuth `state` (HMAC-SHA256) — carries the initiating owner + provider
+// and is tamper-proof, so the callback can't be forged/CSRF'd.
+const SECRET = process.env.BETTER_AUTH_SECRET ?? "dev-secret"
+
+export function signState(data: { ownerId: string; provider: string }): string {
+  const payload = Buffer.from(JSON.stringify(data)).toString("base64url")
+  const sig = crypto.createHmac("sha256", SECRET).update(payload).digest("base64url")
+  return `${payload}.${sig}`
+}
+
+export function verifyState(state: string): { ownerId: string; provider: string } | null {
+  const [payload, sig] = state.split(".")
+  if (!payload || !sig) return null
+  const expect = crypto.createHmac("sha256", SECRET).update(payload).digest("base64url")
+  if (sig.length !== expect.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expect))) return null
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"))
+  } catch {
+    return null
+  }
+}